Host Operating System Selection Wiki Page Discussion

[Patrick]

Going to address other parts later.

@madaidan

@Patrick

Also a related interesting consideration: Then also some malware behaves different if run inside a a VM or detects a debugger. I am not saying Windows is currently doing that, but it could in theory.

Debuggers don’t execute any code. They read from the binary itself. That’s not possible.

Anti-disassembly, Anti-debugging and Anti-VM are properties of sophisticated malware and other programs.
(I am not saying this is perfect, unbreakable.)

Quote Sign in - Google Accounts

The purpose of anti-debugging is to hinder the process of reverse engineering. There could be several general approaches: (1) to detect the existence of a debugger, and behave differently when a debugger is attached to the current process; (2) to disrupt or crash a debugger. Approach (1) is the mostly frequently applied (see an excellent survey in [2]). Approach (2) is rare (it targets and attacks a debugger - and we will see several examples in Max++ later). Today, we concentrate on Approach (1).

Anti-disassembly, anti-debugging and anti-VM | Infosec

Many web search results for:

anti-debugging

[madaidan]

You don’t necessarily need to attach a debugger to the current running code or even execute it at all. One could use e.g. objdump and extract all the static assembly.

[Patrick]

@madaidan

You don’t necessarily need to attach a debugger to the current running code or even execute it at all. One could use e.g. objdump and extract all the static assembly.

That won’t get you far with obfuscated binaries such as Skype. See how difficult that was:
https://www.oklabs.net/skype-reverse-engineering-the-long-journey/