ECOOP 2025
Mon 30 June - Fri 4 July 2025 Bergen, Norway
Fri 4 Jul 2025 11:15 - 11:45 at M209 - Session 1

Modern malware increasingly employs sophisticated anti-debugging and anti-virtualization techniques to evade analysis, particularly targeting artifacts left by virtualization and nested virtualization environments such as VMware Workstation, Hyper-V, and KVM. HyperDbg, an open-source hypervisor-level debugger, introduces advanced mechanisms to mitigate both its own hypervisor footprints and those of the underlying nested virtualization stack. In this talk, we demonstrate the capabilities of adding a transparency layer on top of the HyperDbg debugger to detect, mitigate, and bypass common and advanced anti-debugging methods leveraged against such environments. Although achieving complete transparency remains infeasible, it significantly raises the bar for malware attempting to detect analysis environments, making evasion substantially more difficult. We further highlight the critical importance of these techniques in practical malware analysis workflows, particularly in scenarios involving snapshot restoration for analyzing and debugging internal malware behavior. By reducing observable artifacts, HyperDbg enhances the reliability of snapshot-based analysis and debugging, allowing researchers to stealthily investigate and understand the inner workings of evasive malware without premature detection or execution of anti-analysis payloads.

Fri 4 Jul

Displayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change

10:45 - 12:30
Session 1DEBT at M209
10:45
30m
Talk
Automatic Data Structures Visualization in IntelliJ IDEA
DEBT
Grigorii Emdin JetBrains, EPFL, Dmitrii Kirkhmeier JetBrains, Nikita Koval JetBrains
11:15
30m
Talk
Countering Anti-Debugging Techniques: Enhancing Transparency in Nested Virtualization using HyperDbg
DEBT
Björn Ruytenberg Vrije Universiteit Amsterdam, Mohammad Sina Karvandi Vrije Universiteit Amsterdam
11:45
30m
Talk
Trace Debugger: Interactive Execution Trace Debugging for Java and Kotlin
DEBT
Dmitrii Artiukhov JetBrains, Bob Brockbernd JetBrains, Evgeniia Fedotova JetBrains Research, Nikita Koval JetBrains, Ivan Kylchik JetBrains, Evgenii Moiseenko JetBrains Research, Lev Serebryakov JetBrains, Evgeniy Zhelenskiy JetBrains, Maksim Zuev JetBrains
12:15
15m
Day closing
Closing by the workshop organizers
DEBT
Burcu Kulahcioglu Ozkan Delft University of Technology, Tom Lauwaerts Universiteit Gent, Belgium
:
:
:
: