Countering Anti-Debugging Techniques: Enhancing Transparency in Nested Virtualization using HyperDbg
Modern malware increasingly employs sophisticated anti-debugging and anti-virtualization techniques to evade analysis, particularly targeting artifacts left by virtualization and nested virtualization environments such as VMware Workstation, Hyper-V, and KVM. HyperDbg, an open-source hypervisor-level debugger, introduces advanced mechanisms to mitigate both its own hypervisor footprints and those of the underlying nested virtualization stack. In this talk, we demonstrate the capabilities of adding a transparency layer on top of the HyperDbg debugger to detect, mitigate, and bypass common and advanced anti-debugging methods leveraged against such environments. Although achieving complete transparency remains infeasible, it significantly raises the bar for malware attempting to detect analysis environments, making evasion substantially more difficult. We further highlight the critical importance of these techniques in practical malware analysis workflows, particularly in scenarios involving snapshot restoration for analyzing and debugging internal malware behavior. By reducing observable artifacts, HyperDbg enhances the reliability of snapshot-based analysis and debugging, allowing researchers to stealthily investigate and understand the inner workings of evasive malware without premature detection or execution of anti-analysis payloads.
Fri 4 JulDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
10:45 - 12:30 | |||
10:45 30mTalk | Automatic Data Structures Visualization in IntelliJ IDEA DEBT | ||
11:15 30mTalk | Countering Anti-Debugging Techniques: Enhancing Transparency in Nested Virtualization using HyperDbg DEBT | ||
11:45 30mTalk | Trace Debugger: Interactive Execution Trace Debugging for Java and Kotlin DEBT Dmitrii Artiukhov JetBrains, Bob Brockbernd JetBrains, Evgeniia Fedotova JetBrains Research, Nikita Koval JetBrains, Ivan Kylchik JetBrains, Evgenii Moiseenko JetBrains Research, Lev Serebryakov JetBrains, Evgeniy Zhelenskiy JetBrains, Maksim Zuev JetBrains | ||
12:15 15mDay closing | Closing by the workshop organizers DEBT |