Conversation
Phase 1 hardening for the anti-debug protection. The core complaint — a debugger (e.g. dnSpy F5) can attach and the app runs before the async worker ever checks — is fixed portably: - Safe and Win32 modes now run a BLOCKING debugger check inside Initialize() (injected at the top of the module cctor), so an assembly launched under a debugger fails immediately, before any user code runs, instead of only being caught later on the background thread. - Win32's startup check also calls the native IsDebuggerPresent(). - Reduced the watchdog poll interval from 1000ms to 200ms and removed the 500ms initial sleep, shrinking the detection race window. Deliberately NOT changing the default mode from Safe to Win32 (issue's proposal 1): Win32 P/Invokes ntdll/kernel32 and would crash cross-platform .NET targets on non-Windows, conflicting with the project's all-frameworks goal. The strengthened Safe mode addresses the reported issue portably; OS-aware mode selection is a larger Phase 2 change. Added AntiDebug.Test (safe + win32) as a regression guard that an anti-debug protected assembly still runs normally when not debugged (START/output/exit 42).
mcpolo99
deleted the
76-anti-debug-protection-is-ineffective-in-safe-mode-dnspy-can-run-and-debug-protected-assemblies
branch
July 4, 2026 12:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 1 hardening for #76 — the anti-debug protection let a debugger (dnSpy F5) attach and the app ran before the async worker ever checked.
Fixes #76
Changes (Safe + Win32 runtime)
Initialize()(injected at the top of the module cctor): if a debugger is attached when the module loads, the app fails immediately — before any user code — instead of only being caught later on the background thread. This is the fix for the dnSpy-F5 case.IsDebuggerPresent().Deliberately deferred: default Safe → Win32 (issue proposal #1)
Win32 P/Invokes
ntdll/kernel32and would crash cross-platform .NET targets on non-Windows, conflicting with the project's all-frameworks goal. The strengthened Safe mode fixes the reported issue portably; OS-aware mode selection is a larger Phase 2 change.Test
New
AntiDebug.Test(safe + win32) — regression guard that an anti-debug-protected assembly still runs normally when not debugged (START / output / exit 42). Both cases green locally. Verified the injected runtime rebuilds (net20).Not in this PR (Phase 2, per issue)
Hash-based process detection, anti-attach, OS-aware checks, Antinet .NET Core support.