Anti-Debugging, Anti-Instrumentation, Anti-Emulation, Anti-VM, and Sandbox-Evasion Specification-Level Report

Platforms: Windows NT-family, Linux, macOS / Darwin, with notes for iOS-family divergence, Apple Silicon, WOW64, x86/x86-64, and AArch64.
Orientation: defensive reverse engineering, malware analysis, sandbox/EDR design, triage, and reproducibility engineering.
Corpus policy: this report synthesizes the uploaded documents and preserves source-specific mentions in a verbatim annex. Technique descriptions are organized as observable signals, primitives, platform surfaces, interpretation logic, and analysis-lab mitigations; it does not introduce standalone malware code.

Document Control

Field	Value
Generated	2026-06-22
Output format	Markdown
Source corpus	S1-S6 listed below
Integration method	Canonical synthesis + source concordance + technical mention inventory + verbatim source-retention annex
Safety orientation	Defensive analysis specification, not a deployable evasion implementation

Source Corpus

Source ID	File	Role in synthesis
S1	`anti-debug-emulation-synthesis.md`	Primary cross-platform synthesis and taxonomy spine.
S2	`mit3.md`	Delta report containing missing techniques, version-sensitive corrections, and telemetry-complexity additions.
S3	`mit2.md`	Defensive taxonomy with broad OS/vendor/research provenance and mitigation framework.
S4	`mit1.md`	Concise architecture-of-evasion treatment emphasizing strategic layers and state-of-art trends.
S5	`Pasted text(9).txt`	Concrete primitive-focused technical reference, especially offsets, class IDs, opcodes, DBI artifacts, and tooling.
S6	`Pasted text (2)(1).txt`	Long-form explanatory architecture analysis and extensive works-cited inventory.

Integration Contract

This specification treats anti-analysis as a signal-collection and behavior-gating system. Every source-level mention is retained by one of four mechanisms:

Canonical synthesis: deduplicated and normalized treatment in the main body.
Technique matrices: platform-specific and cross-platform tables that preserve individual primitive names, class IDs, constants, file paths, and artifact classes.
Technical mention inventory: machine-generated concordance of code-like symbols, constants, paths, API names, ATT&CK IDs, tools, and named artifacts found in the corpus.
Verbatim source-retention annex: full raw source documents are appended so that source-specific wording and non-normalized mentions are not dropped.

0. Assumption Register

ID	Assumption	Stress test / falsification probe	Dependent results
A1	The use case is malware analysis, binary reverse engineering, EDR/sandbox design, or defensive triage.	A future request asks for deployable stealth payloads, operational malware, or code that directly implements evasion in a live intrusion context.	Mitigation and analysis-lab sections.
A2	“Windows” means modern Windows NT-family systems, native and WOW64, using Win32, Native API, ETW, WMI, registry, PEB/TEB, object manager, and user/kernel debugging surfaces.	Target is Windows CE, Xbox, Nano Server, or nonstandard PE loader.	Windows-specific offsets/classes may not apply.
A3	“Linux” means mainstream Linux distributions on x86-64/aarch64 with `/proc`, `/sys`, ELF, ptrace, seccomp, cgroups/namespaces, and common hypervisors.	Target is Android, embedded Linux, unikernel, hardened appliance, or nonstandard LSM/kernel config.	Linux-specific `/proc`, Yama, ptrace, and perf conclusions.
A4	“macOS” means desktop Darwin/macOS on Intel and Apple Silicon; iOS-family behavior is included only where source documents mention it.	Target is iOS/iPadOS/watchOS/tvOS with different entitlements and sandbox policy.	macOS/iOS-specific entitlement and syscall discussion.
A5	“Anti-emulation” includes VM detection, sandbox detection, binary translation detection, dynamic binary instrumentation detection, user-simulation detection, and full-system emulator semantic-gap detection.	User only wants CPU-instruction-emulator detection or only public sandbox fingerprinting.	Cross-platform taxonomy breadth.
A6	“Exhaustive” is bounded to technique families plus all named mentions from the source corpus; private product builds, malware-family-specific hardcoded strings, and unobserved vendor internals are unknown unless present in the corpus.	A specific build or private sandbox is requested.	Product-specific implementation details.
A7	Source statements can be version-sensitive.	Exact Windows build, macOS version, QEMU/Unicorn version, CPU microcode, TSX enablement, or Apple Silicon VM capabilities differ from source conditions.	Version-sensitivity and downgrade notes.

1. Normative Vocabulary and Object Model

1.1 Normative terms

MUST: required for a reproducible analysis-lab interpretation or report classification.
SHOULD: strongly recommended because failure creates common false positives or false negatives.
MAY: optional, scenario-dependent, or version-dependent.
Observable signal: information a binary can observe about the analysis environment.
Primitive: OS API, syscall, CPU feature, file path, object type, firmware table, exception behavior, timing source, or artifact class used to produce a signal.
Gate: conditional branch, decryption, delay, crash, decoy behavior, or C2 decision triggered by signals.
Mitigation: defensive analysis-lab practice that improves observability or reduces misleading environmental artifacts.

1.2 Detection-mode taxonomy

Detection mode	Meaning	Examples preserved from corpus
Spawn-time	Detects process creation under debugger.	Windows `NtGlobalFlag`, heap `Flags`/`ForceFlags`, debug heap side effects.
Attach-time	Detects debugger attached after launch.	Linux `TracerPid`, Windows `CheckRemoteDebuggerPresent`, macOS `P_TRACED`, Mach exception ports.
Persistent-history	Detects that debug authorization or debug state existed previously.	macOS `CS_DEBUGGED`.
Active interference	Alters, denies, or suppresses debugging rather than merely detecting it.	`ThreadHideFromDebugger`, Mach exception-port stealing, self-debugging, parent/child tracing.
Environmental scoring	Aggregates many weak artifacts into a high-confidence sandbox/VM/debugger decision.	CPU + firmware + user history + process/module + network + C2 cluster.
Economic/time exhaustion	Avoids observation by exceeding sandbox resource budgets.	Proof-of-work, long sleep, staged activation, randomized backoff.
Semantic-gap proving	Uses correctness differences between real hardware/kernel and emulation/DBI.	QEMU TCG atomicity, Unicorn flags, FPU/SIMD, signal/fault mismatches.

2. Core Anti-Analysis Architecture

All documents converge on the same architecture:

Collect environment signals. Signals include debugger state, exception routing, timing, hardware/firmware identity, device inventory, process/module list, user behavior, filesystem history, network behavior, VM artifacts, DBI/hook artifacts, entitlement state, and C2 reputation.
Score or branch. Implementations range from one-bit “red pill” checks to threshold scoring, staged challenge protocols, C2-side decisions, and environment-bound cryptographic gates.
Gate behavior. Responses include exit, sleep, crash, benign decoy UI, withholding of unpacking/decryption, alternate payload selection, delayed persistence activation, or analyst-state corruption.
Re-check. Checks can run before main, inside TLS/Mach-O constructors, after unpacking, after privilege changes, in child processes, in hidden threads, after reboot/login, or after C2 replies.

2.1 MITRE mapping

ATT&CK ID	Name	Corpus mapping
T1622	Debugger Evasion	`IsDebuggerPresent`, `NtQueryInformationProcess`, PEB reads, Linux `TracerPid`, timing, hardware breakpoint checks, exception checks, debug-output flooding.
T1497.001	Virtualization/Sandbox Evasion: System Checks	CPUID, firmware, DMI/SMBIOS, ACPI, registry, IORegistry, device inventory, disk/RAM/CPU thresholds.
T1497.002	Virtualization/Sandbox Evasion: User Activity Based Checks	Mouse movement, click timing, browser history, bookmarks, common directories, document interaction, recent files.
T1497.003	Virtualization/Sandbox Evasion: Time Based Evasion	Sleeps, delays, clock checks, sleep skipping, uptime gates, calendar gates, PoW/resource asymmetry.

3. Windows Specification

3.1 PEB, heap, and process-state checks

Primitive / field	Concrete source-level details	Detection mode	Interpretation	Analysis-lab treatment
`PEB.BeingDebugged`	Byte at `PEB+0x02`; PEB via `FS:[0x30]` on x86 and `GS:[0x60]` on x64; `IsDebuggerPresent()` reads this byte.	Attach/spawn visible user-mode state	Low-cost debugger signal; weak alone.	Compare API result with raw memory and kernel/process object state.
`NtGlobalFlag`	`PEB+0x68` x86, `PEB+0xBC` x64; WOW64 64-bit PEB at `0x10BC`; debug heap mask `0x70` = `0x10	0x20	0x40`.	Spawn-time
`ProcessHeap.Flags` / `ForceFlags`	`PEB.ProcessHeap` at `PEB+0x18` x86 / `+0x30` x64; offsets version-specific: x86 pre-Vista `0x0C/0x10`, x86 Vista+ `0x40/0x44`, x64 pre-Vista `0x14/0x18`, x64 Vista+ `0x70/0x74`; debug examples include `0x40000062` and `0x40000060`.	Spawn-time	Debug heap artifact; build-sensitive.	Pair offsets with exact build/bitness and use masked tests.
PEB loader lists	Loaded-module and image-layout inspection.	Attach/environment	Used for debugger, hook, injected DLL, and DBI detection.	Cross-check PEB loader lists against VADs and kernel module telemetry.
WOW64 cross-view	32-bit and 64-bit PEB/TEB views, `ProcessWow64Information`.	Environment consistency	Detects inconsistent 32/64-bit cloaking.	Test native and WOW64 execution separately.

3.2 Native API and object-manager checks

Primitive	Corpus details	Signal	Defensive interpretation
`IsDebuggerPresent`	Public Win32 debugger query.	Current user-mode debug flag.	Weak alone; cluster with native and timing checks.
`CheckRemoteDebuggerPresent`	Calls debug-port style query on supplied process handle.	Attach-state signal.	Distinguish from spawn-time PEB checks.
`NtQueryInformationProcess(ProcessDebugPort=7)`	Returns `-1` / `0xFFFFFFFF` when debugged.	Kernel-backed debug port.	Stronger than PEB tamper checks.
`NtQueryInformationProcess(ProcessDebugObjectHandle=0x1E)`	Returns non-null debug object handle.	Debug object association.	High-confidence anti-debug when queried early or repeatedly.
`NtQueryInformationProcess(ProcessDebugFlags=0x1F)`	Returns `0` if debugged, `1` otherwise in corpus framing.	Debug inheritance/debug flag state.	Needs class-specific normalization.
`NtQueryInformationProcess(ProcessHandleTracing=0x20/32)`	Handle-tracing/debug handle behavior.	Debugger-assisted handle validation signal.	Interpret with invalid-handle exception probes.
`NtQuerySystemInformation(SystemKernelDebuggerInformation=0x23)`	`DebuggerEnabled`, `DebuggerNotPresent`.	Kernel debugger state.	Host-level contamination signal.
`NtQuerySystemInformation(SystemProcessInformation=5)`	Process-list enumeration.	Tool/process discovery.	Keep process ancestry realistic.
`NtQuerySystemInformation(SystemModuleInformation=0x0B)`	Driver/module enumeration; SoftICE-style names.	Kernel tool/driver artifacts.	Kernel module names can leak lab state.
`NtQuerySystemInformation(SystemHandleInformation)`	Handle-table scanning.	Debug object, named sections, IPC, pipes.	Object visibility can cross process boundaries.
`NtQueryObject(ObjectTypesInformation/ObjectAllTypesInformation)`	Global `DebugObject` enumeration.	Debugger anywhere on host, not necessarily attached to target.	Treat as host-level contamination vector.
`NtSetInformationThread(ThreadHideFromDebugger=0x11)`	Active event suppression; hidden thread exceptions may not reach debugger.	Active interference.	Use full thread telemetry and non-OS-debugger visibility.
`NtCreateThreadEx(THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER=0x4)`	Hides newly created thread from debug events.	Active interference.	Correlate thread creation and exception routing.
`OutputDebugString` / `DBG_PRINTEXCEPTION_C`	Debug-string side effects and flooding.	Debug event routing and analyst DoS.	Avoid treating debug-output volume as benign logging.
`BlockInput`	Blocks user keyboard/mouse input; sequential-call semantics can detect hooks.	Analyst UI disruption and hook probe.	Keep control plane out of guest; record UI-level calls.

3.3 Exception, breakpoint, and control-flow probes

Probe	Source-level mentions	Signal	Analysis handling
Short `INT3`	`0xCC`, `EXCEPTION_BREAKPOINT` `0x80000003`.	Debugger consumes breakpoint before application handler.	Preserve first-chance exception behavior.
Long-form `INT3`	`0xCD03`.	Disassembler/resume desynchronization.	Check decoded instruction stream and exception PC.
`INT2D`	Breakpoint-like exception; EIP increment / skipped byte depending on `EAX=1/3/4/5`.	Debugger-specific resume behavior.	Validate resume address and handler path.
`ICEBP` / `INT1`	`0xF1`, debug exception `#DB`; tied to DR7/ICE behavior in source.	Single-step/debug exception semantics.	Avoid single-stepping sensitive blocks.
Trap Flag	`EFLAGS.TF` / single-step path.	Detects stepping and debug exception routing.	Use trace collection rather than interactive stepping.
Invalid-handle close	`CloseHandle`/`NtClose`, `EXCEPTION_INVALID_HANDLE` `0xC0000008`.	Debug handle validation path.	Treat invalid-handle probes as anti-debug when clustered.
`UnhandledExceptionFilter`	Path differs when debugger is attached.	Top-level exception routing.	Compare debugger/no-debugger runs.
VEH/SEH abuse	VEH intercept before SEH; handlers redirect normal control flow.	Debugger alters exception path.	Model exception edges in CFG recovery.
TLS callbacks	PE TLS callback array executes before entry point.	Pre-entry anti-debug staging.	Break at loader/system breakpoint or TLS callbacks, not only EP.
Guard pages	`PAGE_GUARD`, `STATUS_GUARD_PAGE_VIOLATION`.	Page-fault and memory-breakpoint semantics.	Reapply guard semantics correctly; capture page faults.
Software breakpoint scan	`.text` checksums, `0xCC` scanning, `repne scasb`.	Code patch detection.	Use snapshot comparison and patchless trace when possible.
Hardware breakpoint scan	DR0-DR3, DR6, DR7 via `GetThreadContext`/`NtGetContextThread`.	Hardware breakpoint visibility.	Hardware breakpoints are not invisible; expect probes.
Page/write-watch/SMC	`GetWriteWatch`, self-modifying code, page permissions.	Instrumentation and breakpoint residue.	Use memory snapshots and page-access telemetry.

3.4 Anti-attach, self-debugging, and analyst-tool enumeration

Family	Mentions preserved	Interpretation
Self-debugging	Child debugs parent via `DebugActiveProcess`; one debugger per target; debug object inheritance.	Prevents ordinary attach and changes process tree semantics.
Remote break-in semantics	Attach chain `DebugActiveProcess → DbgUiDebugActiveProcess → DbgUiIssueRemoteBreakin → RtlpCreateUserThreadEx → DbgUiRemoteBreakin → DbgBreakPoint`.	Attach and spawn are not equivalent experiments.
Tool window enumeration	`FindWindow`, `FindWindowEx`, `EnumWindows`; `OLLYDBG`, `Qt5QWindowIcon`, `WinDbgFrameClass`, IDA, Wireshark.	The analyst desktop is an input surface.
Process/module enumeration	`CreateToolhelp32Snapshot`, `Process32Next`, `EnumProcessModules`; x64dbg, OllyDbg, IDA, WinDbg, Cheat Engine, Process Hacker.	Visible tool chain contaminates guest.
Driver/module enumeration	SoftICE names `sice.sys`, `siwvid.sys`, `ntice.sys`, `iceext.sys`, `syser.sys`; `SystemModuleInformation`.	Host/kernel tools leak through module lists.
Named objects and IPC	Pipes, sections, debug objects, sandbox monitor IPC.	Random names are insufficient if semantics remain abnormal.

3.5 Windows anti-VM / sandbox surface

Surface	Mentions preserved	Interpretation
CPUID	Leaf 1 `ECX bit 31`; leaf `0x40000000`; vendor strings `VMwareVMware`, `KVMKVMKVM`, `Microsoft Hv`, `XenVMMXenVMM`, `prl hyperv` , `TCGTCGTCGTCG`, `VBoxVBoxVBox`.	Strong if visible; hiding must be coherent with devices/timing.
Firmware	`GetSystemFirmwareTable`, ACPI RSDT/FADT/DSDT, SMBIOS, raw tables.	Firmware consistency matters more than string hiding.
Registry	`HARDWARE\ACPI\DSDT\VBOX__`, `SOFTWARE\VMware, Inc.\VMware Tools`, QEMU BIOS strings, SCSI paths.	Common sandbox/VM evidence.
Device inventory	SetupAPI, WMI `Win32_ComputerSystem`, virtual GPU/NIC/storage, VM guest drivers.	Device topology must fit persona.
Disk/RAM thresholds	Disk < approximately 50 GB; RAM < approximately 4 GB in corpus examples.	Heuristic only; cluster with other evidence.
Power/thermal	`GetPwrCapabilities`, `SYSTEM_POWER_CAPABILITIES.ThermalControl == FALSE`.	Absence of thermal zones can expose VM.
MAC OUI	VMware `00:05:69`, `00:50:56`, `00:0C:29`; VirtualBox `08:00:27`; QEMU/KVM `52:54:00`.	Easy to spoof but useful in clusters.
Logs/history	Event logs, Prefetch, Amcache, ShimCache, UserAssist, PowerShell history, Recycle Bin.	Wear-and-tear indicator.

4. Linux Specification

4.1 Debugging and attach-control primitives

Primitive	Corpus details	Detection mode	Interpretation
`ptrace(PTRACE_TRACEME)`	One tracer per process; self-trace blocks later attach; failure `EPERM` if already traced.	Spawn/early attach prevention.	Core Linux anti-debug primitive.
`PTRACE_ATTACH` / `PTRACE_SEIZE`	Attach/seize behavior and stop semantics differ.	Attach-time.	Modern debuggers may use `PTRACE_SEIZE`; do not rely only on SIGSTOP cues.
Chained/stateful ptrace	Offset/state changes across repeated calls in source examples.	Anti-shim.	Naive always-success shims can fail.
`/proc/self/status` `TracerPid`	Nonzero means traced.	Attach-time.	Standard low-noise detector.
`/proc/self/stat`	Cross-checkable process state.	Attach-time consistency.	Avoid inconsistent `/proc` views.
Yama `ptrace_scope`	Modes 0 classic, 1 restricted/default, 2 admin-only, 3 no-attach.	Policy probe.	Record kernel policy.
`CAP_SYS_PTRACE`	Capability to trace arbitrary processes.	Capability/environment.	Overprivileged sandboxes can look unrealistic.
`prctl(PR_SET_DUMPABLE, 0)`	Blocks attach and core dumps; changes `/proc` access.	Active attach hardening.	Capture prctl calls and dumpability state.
`prctl(PR_SET_PTRACER, pid)`	Whitelists tracer under Yama-like policy.	Active attach selection.	External debugger may be excluded.
Raw syscall invocation	Bypasses libc and `LD_PRELOAD` interposition.	Anti-hook.	User-space shims are incomplete.
Static linking	Reduces dynamic linker instrumentation visibility.	Anti-loader.	Need syscall/kernel-level visibility.

4.2 Procfs, loader, and environment inspection

Path / surface	Signal preserved from corpus
`/proc/self/wchan`	May show `ptrace_stop` or wait state associated with debugger pauses.
`/proc/self/maps`	Injected shared objects, DBI code caches, RWX mappings, `LD_PRELOAD`, emulator stubs.
`/proc/self/fd`	Debugger pipes, pseudo-terminals, IPC, high descriptor count, harness artifacts.
`/proc/self/auxv`	Auxiliary-vector loader state via `AT_*` / `getauxval`.
`/proc/<ppid>/exe`, `/proc/<ppid>/cmdline`	Parent debugger/tracer/sandbox ancestry.
`/proc/<pid>/comm`	Process names such as `gdb`, `lldb`, `strace`, `ltrace`, `rr`, `perf`, `valgrind`.
`argv[0]`	Absolute-vs-relative path differences under GDB from corpus.
Environment	`LD_PRELOAD`, `LD_AUDIT`, sanitizer/DBI/env artifacts.
GOT/PLT/prologues	Inline hooks, dynamic interposition, libc/syscall wrapper mismatch.

4.3 Signal, seccomp, self-tracing, and SMC

Technique	Corpus details	Interpretation
`SIGTRAP` handler + `INT3`	Handler runs only if debugger does not consume trap.	Debugger exception routing.
`SIGSEGV`, `SIGILL`, `SIGBUS`	Intentional faults as control flow; ARM `udf` mentioned.	Debugger signal-order artifacts.
Signal masks	Program changes masks and checks consistency.	Multi-threaded anti-debug surface.
`fork`/`clone` watchdogs	Parent/child trace/watch each other.	Must analyze full process tree.
Parent-child repair	Parent traces child, intercepts signals, repairs syscall/registers/code before resume; external debugger breaks loop.	Anti-debug and obfuscation fused.
Seccomp/tracer interaction	Syscall interception semantics, ptrace/seccomp stop ordering.	Requires accurate kernel stop model.
`personality(ADDR_NO_RANDOMIZE)`	Detects/counters ASLR-disabling debugger harnesses.	Record personality flags.
`mprotect` choreography	Page permissions and guard behavior.	Hook/DBI detection and SMC support.
`.text` checksum / `0xCC` scan	ELF text and unpacked/JIT regions.	Breakpoint detection.
Record/replay detection	`rr`-style determinism, perf constraints, syscall timing.	Replay is an input, not sole truth.

4.4 Linux anti-VM / sandbox surface

Surface	Signals preserved
CPUID and `/proc/cpuinfo`	Hypervisor bit, vendor leaves, CPU model mismatch, hypervisor flags.
`/sys/class/dmi/id/product_name`	`VMware Virtual Platform`, `VirtualBox`, `KVM`.
`/sys/class/dmi/id/sys_vendor`	`QEMU`, `innotek GmbH`, vendor strings.
`/proc/scsi/scsi`	Emulated SCSI controller signatures.
`/sys/devices`, `/sys/block`, `/sys/bus/pci`, `/sys/class/net`	virtio/VMware/VBox/Hyper-V/QEMU devices, disk/rotational/SMART, MAC OUI.
Container markers	`/.dockerenv`, cgroups, namespaces, overlayfs, Kubernetes mounts/tokens/env/DNS.
WSL markers	WSL kernel strings, DrvFS, `/mnt/c`, interop.
User/history	Package DB age, shell history, SSH known hosts, logs, browser/profile state.
Headless UI	X11/Wayland/VNC/headless artifacts; `/dev` sparsity; missing audio/GPU/USB/Bluetooth/Wi-Fi.
Cloud	Metadata routes, cloud-init residue, cloud agents, ephemeral image traits.

5. macOS / Darwin / iOS-Family Specification

5.1 Core macOS anti-debug matrix

Vector	Corpus details	Detection mode	Interpretation
`ptrace(PT_DENY_ATTACH=0x1F / 31)`	Sets no-attach state; if already traced exits with `ENOTSUP`/status 45 in corpus; later attach can affect parent debugger. May be invoked before `main`, via dynamic resolution, direct syscall, or ARM64 `svc #0x80` on iOS-family material.	Active attach denial / early staging.	Breakpoints at `main` are too late; trace initializers and syscalls.
`ptrace(PT_TRACE_ME)`	Trace-me checks and self-trace.	Spawn/attach control.	Do not rely on ptrace-only visibility.
`sysctl` `P_TRACED`	MIB `CTL_KERN`, `KERN_PROC`, `KERN_PROC_PID`, `getpid()`; `kp_proc.p_flag & P_TRACED`, `0x800`.	Attach-time.	Public API, low-noise; cluster with Mach/ptrace/csops.
`csops` / `csops_audittoken`	Syscalls #169/#170 in source; `CS_OPS_STATUS`; `CS_DEBUGGED = 0x10000000`; `csops_audittoken` reduces PID-reuse ambiguity.	Persistent/current code-signing debug state.	One of four core macOS anti-debug surfaces.
Mach exception ports	`task_get_exception_ports`; mask `EXC_MASK_ALL & ~(EXC_MASK_RESOURCE	EXC_MASK_GUARD)`in source; detects LLDB/Bit Slicer/non-ptrace debuggers;`task_set_exception_ports` can steal exceptions.	Attach/interference.
`task_for_pid`	Task-port access governed by taskgated/AMFI/root/entitlements/SIP.	Debug authorization surface.	Entitlement state must be recorded.
Hardened Runtime	Library validation, dyld environment handling, executable-page behavior.	Signing/runtime policy.	Changes injection and attach feasibility.
`get-task-allow`	Target-side entitlement affecting task-port/debugging access.	Signing/runtime policy.	Entitlement parity required between runs.
`com.apple.security.cs.debugger`	Debugging-tool entitlement.	Debugger-side authorization.	Required for some attach/task-port paths.
SIP / AMFI / taskgated	System policy enforcement.	Kernel policy.	Analysis-induced changes can alter behavior.

5.2 dyld, library validation, and entitlement drift

Surface	Mentions preserved	Interpretation
`DYLD_INSERT_LIBRARIES` / `DYLD_*`	macOS equivalent of loader interposition; colon-separated dylibs; detected by `getenv` and dyld image enumeration.	Loader-based instrumentation signal.
`_dyld_image_count` / `_dyld_get_image_name`	Foreign dylib / Frida gadget / monitoring shim enumeration.	Module visibility signal.
`allow-dyld-environment-variables`	Hardened Runtime entitlement permitting dyld env behavior.	Entitlement-sensitive.
`disable-library-validation`	Required to inject untrusted dylibs under library validation.	Entitlement-sensitive.
App Group entitlement loss	Resigning can remove App Group/container entitlement; `containerURLForSecurityApplicationGroupIdentifier:` may return nil; Swift force-unwrap can trigger `BRK`.	Analysis-induced false crash, not necessarily intentional anti-debug.
Code signature class	Developer ID, ad hoc, platform, local signing.	Must match between comparative runs.
TCC state	Camera, microphone, accessibility, automation, files, screen recording.	Persona/entitlement consistency.

5.3 macOS anti-VM and Apple Silicon surface

Surface	Signals preserved	Version / interpretation
IORegistry / IOKit	`IOPlatformExpertDevice`, board-id, manufacturer, model, serial, device tree.	Core macOS hardware identity surface.
`sysctl -n hw.model`	Generic VM vs specific Mac model identifiers.	Low-noise platform signal.
`IOPlatformSerialNumber`	Default `0` in source examples vs unique physical serial.	Must be version/hypervisor-specific.
Virtualization.framework / Hypervisor.framework	Apple VM device model, platform identity, framework artifacts.	Modern macOS VM surface.
Rosetta	`sysctl.proc_translated`; x86-64 translated on Apple Silicon.	Test native and translated paths.
Apple ID / iCloud absence	Source delta downgrades this: macOS 15+ supports iCloud in Apple Silicon macOS VMs.	Version-specific, not universal.
`HACR_EL2` / “Apple ISA” bit	Mentioned in source as Apple Silicon VM signal; delta marks as unverified/private-platform unless confirmed.	Do not make primary stable indicator without exact platform verification.
USB/peripheral limitations	USB passthrough, sensors, GPU/display, audio/camera/microphone/TCC history.	Persona-dependent VM signal.

6. Anti-Instrumentation, Hook, DBI, and Frida Specification

6.1 Generic hook and instrumentation checks

Family	Observable	Platforms
Import-table integrity	IAT/EAT/delay imports on Windows; PLT/GOT on Linux; dyld stubs on macOS.	Windows, Linux, macOS
Syscall-stub integrity	User-mode syscall stubs modified by hooks/trampolines.	Windows, Linux
Direct primitive comparison	API result compared with lower-level syscall/kernel/direct primitive.	Windows, Linux, macOS
Loaded-module scanning	EDR DLLs/SOs/dylibs, Frida, Pin, DynamoRIO, Valgrind, QBDI, sanitizers, profilers.	Windows, Linux, macOS
Anonymous executable memory	RX/RWX mappings, JIT caches, DBI translation caches, injected agents.	Windows, Linux, macOS
Thread probes	Helper thread names/counts such as Frida/DBI loops.	Windows, Linux, macOS
IPC probes	Named pipes, sockets, default ports, D-Bus, tool IPC endpoints.	Windows, Linux, macOS
Environment probes	`LD_PRELOAD`, `LD_AUDIT`, `DYLD_*`, sanitizer variables, DBI config.	Windows, Linux, macOS
API semantic probes	Edge-case error codes, argument validation, reentrancy, stack shape, TLS state.	Windows, Linux, macOS
Stack walks	Return addresses/frames outside expected module ranges.	Windows, Linux, macOS

6.2 DBI taxonomy and artifacts

Category	Corpus mentions
Code-cache artifacts	Instruction pointer or return address outside main module; stack frames in code cache; translation-cache regions.
JIT-compiler detection	Mapping rhythm, JIT trampolines, encoder/decoder strings.
Overhead detection	Basic-block latency, syscall latency, memory peak, working set, branch-density anomalies.
Environment artifacts	`pinvm.dll`, `.charmve`, `.pinclie`, `Intel(R) X86 Encoder`, `PIN_SetDebugMode`, `PinCommitHashC`, `PinWinMain`, `ClientIntC`, `__pin_tls`, DBI launcher parent.
Frameworks	Pin, DynamoRIO, QBDI, Valgrind, QEMU-user, sanitizers, Arancino, PinShield.
Hardware tracing alternative	Intel PT, LBR, LibIHT; no inline patch/code cache.

6.3 Frida-specific artifact families

Surface	Mentions preserved
Module/map names	`frida-agent`, `frida-gadget`, `frida-server`.
Threads	`gum-js-loop`, `gmain`, `gdbus`, `pool-frida`, `linjector`.
Ports	27042, 27043.
IPC	D-Bus, named pipes, `/proc/<pid>/fd`.
Memory	RWX pages, inline prologue patches.
Platform caveat	Android-specific paths/smali references are not generalized to desktop OSes; core map/thread/IPC/port classes persist.

7. Anti-Emulation, Anti-VM, Firmware, and Hardware Specification

7.1 Hypervisor fingerprint hierarchy

Layer	Technique	Reliability / caveat
Architectural	CPUID leaf 1 `ECX bit 31`, hypervisor-present.	Strong when exposed.
Vendor leaves	CPUID `0x40000000`, `0x40000001`, vendor/max leaf/interface signature.	Strong only if internally coherent.
Brand/model	CPUID brand string such as `QEMU Virtual CPU` / `Common KVM`.	Easy to spoof.
Backdoor I/O	VMware magic `EAX=0x564D5868`, `ECX=0x0A`, `DX=0x5658`, `EBX=0x564D5868`; ports `0x5658`/`0x5659`.	Vendor-specific.
Descriptor tables	SIDT/SGDT/SLDT/STR red/no-pill, IDT base heuristics, `disable_directexec`.	Legacy/low-weight on modern VT-x/AMD-V/SMP.
Timing	CPUID latency, VM-exit latency, EPT violation timing, TSC offsets.	Noisy but hard to hide perfectly.
Cross-view consistency	CPUID says bare metal while PCI/ACPI/SMBIOS says VM.	Often strongest practical signal.

7.2 CPU, ISA, and microarchitectural probes

Family	Mentions preserved
Timing	`RDTSC`, `RDTSCP`, `RDPMC`, `QueryPerformanceCounter`, `clock_gettime`, `mach_absolute_time`, syscall latency, scheduler jitter.
PMU/HPC	`perf_event_open`, PMU counters, access-control sensitivity.
MSR/registers	MSR behavior, FS/GS/system-register gaps, AArch64 feature registers.
FPU/SIMD	Rounding, NaN, denormal, exception flags, unaligned SIMD / `movntps`.
Memory ordering	Atomic operations, locks, cache coherency, SMC, i-cache invalidation.
Transactional memory	Intel TSX RTM/HLE, `XBEGIN`/`XEND`, abort status, debug exceptions, DR7/IA32_DEBUGCTL RTM debug capability.
Cache/TLB/BPU	Cache, TLB, branch predictor, prefetch, LLC/NoC contention, LLC remapping / NoIR.
EPT hooks	EPT violation/VM-exit latency; hidden hooks / hypervisor introspection timing.

7.3 Emulator correctness and semantic gaps

Engine / class	Corpus details	Version caveat
Unicorn	EFLAGS desynchronization examples, branch single-step desync issues, no OS semantics for syscall/sysenter, SEH/VEH absence, FS/GS/MSR/RDRAND/RDTSC/AESNI/x87/SMC/unmapped-memory differences.	Specific issue IDs may be fixed; verify exact version.
QEMU TCG	Translation-block atomicity; interrupts at TB boundaries; race-condition detection; `-d` / `-singlestep`; TB-cache timing; `QEMU`/`Seabios`; MAC `52:54:00`.	KVM acceleration differs from pure TCG.
INSDET / ARM differential testing	2,774,649 generated streams, 1,998 encodings, 155,642 inconsistent instruction streams in cited corpus.	Reflects tested QEMU/device matrix.
General DBT/full-system gaps	Unimplemented instructions, flag/exception/fault-address mismatch, syscall/ioctl/fcntl/mmap edge cases, device incompleteness, timing flatness, scheduler determinism, file timestamp regularity, graphics/UI absence, network emulation gap, snapshot artifacts.	Requires differential testing against target hardware/kernel.

7.4 Firmware, DMI/SMBIOS, ACPI, IORegistry, and identity

Surface	Windows	Linux	macOS	Required consistency
SMBIOS/DMI	`GetSystemFirmwareTable`, WMI	`/sys/class/dmi/id`, `dmidecode`	IORegistry/system profiler	Manufacturer, product, UUID, board, chassis, BIOS date.
ACPI	Raw firmware table APIs, DSDT/FADT/RSDT	`/sys/firmware/acpi`	IORegistry on Intel Macs	OEM IDs, signatures, topology.
Registry/system config	VM keys, services, SCSI, guest tools	`/proc`, `/sys`, package DB	LaunchDaemons/Agents, unified logs	Must match hardware persona.
Serial/UUID	Machine GUID, SMBIOS UUID	DMI/sysfs UUID	`IOPlatformSerialNumber`, platform UUID	Per-persona stable entropy.
BIOS/OS age	Install date, update history	package/log age	unified log/update history	Timeline coherence.
Chassis/power	battery, thermal, sensors	power/thermal/sysfs	sensors, battery/power	Hardware model coherence.

8. Sandbox, Wear-and-Tear, User Activity, Network, Cloud, and Container Specification

8.1 Wear-and-tear and spotless-sandbox indicators

Category	Signals preserved
Install age	OS install date, first boot, update history, package DB age.
User-profile depth	Documents, downloads, desktop, shell history, recent files, bookmarks.
Browser profile	Cache, cookies, bookmarks, saved sessions, extensions, tabs.
Office/productivity	MRUs, templates, autosaves, recent Office documents.
Developer/shell	`.bash_history`, `.zsh_history`, PowerShell history, Git configs, SSH known hosts.
Logs	Event logs, syslog, journald, auth logs, unified logs, crash reports.
Trash/recycle	Empty bin on an old system; timestamp incoherence.
Fonts/locale	Sparse fonts, default keyboard, timezone/language/IP mismatch.
Enterprise	Domain join, AD, MDM, VPN, printers, shares, EDR, software inventory.
File timestamps	Bulk clone timestamps, impossible chronology, uniform created/modified times.
Account behavior	Login, lock/unlock, idle history.

8.2 User-activity and reverse-Turing checks

Surface	Signals preserved
Mouse	Curves, acceleration, pauses, click entropy, SmoothCriminal-style jump/click artifacts.
Keyboard	Inter-key timing, corrections, paste bursts, focus changes.
Window/UI	Foreground focus, lure document/installer/browser, lock state, screensaver, DPI, multi-monitor.
Browser/document	Scroll, dwell time, macro-enable path, editing, tabs/cookies/history/extensions.
Clipboard/hotkeys	Empty or automation-specific clipboard; breakpoint/copy-paste artifacts.
Social context	Email client, attachments, chat apps.
Peripherals	Audio, camera, microphone, HID, Bluetooth/Wi-Fi, printers.

8.3 Time-based sandbox evasion

Technique	Signals preserved	Defensive requirement
Long sleep	Delay exceeds sandbox budget.	Detect statically/dynamically; use coherent time treatment.
Random/C2 backoff	Random or server-controlled delay.	Multi-run and C2 protocol analysis.
Multi-stage timers	Persistence then post-reboot/login execution.	Include reboot/login activation cycles.
Uptime/install-age gates	Runs only after threshold.	Plausible aged images and logs.
Calendar gates	Date, weekday, fiscal period, campaign window.	Explore date branches in copies.
Sleep-skipping detection	Cross-check `NtDelayExecution`, `GetTickCount`, QPC, system time; argument-validation anomalies such as expected `STATUS_DATATYPE_MISALIGNMENT` or `STATUS_ACCESS_VIOLATION`.	Do not patch only one API or skip validation semantics.
PoW/resource asymmetry	CPU-bound puzzle controls decryption/execution; sandbox timeout/economic scaling.	Identify CPU-bound gates; use high-budget/bare-metal when needed.
Telemetry-complexity attacks	Event-volume overload, deep nesting, oversized telemetry, process-tree explosion, dashboard/report truncation.	Validate sensor → serializer → queue → DB → report → UI path; preserve raw capture.

8.4 Network, C2, and internet-environment checks

Surface	Signals preserved
Reachability	No internet, captive DNS, sinkholes, blocked ports.
DNS	NXDOMAIN timing, wildcarding, resolver names, sinkhole signatures.
TLS	MITM certificates, JA3/JA4 mismatch, chain anomalies.
Geolocation	IP, ASN, timezone, locale, keyboard, documents mismatch.
LAN	RFC1918 topology, gateway, DHCP, neighbors, printers, shares, AD, mDNS, LLMNR, NetBIOS, IPv6.
Proxy/VPN	Environment variables, PAC, WinHTTP proxy, system proxy.
C2 scoring	Server withholds payload based on IP reputation, TLS fingerprint, timing, prior submissions, host traits.
Browser fingerprint	User-agent, cookies, history, installed extensions.
Bandwidth/latency	Too fast, too clean, deterministic network.
Cloud metadata	AWS/Azure/GCP endpoints, cloud-init residue, instance UUID, agents.
Sinkhole detection	Known analysis infrastructure responses.

8.5 Container, WSL, cloud, and namespace checks

Surface	Signals preserved
cgroups/namespaces	cgroup paths, namespace IDs, minimal PID namespace, unusual PID 1.
Mounts	overlayfs/aufs, bind mounts, read-only roots, unusual `/proc`/`/sys`.
Kubernetes	Service-account tokens, env vars, DNS names, mounts.
Docker	`/.dockerenv`, Docker hostnames/network ranges.
WSL	WSL kernel strings, DrvFS, `/mnt/c`, Windows interop.
Cloud	metadata endpoints, cloud-init, agents, virtual NIC/disk, ephemeral image traits.
Serverless	Minimal filesystem, constrained syscalls, unusual clock/network behavior.

9. Modern and State-of-the-Art Specification

Class	Details preserved	Defensive analysis implication
Multi-signal scoring	CPU/hypervisor + firmware/DMI + device topology + user/browser history + locale/timezone/IP + process/module inventory + clock + C2 + domain/EDR + install/log age.	“Score the scorekeeper”; many weak checks early become strong evidence.
Differential benign behavior	Decoy UI, benign network, fake errors, clean exit, missing unpacking, withheld config, skipped decryption, no C2 task.	Compare across VM/bare metal, debug/no-debug, instrumented/native, aged/fresh persona.
Environment-bound decryption	Machine GUID, SMBIOS UUID, domain/tenant, username, locale/timezone, GPU/MAC/disk serial, C2 nonce, time window, lure metadata.	Taint environment-derived values into crypto and guard predicates.
Triggered/staged execution	Date, reboot, login, domain join, VPN, process launch, file open, browser activity, C2 approval, geolocation, org artifact, removable drive, privilege, EDR state.	Trigger discovery and event fuzzing.
Public-sandbox fingerprinting	Hostnames, usernames, paths, IP ranges, DNS, screen, installed tools, process tree, API-hook semantics, timing.	Rotate personas and compare with private/bare-metal detonation.
Microarchitectural checks	VM-exit, TSC scaling, PMU, cache/TLB/BPU, TSX, FPU/SIMD, interrupts, HPET/APIC, scheduler jitter.	Use bare-metal or hardware-assisted tracing for high-risk samples.
Hypervisor stealth debugging	HyperDbg, EPT hidden hooks, TLB splitting, VMX-root script evaluation, Intel PT.	Useful where OS-debug APIs are detected; metrics are paper/corpus-specific.
Hardware tracing	Intel PT TIP/TNT/MODE.TSX, LBR, LibIHT, HeNet.	Low code-modification footprint; still record PMU/access policy.
VMProtect/Themida	Code virtualization, custom bytecode, dispatcher, randomized ISA, control-flow flattening, mutation, nanomites, self-checksums, CFI, stolen bytes, lazy imports.	Dump-after-unpack when only packing; devirtualize only genuinely virtualized functions.
LLC/NoC side channels	Cache contention, NoC interconnect, LLC remapping/NoIR.	Hardware/cache realism matters.
Telemetry-complexity denial	Collection/serialization/storage/report/UI overload and truncation.	Raw telemetry fallback and bounded streaming structures.

10. Defensive Analysis-Lab Requirements

10.1 Four-run differential baseline

For high-value samples, the lab SHOULD run at least:

VM, no debugger, standard telemetry.
VM, debugger/instrumentation attached.
Bare-metal or high-fidelity hardware-backed run, no debugger.
Bare-metal or high-fidelity run with hardware trace or low-observable telemetry.

Behavior that appears only in runs 3/4 suggests VM/instrumentation gating. Behavior that disappears only in run 2 suggests debugger/instrumentation sensitivity.

10.2 Environment consistency ledger

Ledger field	Examples
Debug mode	Spawned under debugger, attach after launch, kernel debugger, hypervisor debugger, none.
Instrumentation	User-mode hooks, kernel driver, ETW/eBPF/EndpointSecurity, DBI, hypervisor/VMI, Intel PT.
VM exposure	CPUID, firmware, PCI, ACPI, SMBIOS/DMI, IORegistry, hypervisor vendor.
Time model	Wall, monotonic, TSC, QPC, network time, filesystem time, sleep acceleration.
Persona	Login history, browser history, documents, recent files, interaction traces.
Code-signing	macOS entitlements, Hardened Runtime, SIP, AMFI/taskgated, dyld policy.
Telemetry health	Dropped events, serialization failures, DB insert errors, report truncation.

10.3 Tooling contamination rule

Any debugger, DBI engine, Frida agent, EDR user-mode hook, sandbox monitor, GUI, named object, pipe, port, environment variable, helper thread, parent process, kernel object, loaded module, or IPC endpoint visible to the guest MUST be treated as part of the sample’s input surface.

10.4 Consistency over string hiding

Do not patch isolated artifacts without preserving consistency. Common incoherence patterns:

CPUID hypervisor bit hidden while virtual PCI devices remain visible.
SMBIOS vendor changed while ACPI OEM IDs remain virtual.
Disk size increased while filesystem age/logs remain fresh.
Mouse motion simulated without browser/login history.
Sleep accelerated without wall/monotonic/network/filesystem/scheduler consistency.
Guest tools removed while dependent synthetic devices remain.
macOS signing/entitlements changed between comparative runs.

10.5 macOS entitlement parity

Comparative macOS runs MUST record code-signature class, Hardened Runtime state, get-task-allow, library validation, dyld environment policy, App Group/container entitlements, TCC state, SIP/AMFI/taskgated state, architecture, and Rosetta translation state.

10.6 Cross-view telemetry

Layer	Windows	Linux	macOS
Guest user mode	API logs, module loads, process tree	libc/syscall wrapper logs, `/proc`	dyld, Obj-C, user logs
Guest kernel	ETW, callbacks, drivers	auditd, eBPF, LSM, perf	EndpointSecurity, unified logs, kernel traces where available
Hypervisor/VMI	VM exits, memory snapshots, device events	Same	Same where supported
Network	DNS, TLS, HTTP, PCAP, proxy logs	Same	Same
Filesystem	Snapshot and metadata diffs	Same	Same
Memory	Dumps, unpacked regions, page accesses	Same	Same

11. Detection Engineering Patterns

Prefer clusters over single checks. High-value non-operational rule concepts:

Debugger-state API plus timing loop plus exception-heavy control flow.
CPUID/hardware enumeration plus module/process enumeration plus early exit.
Firmware/DMI query plus user-profile inspection plus long sleep.
PEB/ptrace/sysctl/csops/Mach-port check inside unpacking stub.
API prologue integrity check plus loaded-module scan.
Browser-history check plus mouse-input gate before network activity.
VM vendor artifacts queried immediately before decryption or C2 beaconing.
Environment-derived identifiers passed into crypto/key-derivation routines.
Thread-hide call followed by checksum, decryption, unpacking, or crash.
Telemetry volume/process-tree expansion followed by missing or truncated reports.

12. Version-Sensitivity and Downgraded Claims

Claim / class	Treatment
Apple Silicon macOS VMs cannot sign into Apple ID/iCloud.	Downgrade to version-specific; source delta notes macOS 15+ iCloud support in macOS VMs.
Apple Silicon `HACR_EL2` / Apple ISA bit.	Treat as unverified/private-platform signal unless confirmed for exact SoC/macOS generation.
Unicorn EFLAGS issue IDs.	Version-sensitive; verify exact engine version.
QEMU ARM errata counts.	Reflect tested matrix; use as category evidence, not universal count.
Descriptor-table red/no-pill checks.	Legacy/low-weight on modern VT-x/AMD-V and SMP; useful mainly in interpreter/compatibility modes or clusters.
Frida Android paths/smali.	Do not generalize exact paths to desktop OSes; generalize artifact classes.
HyperDbg stealth/effectiveness metrics.	Treat as paper-specific corpus results, not universal guarantee.
TSX anti-debug.	CPU-, microcode-, BIOS-, and OS-policy-dependent; may be disabled or absent.
Protector internals and devirtualizer efficacy.	Version-specific for VMProtect, Themida, NoVmp, VTIL, Pinicorn, UnSafengine64, ScyllaHide options.

13. Bounded Scope Expansion

Opportunity / risk	Impact	Defensive relevance
C2-side sandbox scoring	High	Server can withhold payload based on host, IP/ASN, TLS, timing, or previous submissions.
AI-assisted sandbox fingerprinting	High	Automated probes can discover subtle lab invariants.
Persona reuse leakage	High	A single aged persona reused across samples becomes a fingerprint.
Clock-coherence failure	High	Time acceleration is detectable if only one clock/API is patched.
Container detonation false negatives	High	Containers lack endpoint hardware, user, kernel, and device fidelity.
Emulator differential correctness	High	Rare instruction/signal/syscall/device behavior exposes emulators.
User simulation shallowness	High	Random input without historical artifacts is weak.
Telemetry-complexity attacks	High	Behavior may execute but not survive into reports/UI.
PoW resource asymmetry	High	Sandbox economics become the detection surface.
macOS entitlement drift	High	Resigning/instrumenting can create false crashes and false negatives.
TCG translation-block atomicity	Medium/High	Race behavior and context-switch granularity reveal translation engines.
Microarchitectural checks	Medium/High	Difficult to emulate; bare-metal comparison may be required.
Debug-object global contamination	Medium	A debugger elsewhere on host can be detectable.
UI disruption	Medium	Desktop/window/input layers are part of the guest-observable surface.
Endpoint-security realism gap	Medium	Removing EDR may hide EDR-gated behavior.
Apple VM version drift	Medium	macOS VM signals change across versions.
Hypervisor transparency overfitting	Medium	String hiding with inconsistent topology can increase detectability.
Public-report poisoning	Medium	Decoy behavior may contaminate public reports.

14. Provenance Register

The canonical source corpus itself contains a full works-cited inventory. Primary categories preserved across the documents include:

MITRE ATT&CK T1622, T1497, T1497.001, T1497.002, T1497.003.
Microsoft documentation: IsDebuggerPresent, NtQueryInformationProcess, PEB, debugger communication, DebugBreak, OutputDebugString, QueryPerformanceCounter, GetSystemFirmwareTable, WMI Win32_ComputerSystem, SetupAPI, BlockInput, NtSetInformationThread, Hyper-V TLFS feature discovery.
Linux man-pages and kernel documentation: ptrace(2), proc_pid_status(5), Yama ptrace_scope, capabilities(7), perf_event_open(2), perf security, /proc filesystem documentation.
Apple documentation and source: ptrace, sysctl, IOKit IORegistry, debugging entitlement, Rosetta sysctl.proc_translated, Virtualization.framework, Hypervisor.framework, XNU cs_blobs.h / CS_DEBUGGED.
DMTF SMBIOS DSP0134 and Intel Software Developer’s Manual family.
Peer-reviewed/research corpus: Bulazel & Yener, Afianian et al., BareBox, BareCloud, SandPrint, Spotless Sandboxes, Enviral, Detecting Hardware-Assisted Virtualization, Rethinking anti-emulation techniques, INSDET, HyperDbg, PoW-How/Scramblesuit, telemetry-complexity attacks, LLC/NoC/NoIR references.
Practitioner/tooling corpus: Check Point anti-debug/evasion catalogs, Unprotect Project, ANY.RUN packer study, eShard, Praetorian, secret.club, momo5502, rayanfam Hypervisor From Scratch, LibIHT, Bryce Bostwick, ScyllaHide, TitanHide, x64dbg, NoVmp/VTIL, Pinicorn, UnSafengine64, Qiling, Unicorn, Frida, strongR-frida/hluda.

15. Quality Gates

Gate	Result
QG1	No normative judgment required; report is scoped to defensive analysis and reproducibility.
QG2	Assumption Register included with falsification probes.
QG3	Windows, Linux, macOS/iOS notes, anti-debugging, anti-instrumentation, anti-VM, anti-sandbox, anti-emulation, microarchitectural, DBI, Frida, PoW, and telemetry-complexity coverage included.
QG4	No SI calculations requiring dimensional validation; constants/offsets preserved as source mentions with version caveats.
QG5	Spawn-vs-attach, entitlement drift, emulator version drift, descriptor-table obsolescence, tool contamination, Apple VM drift, and TSX availability addressed.
QG6	Provenance categories preserved; source documents appended verbatim.
QG7	Bounded scope expansion included with impact labels.
QG8	No source-level mention is intentionally omitted: verbatim source-retention annex follows.

16. Source Metadata and Integrity

Source ID	File	Bytes/characters	SHA-256 of text	Role
S1	`anti-debug-emulation-synthesis.md`	63,064	`8c8d85fd13c6e0ec1b8994ab4cfa75b591ad1ffdd6216cef4939f2fee2678231`	Existing unified cross-platform synthesis used as the primary spine.
S2	`mit3.md`	50,096	`a5917fc81ded63b3f0e0dbdd3788233fc8f9d60be28cd4c2b0eece255f262df0`	Integrated delta/addendum with missing items and version-sensitive corrections.
S3	`mit2.md`	109,768	`a7f34e1a843681e1a4c34bb22f0e6fa7da2274eb170a698af8d7dba126558697`	Defensive taxonomy with OS/vendor/research provenance and mitigation framework.
S4	`mit1.md`	13,510	`fee81a17218d90db3236d132d14238ac97fb26e0e881e4e1119636d84f8e2a40`	Architecture-of-evasion concise technical reference.
S5	`Pasted text(9).txt`	33,801	`4f4d554fe160ffb9004472a36ce082d54306bc4274f26c205eb3a776e6342286`	Comprehensive technical reference with concrete primitives and state-of-art tooling notes.
S6	`Pasted text (2)(1).txt`	71,610	`37736a776af973bb4859fd4d1ddbcfce73906ab3e9e1fcfc06686fd4d1ba11e5`	Long-form architecture analysis with Windows/Linux/macOS narrative and works cited.

17. Source Heading Concordance

This section lists source headings to show structural coverage across the corpus.

S1 — `anti-debug-emulation-synthesis.md`

Anti-Debugging, Anti-Instrumentation & Anti-Emulation: Unified Cross-Platform Technical Reference (Windows / Linux / macOS)
TL;DR
0. Scope, assumptions, and falsification probes
1. Core model: signal collection + behavior gating
2. Anti-debugging
2.A Windows
2.A.1 PEB / process-state checks (spawn-time vs attach is decisive)
2.A.2 API / kernel-object queries (the strong tier — query the kernel, not the PEB)
2.A.3 Exception-based checks
2.A.4 Hardware breakpoints / debug registers
2.A.5 Timing
2.A.6 Self-debugging / anti-attach
2.A.7 Tool / window / object / module enumeration
2.A.8 Code-integrity / breakpoint scanning
2.A.9 TLS callbacks, page-guard, write-watch, SMC
2.B Linux
2.C macOS / iOS
3. Anti-instrumentation / hook & DBI detection (cross-platform)
4. Anti-emulation / anti-VM / anti-sandbox
4.1 CPU / hypervisor / ISA-level
4.2 Emulator-correctness / semantic-gap discrepancies
4.3 Firmware / DMI / SMBIOS / ACPI / platform identity
4.4 Device / bus / peripheral inventory
4.5 Virtualization software artifacts (drivers/services/devices)
4.6 OS profile / installation age / "wear-and-tear" / spotless-sandbox
4.7 Process / service / driver / module artifacts
4.8 Filesystem / registry / configuration (per-OS)
4.9 User-activity / reverse-Turing checks (T1497.002)
4.10 Time-based sandbox evasion & stalling (T1497.003)
4.11 Network / internet-environment checks
4.12 Container / cloud / WSL / namespace checks
5. Modern / state of the art
5.1 Multi-signal scoring — "score the scorekeeper"
5.2 Behavior-gating patterns
5.3 Microarchitectural & hardware-assisted detection
5.4 Anti-anti-debug tooling
5.5 Hypervisor-based stealth debugging
5.6 Hardware tracing
5.7 Anti-tampering & virtualization-based obfuscation
5.8 Bounded-scope risks (impact-labeled)
6. Analyst posture: tiered tooling & mitigation framework
7. Consolidated per-OS checklists
7.1 Windows
7.2 Linux
7.3 macOS
8. Caveats & quality gates
9. Consolidated references / provenance

S2 — `mit3.md`

Integrated delta to the prior report
Addendum A — Windows techniques not fully covered
A1. Spawn-vs-attach debugger-state distinction
A2. Global DebugObject and object-type enumeration
A3. ThreadHideFromDebugger as active debugger blinding
A4. Direct debugger interaction and UI disruption
A5. Finer Windows exception and instruction probes
A6. Anti-attach via remote break-in semantics
A7. Windows anti-VM additions: thermal, ACPI, and firmware realism
Addendum B — Linux techniques not fully covered
B1. prctl and ptrace-policy manipulation
B2. Procfs beyond TracerPid
B3. Stateful self-tracing and parent-child repair
B4. Linux ASLR, seccomp, and breakpoint edge probes
Addendum C — macOS techniques not fully covered
C1. PT_DENY_ATTACH with direct or early invocation
C2. sysctl P_TRACED and process-state retrieval
C3. csops, csops_audittoken, and CS_DEBUGGED
C4. Mach exception-port inspection and exception-port stealing
C5. task_for_pid, Hardened Runtime, AMFI/taskgated, and entitlements
C6. dyld environment, library validation, and Hardened Runtime
C7. macOS VM and Apple Silicon correction
Addendum D — Anti-emulation, anti-DBI, and state-of-the-art additions
D1. Hypervisor fingerprint hierarchy
D2. QEMU TCG translation-block artifacts
D3. Emulator correctness differential tests
D4. DBI and Frida-specific detection
D5. Intel TSX and Intel PT
D6. Proof-of-work and economic timing evasion
D7. Telemetry-complexity denial-of-analysis
Addendum E — Revised mitigation strategy
E1. Add an “environment consistency ledger”
E2. Add “four-run differential baseline”
E3. Add “tooling contamination” rule
E4. Add “macOS entitlement parity” rule
Items to downgrade or mark version-sensitive
Updated Bounded Scope Expansion
Provenance additions
Quality-gate delta

S3 — `mit2.md`

0. Assumption Register
1. Core model: anti-analysis as signal collection plus behavior gating
2. Anti-debugging techniques
2.1 Direct debugger-state checks
Windows
Linux
macOS
2.2 Breakpoint and code-integrity checks
2.3 Exception, signal, and control-flow abuse
Windows-specific
Linux-specific
macOS-specific
2.4 Timing-based anti-debugging
2.5 Dynamic instrumentation and hook detection
3. Anti-emulation, anti-VM, and anti-sandbox techniques
3.1 CPU, hypervisor, and ISA-level checks
3.2 Firmware, DMI/SMBIOS, ACPI, and platform identity checks
3.3 Device, bus, and peripheral inventory checks
3.4 OS profile, installation age, and “wear-and-tear” checks
3.5 Process, service, driver, and module artifact checks
3.6 Filesystem, registry, and configuration checks
Windows
Linux
macOS
3.7 User-activity and reverse-Turing checks
3.8 Time-based sandbox evasion and stalling
3.9 Network and internet-environment checks
3.10 Container, cloud, WSL, and namespace checks
3.11 Full-system emulator and DBT semantic-gap checks
4. Modern and state-of-the-art evasion patterns
4.1 Multi-signal environment scoring
4.2 Differential benign behavior
4.3 Environment-bound decryption
4.4 Human-interaction gating
4.5 Wear-and-tear fingerprinting
4.6 Public-sandbox fingerprinting
4.7 Microarchitectural and hardware-assisted checks
4.8 Anti-hook and untrusted-telemetry checks
4.9 Triggered and staged execution
5. OS-specific anti-analysis checklist
5.1 Windows checklist
Debugger and instrumentation checks
VM/sandbox/emulation checks
5.2 Linux checklist
Debugger and instrumentation checks
VM/sandbox/emulation checks
5.3 macOS checklist
Debugger and instrumentation checks
VM/sandbox/emulation checks
6. Defensive mitigation strategies
6.1 Static triage and pre-execution mapping
6.2 Multi-environment differential execution
6.3 Environment consistency over string hiding
6.4 Time-control discipline
6.5 Persona engineering
6.6 Trigger discovery and path exploration
6.7 Cross-view telemetry
6.8 Hook and instrumentation hygiene
6.9 Bare-metal and hardware-assisted analysis
6.10 Detection engineering
7. Bounded scope expansion: unconventional opportunities and risks
8. Provenance
9. Quality gates

S4 — `mit1.md`

The Architecture of Evasion: A Comprehensive Technical Reference on Anti-Debugging, Anti-Emulation, and Anti-Instrumentation
Executive Summary & TL;DR
1. The Core Model of Evasion
2. Windows Anti-Debugging Methodologies
2.1 User-Mode Telemetry & The PEB
2.2 Advanced API Interrogation & Kernel Structures
2.3 Exceptions, Breakpoints, and Control Flow
3. Linux Anti-Debugging Methodologies
3.1 Ptrace Subversion
3.2 The Procfs Virtual Filesystem
4. macOS & iOS Anti-Debugging Methodologies
4.1 Kernel Denials and Sysctl
4.2 SIP and Entitlements
5. Anti-Emulation, Anti-VM, & Anti-Sandbox
5.1 CPU & Hypervisor Fingerprinting
5.2 Emulator Correctness & Semantic Gaps
5.3 Wear-and-Tear & "Spotless Sandboxes"
5.4 Timing & Proof-of-Work (PoW) Sandbox Exhaustion
6. Anti-Instrumentation & DBI Detection
7. State of the Art: Microarchitectural Evasion & Mitigation
7.1 Intel TSX (Transactional Synchronization Extensions)
7.2 The Analyst's Arsenal: Hypervisors & Hardware Tracing
8. Defensive Recommendations & Analyst Playbook
Appendix: OS-Specific Quick Reference Checklists
Windows Checklist
Linux Checklist
macOS Checklist

S5 — `Pasted text(9).txt`

Anti-Debugging, Anti-Emulation & Anti-Instrumentation: A Comprehensive Technical Reference (Windows / Linux / macOS)
TL;DR
Key Findings
Details
TAXONOMY OVERVIEW
(A) WINDOWS ANTI-DEBUG
A1. PEB-based checks
A2. API-based checks
A3. Exception-based checks
A4. Hardware-breakpoint / debug-register detection
A5. Timing checks
A6. Self-debugging / anti-attach
A7. Tool / window / object enumeration
A8. Code-integrity / breakpoint scanning
A9. TLS callbacks, page-guard, heap/stack tricks
(B) LINUX ANTI-DEBUG
(C) MACOS ANTI-DEBUG
(D) ANTI-EMULATION / ANTI-VM / ANTI-INSTRUMENTATION (cross-platform)
D1. CPU / hypervisor fingerprinting
D2. Instruction-behavior / emulator-correctness discrepancies
D3. Virtualization artifacts (registry/devices/firmware)
D4. DBI / instrumentation detection
D5. Page-permission / code-cache integrity / SMC traps
D6. Microarchitectural side channels
(E) MODERN / STATE OF THE ART
Recommendations
Caveats

S6 — `Pasted text (2)(1).txt`

The Architecture of Evasion: A Comprehensive Analysis of Cross-Platform Anti-Debugging and Anti-Emulation Methodologies
Introduction
Windows Anti-Debugging Methodologies
User-Mode Telemetry and the Process Environment Block (PEB)
Thread Local Storage (TLS) Callbacks
Advanced API Interrogation and Kernel Structures
Object Tracking and Global Handle Enumeration
Thread Subversion and Notification Suppression
Hardware Breakpoints, Guard Pages, and Exception Interception
User Interface and Interaction Disruption
Microarchitectural Evasion: Intel Transactional Synchronization Extensions (TSX)
Windows Anti-Emulation and Sandbox Evasion
Firmware, ACPI, and Registry Interrogation
Environmental and Hardware Profile Constraints
Instruction-Level Discrepancies and Unaligned Vectorization
QEMU Tiny Code Generator (TCG) Atomic Translation Anomalies
Extended Page Table (EPT) Hook Identification and RDTSC Timing
Linux Anti-Debugging Methodologies
The Procfs Virtual Filesystem Paradigm
Ptrace Subversion and Preemption
Advanced Self-Modifying Code and Signal Interception
Linux Anti-Emulation and Sandbox Evasion
Sysfs and Hardware Fingerprinting
macOS and iOS Anti-Debugging Methodologies
PT_DENY_ATTACH and Direct Kernel Syscalls
Kernel Flag Interrogation via Sysctl
Mach Exception Port Enumeration
Sandboxing, Signature Validation, and System Integrity Protection (SIP)
macOS Anti-Emulation and Virtualization Awareness
IOKit and IORegistry Telemetry
Apple Silicon and the Virtualization Framework
Cross-Platform Advanced Evasion: Timing, Side-Channels, and Obfuscation
Timing Side-Channels and Proof-of-Work (PoW) Sandbox Exhaustion
Code Virtualization and Last-Level Cache (LLC) Side-Channels
Conclusion
Works cited

18. Technical Mention Inventory

The following machine-generated concordance preserves code-like symbols, constants, artifact names, paths, ATT&CK identifiers, tool names, and platform primitives found in the source corpus. Source IDs indicate where each mention appears. The verbatim annex remains authoritative for exact context.

Mention	Sources
`#BP`	S1
`#DB`	S1, S2
`#GP`	S1
`#VE`	S1
`+load`	S1, S2, S5
`-1`	S1, S4
`-1 EPERM`	S1
`-cpu host`	S1, S5
`-cpu host,-hypervisor`	S1, S5
`-d`	S1, S5
`-l`	S1, S5
`-singlestep`	S1, S5
`.bash_history`	S1, S3
`.charmve`	S1, S5
`.pinclie`	S1, S5
`.text`	S1, S2, S4
`.zsh_history`	S1, S3
`/.../Yama.txt`	S1
`/.dockerenv`	S1, S3
`//air.unimi.it/handle/2434/938987`	S6
`//anti-debug.checkpoint.com/techniques/debug-flags.html`	S6
`//anti-debug.checkpoint.com/techniques/interactive.html`	S6
`//anti-debug.checkpoint.com/techniques/object-handles.html`	S6
`//arxiv.org/abs/1811.01190`	S3
`//arxiv.org/abs/2105.14273`	S2
`//arxiv.org/abs/2109.02979`	S2
`//arxiv.org/abs/2207.05676`	S2
`//arxiv.org/abs/2511.04472`	S2
`//arxiv.org/html/2511.04472v3`	S6
`//attack.mitre.org/techniques/T1497/`	S1, S6
`//attack.mitre.org/techniques/T1497/001/`	S3, S6
`//attack.mitre.org/techniques/T1497/002/`	S3
`//attack.mitre.org/techniques/T1497/003/`	S3
`//attack.mitre.org/techniques/T1622/`	S1, S3, S6
`//bryce.co/undebuggable/`	S6
`//coffsec.medium.com/top-20-files-linux-forensic-must-check-c1d681d14e1f`	S6
`//colinsenner.com/blog/thread-hide-from-debugger/`	S6
`//crackingwalnuts.com/linux`	S6
`//crackingwalnuts.com/linux/ptrace`	S6
`//ctf-wiki.mahaloz.re/reverse/windows/anti-debug/ntqueryinformationprocess/`	S6
`//cysec.kr/publications/emul-detect.pdf`	S2
`//developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment`	S3
`//developer.apple.com/documentation/bundleresources/entitlements/com.apple.security.cs.debugger`	S2, S3
`//developer.apple.com/documentation/virtualization`	S2, S3, S6
`//developer.apple.com/documentation/virtualization/using-icloud-with-macos-virtual-machines`	S2
`//developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man2/ptrace.2.html`	S2, S3
`//developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/sysctl.3.html`	S2, S3
`//dl.acm.org/doi/10.1145/2076732.2076790`	S3
`//dl.acm.org/doi/10.1145/3150376.3150378`	S3
`//dl.acm.org/doi/10.1145/3365001`	S3
`//docs.kernel.org/admin-guide/perf-security.html`	S3
`//docs.peruzal.com/mobile-device-security-and-penetration-testing/ios-anti-reversing-defenses`	S6
`//download.vusec.net/papers/enviral_eurosec23.pdf`	S3
`//eclecticlight.co/2026/04/29/virtualisation-on-apple-silicon-macs-is-different/`	S6
`//en.wikipedia.org/wiki/Transactional`	S6
`//en.wikipedia.org/wiki/Transactional_Synchronization_Extensions`	S6
`//evasions.checkpoint.com/src/MacOS/macos.html`	S6
`//fluxsec.red/vectored-exception-handling-squared-rust`	S6
`//forum.hise.audio/topic/9477/lessons-learned-developing-in-a-macos-vm-on-apple-silicon`	S6
`//gist.github.com/hankbao/174f341a69da0472069d361f86ac09d7`	S6
`//gist.github.com/soxfmr/16c495d6e4ad99e9e46f5bfd558d152f`	S6
`//github.com/cev-api/vm-detect`	S6
`//github.com/domin568/Anti-Debug-examples-Windows`	S6
`//github.com/nullhypothesis/scramblesuit`	S6
`//github.com/theo-abel/awesome-anti-virtualization`	S6
`//github.com/tobyxdd/linux-anti-debugging`	S6
`//github.com/vtky/ios-antidebugging`	S6
`//github.com/yo-yo-yo-jbo/anti`	S6
`//github.com/yo-yo-yo-jbo/anti_debugging_intro`	S6
`//grokipedia.com/page/Ptrace`	S6
`//gururaj-s.github.io/assets/pdf/CAL23`	S6
`//gururaj-s.github.io/assets/pdf/CAL23_Kar.pdf`	S6
`//hacktricks.wiki/en/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.html`	S6
`//huggingface.co/datasets/Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset`	S6
`//kr0tt.github.io/posts/early-exception-handling/`	S6
`//learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/feature-discovery`	S3
`//learn.microsoft.com/en-us/windows-hardware/drivers/bringup/acpi-system-description-tables`	S6
`//learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntsetinformationthread`	S2
`//learn.microsoft.com/en-us/windows/win32/api/debugapi/nf-debugapi-isdebuggerpresent`	S3
`//learn.microsoft.com/en-us/windows/win32/api/profileapi/nf-profileapi-queryperformancecounter`	S3
`//learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-getsystemfirmwaretable`	S3
`//learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntqueryinformationprocess`	S3
`//learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb`	S3
`//learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-blockinput`	S2
`//learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-computersystem`	S3
`//learn.microsoft.com/en-us/windows/win32/debug/communicating-with-the-debugger`	S3
`//ling.re/hardware-breakpoints/`	S6
`//linuxsecurity.com/features/hacker-s-corner-complete-guide-to-anti-debugging-in-linux-part-2`	S6
`//man7.org/linux/man-pages/man2/perf_event_open.2.html`	S3
`//man7.org/linux/man-pages/man2/ptrace.2.html`	S3, S6
`//man7.org/linux/man-pages/man5/proc_pid_status.5.html`	S3
`//man7.org/linux/man-pages/man7/capabilities.7.html`	S3
`//mas.owasp.org/MASTG-KNOW-0085/`	S6
`//medium.com/`	S6
`//medium.com/csg-govtech/preventing-an-ios-mobile-application-from-being-debugged-the-secure-way-1094731ff566`	S6
`//momo5502.com/posts/2022-05-02-detecting-hypervisor-assisted-hooking/`	S6
`//msolarana.netlify.app/2018/09/14/anti-debugging/`	S6
`//ntquery.wordpress.com/2014/03/30/anti-debug-ntqueryobject/`	S6
`//objective-see.org/blog/blog`	S6
`//objective-see.org/blog/blog_0x59.html`	S6
`//pmc.ncbi.nlm.nih.gov/articles/PMC11208535/`	S6
`//pub.dev/packages/flutter`	S6
`//pub.dev/packages/flutter_neo_shield/versions/1.11.0`	S6
`//raw.githubusercontent.com/apple-oss-distributions/xnu/main/osfmk/kern/cs_blobs.h`	S2
`//rayanfam.com/topics/hypervisor-from-scratch-part-7/`	S6
`//research.meekolab.com/understanding-kernel-level-anticheats-in-online-games`	S6
`//retrocomputing.stackexchange.com/questions/28367/did-any-x86-cpu-optionally-trap-unaligned-access`	S6
`//revers.engineering/evading-trivial-acpi-checks/`	S6
`//reverseengineering.stackexchange.com/questions/1686/how-to-detect-a-virtualized-environment`	S6
`//reze.gitbook.io/bin/maldev/evasion/anti-debugging-techniques`	S6
`//safedep.io/art-template-npm-supply-chain-compromise/`	S6
`//secret.club/2025/06/02/hypervisors-for-memory-introspection-and-reverse-engineering.html`	S6
`//security.stackexchange.com/questions/232911/what-mechanisms-prevent-me-from-ptraceing-a-signed-osx-application`	S6
`//sol.sbc.org.br/index.php/sbseg/article/download/19504/19332/`	S6
`//sourceware.org/ml/gdb/2016-11/msg00011.html`	S6
`//stackoverflow.com/questions/1401359/understanding-linux-proc-pid-maps-or-proc-self-maps`	S6
`//stackoverflow.com/questions/39956963/how-to-implement-pt-deny-attach-anti-debugging-in-ios`	S6
`//stackoverflow.com/questions/4744826/detecting-if-ios-app-is-run-in-debugger`	S6
`//stackoverflow.com/questions/59777566/is-it-possible-to-debug-intel-tsx`	S6
`//stackoverflow.com/questions/76254673/how-to-prevent-ptrace-anti-debugging-in-android`	S6
`//unprotect.it/snippet/detecting-virtual-environment-artefacts/245/`	S6
`//unprotect.it/technique/detecting-virtual-environment-artefacts/`	S6
`//unprotect.it/technique/kernel-flag-inspection-via-sysctl/`	S6
`//unprotect.it/technique/ntsetinformationthread/`	S6
`//users.cs.utah.edu/`	S6
`//vblocalhost.com/uploads/VB2021-Wardle.pdf`	S6
`//web.mit.edu/darwin/src/modules/xnu/osfmk/man/task_set_exception_ports.html`	S2
`//www.appknox.com/blog/anti-debugging-techniques`	S6
`//www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software`	S6
`//www.christian-rossow.de/publications/detectvt-dimva2016.pdf`	S3
`//www.christian-rossow.de/publications/sandprint-raid2016.pdf`	S3
`//www.codereversing.com/archives/595`	S6
`//www.coredump.gr/articles/ios-anti-debugging-protections-part-2/`	S6
`//www.cynet.com/security-foundations/attack-techniques/malware-anti-vm-techniques/`	S6
`//www.dmtf.org/sites/default/files/standards/documents/DSP0134_3.2.0.pdf`	S1, S3
`//www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer`	S6
`//www.eshard.com/blog/windows-anti-vm-detection-bypass`	S6
`//www.infosecinstitute.com/resources/hacking/anti-debugging-and-anti-vm-techniques-and-anti-emulation/`	S6
`//www.intel.com/content/www/us/en/developer/articles/community/exploring-tsx-with-software-development-emulator.html`	S6
`//www.intel.com/content/www/us/en/developer/articles/community/tsx-profiling-with-linux-perf.html`	S6
`//www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html`	S1, S2, S3
`//www.kernel.org/doc/Documentation/security/Yama.txt`	S3
`//www.kernel.org/doc/html/next/filesystems/proc.html`	S6
`//www.layakk.com/blog/practical-examples-with-fridafrida-vs-anti-debug-techniques-on-windows-ii/`	S6
`//www.lodsb.com/ntsetinformationthread-disabling-threadhidefromdebugger`	S6
`//www.ndss-symposium.org/ndss-program/ndss-2022/`	S6
`//www.pku-exploit.com/files/paper88.pdf`	S6
`//www.qemu.org/docs/master/devel/tcg.html`	S2
`//www.reddit.com/r/cprogramming/comments/1s0xirj/my`	S6
`//www.reddit.com/r/cprogramming/comments/1s0xirj/my_first_c_malware_sample_implementing_basic/`	S6
`//www.researchgate.net/publication/316857425`	S6
`//www.researchgate.net/publication/354944758`	S6
`//www.researchgate.net/publication/354944758_PoW-How_An_Enduring_Timing_Side-Channel_to_Evade_Online_Malware_Sandboxes`	S6
`//www.researchgate.net/publication/362815857`	S6
`//www.sonicwall.com/blog/top-malware-anti-analysis-coverage`	S6
`//www.trendmicro.com/en/research/20/g/updates-on-quickly-evolving-thiefquest-macos-malware.html`	S6
`//www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/kirat`	S3
`//www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/`	S6
`/001/`	S1
`/002/`	S1
`/003/`	S1
`/0x10`	S1
`/0x18`	S1, S5
`/0x1E/0x1F/0x20`	S1
`/0x1E/0x1F/0x20/0x29`	S1, S5
`/0x44`	S1, S5
`/0x74`	S1, S5
`/0xFFFFFFFF`	S5
`/2/4/6`	S1, S5
`/2076732.2076790`	S1
`/2076732.2076790**`	S3
`/26`	S1, S5
`/27043`	S5
`/27043**`	S1
`/3/4`	S1, S5
`/3150376.3150378`	S1
`/3150376.3150378**`	S3
`/32**`	S1
`/3365001`	S1
`/3365001**`	S3
`/3548606.3560649**`	S2
`/978-3-319-45719-2_8`	S1
`/978-3-319-45719-2_8**`	S3
`/__pin_tls`	S5
`/aarch64`	S1, S3
`/absence`	S1
`/absent`	S2
`/acceleration`	S5
`/ACPI`	S1, S2, S3, S4
`/ACPI/SMBIOS`	S2
`/AD`	S1
`/admin`	S3
`/admin-guide/perf-security.html`	S1
`/after`	S1
`/age`	S1
`/agents`	S1
`/Amcache/ShimCache`	S1, S3
`/Amcache/ShimCache/UserAssist`	S1
`/AMD-V`	S1, S2, S5
`/AMFI`	S1, S4, S5
`/android-performance-monitor-anti-debugging-9758cf1b2f1f`	S6
`/anti`	S6
`/Anti-Debug-examples-Windows`	S6
`/anti-debugging-techniques-4d8f89f8a361`	S6
`/anti-emulation`	S1
`/anti-instrumentation`	S5
`/anti-single-step`	S3
`/Any.run`	S5
`/API`	S3
`/API/PEB`	S1
`/API/PEB-state`	S4, S5
`/APIC/timer`	S1, S3
`/Apple-Silicon`	S1
`/Apple/QEMU/Intel`	S2
`/arch-specific`	S1, S5
`/arch-specific**`	S1, S5
`/ASN/TLS/timing/prior-submission`	S1
`/attach`	S2
`/audio/GPU/sensor/storage`	S3
`/audio/USB/sensor`	S3
`/audio/USB/sensors`	S1
`/audit/perf`	S1, S3
`/audit/perf/VMI`	S3
`/aufs`	S1, S3
`/auxv/environment**`	S1
`/Azure/GCP`	S1, S3
`/bare`	S3
`/bare-metal`	S1
`/BareCloud`	S1
`/battery`	S3
`/Bluetooth`	S3
`/BLX`	S1, S5
`/board`	S1
`/board/model`	S2
`/Bochs/Unicorn/PANDA/custom`	S1
`/boot-ID/UUID/logs`	S1
`/BPU`	S5
`/branch`	S1, S5
`/breakpoint`	S1
`/breakpoint-exception`	S1
`/breakpoints`	S1, S5
`/browser/office/security/updater`	S3
`/BS/TS`	S1, S5
`/BSON`	S2
`/C2-controlled`	S1
`/cache/history/extensions`	S3
`/camera/battery/sensors`	S1
`/camera/mic/location`	S1
`/camera/mic/TCC`	S1
`/camera/microphone/TCC`	S3
`/CAPE/Joe`	S5
`/captions`	S1
`/CFI`	S1, S5
`/cgroup`	S1, S3
`/chained`	S5
`/child`	S1, S2, S3
`/class`	S1, S3
`/cloned`	S1
`/code`	S2
`/commit/abort`	S1, S5
`/config`	S1
`/container`	S1, S3
`/containment/observability`	S1
`/control`	S3
`/control-flow`	S2
`/controller`	S2
`/cookies/bookmarks/sessions/extensions`	S1
`/counter`	S1, S5
`/countering`	S1
`/cprogramming`	S6
`/cross-clock`	S1
`/crypto`	S1
`/data/local/tmp/frida-server`	S1, S5
`/date`	S3
`/DBI`	S1, S2
`/DBI/EDR`	S3
`/debug`	S2, S3
`/debug-break`	S2
`/debug-port`	S1
`/debug-register`	S1, S3
`/debugapi/profileapi/sysinfoapi/cimwin32prov`	S1
`/debugger`	S3
`/debugging-entitlement`	S1
`/DebugObject`	S1
`/decoder`	S2
`/decremented`	S1
`/decrypt`	S1, S3
`/delay`	S1, S3
`/descendant-only`	S1, S5
`/dev`	S1, S3
`/developer`	S3
`/device`	S1, S3, S5
`/device-tree`	S1
`/devices/firmware`	S5
`/devices/strings`	S1, S5
`/disabled`	S2
`/disk`	S1, S3
`/display`	S1, S3
`/display/GPU`	S1, S3
`/ditching-the-debugger-2bb09eea3101`	S6
`/DMI`	S1, S3, S5
`/dock`	S1, S3
`/document`	S3
`/Downloads/Desktop`	S1
`/DPI/lock/screensaver/multi-monitor`	S1
`/drivers`	S1, S5
`/DTrace`	S1
`/DTrace/monitoring`	S3
`/DTrace/tool`	S3
`/dummy/no`	S1
`/dwell/macro-enable`	S1
`/dyld`	S2
`/DYLD`	S5
`/dylib/injected-agent`	S1, S3
`/dynamically`	S3
`/DynamoRIO/QBDI/Valgrind`	S5
`/DynamoRIO/QBDI/Valgrind-style`	S2
`/EAT`	S1, S3
`/EAT/PLT/GOT/dyld-stub`	S1
`/EDR`	S1, S2, S3
`/EDR-present`	S3
`/emulation`	S3
`/emulation/VM`	S3
`/emulator`	S1, S2, S4, S5
`/emulators`	S3
`/entitlement-dependent`	S1
`/environment`	S2, S3
`/EPT`	S1, S4, S5
`/errata`	S5
`/ETW/EndpointSecurity`	S2
`/evasion`	S1, S3
`/event`	S1
`/Examiner-style`	S2
`/exception`	S1, S3, S5
`/exception-flow`	S1
`/exception-heavy`	S1, S5
`/exception/signal-mapping/fault-address`	S1
`/exception/timing`	S1
`/exception/timing-based`	S4, S5
`/exec`	S5
`/execute`	S1
`/FADT/DSDT`	S1
`/FADT/RSDT`	S2
`/fan/ambient/camera`	S1, S3
`/fd/cmdline`	S3
`/Finder`	S1, S3
`/FindWindowEx/EnumWindows`	S5
`/firmware`	S1, S2, S3, S5
`/ForceFlags`	S5
`/foxy/bin`	S6
`/FPU`	S2
`/fresh`	S1, S3
`/Frida`	S2
`/frida-gadget`	S5
`/frida-gadget/frida-server`	S5
`/FS/GS/system-register`	S2
`/future-trace`	S2
`/GDT/LDT/task-register`	S3
`/GetTickCount64`	S5
`/gmain/gdbus/pool-frida/linjector`	S5
`/GOT`	S3
`/GOT/PLT/dyld`	S3
`/GPU`	S1, S3
`/GPU/USB/Bluetooth/Wi-Fi`	S3
`/GPU/USB/BT/Wi-Fi`	S1
`/GS`	S1, S5
`/guard/fault`	S3
`/Hardened`	S3, S4
`/Hardened-Runtime`	S1
`/hardening*`	S5
`/hardening/interpretation*.`	S1
`/hardware`	S3
`/harness`	S1
`/headless`	S1, S3
`/heap`	S1, S3
`/HeapFlags/StartupInfo/OsBuildNumber`	S1
`/Hex-Rays-class`	S1
`/High`	S1, S2, S3
`/history`	S3
`/history/profile`	S1
`/history/user-profile`	S3
`/HLE`	S2
`/hluda`	S1
`/hook/instrumentation`	S1
`/hostnames`	S1, S5
`/HPC`	S1, S3
`/HW`	S1
`/HW-assisted/ETW/eBPF/audit/perf/EndpointSecurity/PCAP/FS`	S1
`/Hyper-V/container`	S1, S3
`/hypervisor`	S1, S3
`/I-cache`	S3
`/i-cache`	S5
`/iCloud`	S2
`/IDA`	S1, S4, S5
`/IDA-class`	S5
`/IDA/Ghidra`	S1
`/ida64.exe`	S5
`/IDE/sandbox`	S3
`/idle`	S3
`/implementation-defined`	S2
`/injected`	S1
`/install-age`	S1
`/installer/browser`	S1
`/instrumentation`	S1, S2, S3, S5
`/instrumentation-sensitive`	S2
`/instrumenting`	S2
`/integrity`	S1
`/Intel`	S2, S5
`/interposing`	S1
`/interposition`	S1
`/invalid-instruction`	S1
`/ioctl`	S1, S3
`/ioctl/fcntl/mmap`	S1, S3
`/iOS-side`	S2
`/iPadOS/watchOS/tvOS`	S1
`/IPC/symbol`	S1
`/j.cose.2019.02.005**`	S2
`/JA4`	S1, S3
`/JCS-220005**`	S2
`/JIT`	S5
`/journald`	S3
`/kern/cs_blobs.h`	S1, S5
`/kernel`	S3
`/key-derivation`	S3
`/Kubernetes`	S1, S3
`/KVM`	S1, S2, S5
`/language/IP`	S3
`/latency`	S1, S3
`/LaunchDaemons`	S1, S3
`/LBR`	S1
`/LEN`	S1, S5
`/library-validation`	S2
`/Linux`	S3, S4
`/linux-anti-debugging`	S6
`/linux-anti-debugging-detection-tool-linkage-with-my-code-479bef4f5f87`	S6
`/Linux/macOS`	S1, S3
`/Linux/Windows`	S1, S2
`/LLC`	S1
`/loader-audit`	S1
`/locale`	S1
`/locale/IP`	S1, S3
`/locale/keyboard/documents`	S1
`/locales`	S4
`/lock/idle`	S1
`/lock/TLS/stack-shape`	S1
`/login`	S1
`/login/time`	S3
`/low-weight`	S2
`/MAC`	S1, S3
`/MAC/disk`	S1
`/macOS`	S3
`/macOS.**`	S5
`/mail`	S3
`/malw-sem/slides/02-anti-debugging.pdf`	S6
`/maps`	S5
`/may`	S1
`/MD5`	S1, S5
`/memory-ordering`	S3
`/memory-ordering/cache-coherency/SMC`	S1
`/metadata`	S1
`/microphone/audio/HID`	S3
`/microphone/location`	S3
`/mnt/c`	S1, S3
`/model`	S1, S2, S3
`/model/board`	S2
`/module`	S1, S3
`/module/device`	S3
`/module/tool`	S1, S3
`/monotonic`	S3
`/mouse`	S2
`/MRU`	S1, S3
`/MSR/FS-GS`	S5
`/namespaces`	S1, S3
`/namespaces/overlayfs/Docker/k8s`	S1
`/NaN/denormal/exception-flag`	S1
`/native`	S1, S3
`/NEON-style`	S2
`/network`	S3
`/network-connectivity`	S5
`/NIC/storage`	S1, S3
`/No`	S1, S5
`/no-debugger`	S1, S3
`/no-EDR`	S3
`/no-pill`	S1, S2, S5
`/NoC`	S1
`/non-debug`	S3
`/non-instrumented`	S3
`/non-VM`	S1
`/normalize`	S3
`/NtCreateThreadEx`	S5
`/NtGetContextThread`	S5
`/NtGlobalFlag/HeapFlags/StartupInfo/OsBuildNumber`	S5
`/NtQIP/object-enumeration`	S5
`/NtQIP/thread/object/timing`	S5
`/NtSetDebugFilterState`	S5
`/NULL`	S1
`/NVMe`	S1, S3
`/Obj-C`	S5
`/object-enumeration`	S1
`/object-handles/interactive`	S1
`/ObjectTypeInformation`	S5
`/observe`	S1, S5
`/office/shell`	S1
`/offline`	S1, S3
`/offset`	S1, S3
`/OllyDbg/IDA/TitanEngine`	S1, S5
`/open-source`	S2
`/or`	S1
`/out-of-process`	S3
`/out/syscall/sysenter/cpuid`	S5
`/overhead`	S5
`/overhead-based`	S5
`/overhead/parent-process`	S1
`/oversubscribed`	S2
`/page-protection`	S1
`/papers/enviral_eurosec23.pdf`	S1
`/paste`	S2
`/performance`	S2
`/personas`	S3
`/Pin/DynamoRIO/Valgrind/sanitizers/profilers/EDR`	S1
`/PinShield`	S5
`/PinWinMain`	S5
`/pipe/event-name`	S5
`/platform`	S2
`/PLT`	S1, S3
`/PMU`	S1, S2, S3, S4
`/PoW`	S1
`/power`	S1, S3
`/power/sensor`	S1, S3
`/primitive`	S1
`/printers`	S1, S3
`/private-platform`	S2
`/proc`	S1, S2, S3, S5, S6
`/proc.**`	S5
`/proc/*/cmdline`	S3
`/proc/*/status`	S3
`/proc/<pid>/cmdline`	S1, S3
`/proc/<pid>/comm`	S1, S3
`/proc/<pid>/fd`	S1, S5
`/proc/<pid>/status`	S3
`/proc/<ppid>/cmdline`	S2
`/proc/<ppid>/exe`	S2
`/proc/<tracer>/exe`	S1, S5
`/proc/cpuinfo`	S1, S3
`/proc/pid/maps`	S6
`/proc/scsi/scsi`	S1, S6
`/proc/self/auxv`	S1, S2, S5
`/proc/self/fd`	S1, S2, S3, S4, S5, S6
`/proc/self/maps`	S1, S2, S3, S4, S5, S6
`/proc/self/stat`	S1, S2, S5
`/proc/self/status`	S1, S2, S3, S4, S5, S6
`/proc/self/task/<tid>/comm`	S1, S5
`/proc/self/wchan`	S1, S2, S4, S5, S6
`/proc/sys/kernel/yama/ptrace_scope`	S3
`/process`	S2
`/process-name`	S3
`/process-state`	S5
`/Process32Next`	S5
`/ProcessDebugObjectHandle/ProcessDebugFlags`	S5
`/processes`	S1, S5
`/product/BIOS/board/chassis/UUID`	S1
`/product/UUID`	S1, S3
`/product/UUID/BIOS`	S3
`/productivity`	S3
`/profile`	S1
`/prologue`	S1, S3
`/protectors**`	S1
`/ptrace`	S1, S3
`/ptrace/sysctl`	S1, S3
`/publications/detectvt-dimva2016.pdf`	S1
`/QEMU`	S2
`/QEMU/VBox/VMware`	S1
`/QueryPerformanceCounter`	S5
`/RAM`	S2
`/RAM/CPU`	S5
`/RAM/CPU-count`	S1, S5
`/RAM/disk`	S1, S5
`/rayanfam`	S1
`/RDP/SSH`	S1, S3
`/RDTSC`	S5
`/RDTSCP`	S5
`/re-fingerprint`	S1
`/read`	S5
`/realistic`	S1
`/reboot/rare-event-gated`	S1
`/recycle`	S1, S3
`/registers`	S1
`/relocate`	S1, S5
`/remote`	S1
`/removal`	S3
`/replay`	S1, S3
`/report`	S2
`/reporting`	S2, S3
`/research`	S3
`/resolution`	S1
`/resource`	S2
`/resume`	S3
`/Rosetta`	S1, S3
`/RSI`	S1
`/RTM-like`	S3
`/RWX`	S1, S2, S5
`/RWX/named-lib`	S1
`/sandbox`	S1, S3, S4, S5
`/Sandbox`	S3, S6
`/sandbox.exe`	S5
`/sandbox/emulation`	S1, S3
`/scanners`	S1, S3
`/scramblesuit`	S6
`/scrubbed`	S2
`/seccomp`	S2, S3
`/Secure`	S1, S3
`/security`	S1, S3
`/SEH`	S3
`/SEH/syscall/SMC-heavy`	S5
`/seize`	S1, S3
`/select`	S1
`/self-tracing`	S2
`/sensors`	S3
`/serial/platform`	S1
`/serial/rotational/SMART`	S1
`/serial/SMART/bus`	S1
`/services`	S1, S3
`/services/devices`	S1
`/session`	S3
`/SGDT/SLDT`	S5
`/SGDT/SLDT/STR`	S1, S2, S5
`/shares/AD/mDNS/LLMNR/NetBIOS/IPv6`	S1
`/SIGTRAP`	S5
`/SIMD`	S1, S3
`/single-step/debug`	S2
`/siwvid.sys/ntice.sys/iceext.sys/syser.sys`	S5
`/size`	S2
`/SLDT`	S1, S5
`/SMBIOS`	S1, S3, S5, S6
`/SMBIOS/DMI`	S5
`/SMC/unmapped-memory`	S1, S5
`/SoC`	S2
`/socket`	S1, S3
`/SOs/dylibs`	S1, S3
`/SP.2017.42`	S1
`/SP.2017.42**`	S3
`/SSH`	S1
`/stability/frequency/serialization`	S1
`/stack`	S5
`/staged`	S1
`/stalling`	S3
`/stateful`	S1, S5
`/stateful**`	S1
`/stealth`	S1
`/storage`	S2
`/strings`	S5
`/strongR-frida`	S5
`/SwitchToThread`	S5
`/symbol/load-command`	S1
`/symbolic`	S1
`/sys`	S1, S3
`/sys/block`	S1, S3
`/sys/bus/pci`	S1, S3
`/sys/class/dmi/id`	S1, S3, S4
`/sys/class/dmi/id/product`	S6
`/sys/class/dmi/id/product_name`	S1
`/sys/class/dmi/id/sys`	S6
`/sys/class/dmi/id/sys_vendor`	S1
`/sys/class/net`	S1, S3
`/sys/devices`	S1, S3
`/sys/firmware/acpi`	S1, S3
`/syscall`	S3
`/syscall-timing`	S1
`/syscall-wrapper`	S1
`/syscall/signal/device`	S1
`/sysctl`	S1, S5
`/sysenter`	S1, S5
`/sysfs`	S3
`/syslog/auth`	S1, S3
`/system`	S1, S3
`/SystemTimeToFileTime`	S5
`/tabs/cookies/bookmarks/extensions`	S1
`/task`	S3
`/task-port`	S2
`/taskgated`	S2
`/TCG.**`	S5
`/TEB`	S1, S3
`/tenant`	S1
`/the`	S1, S5
`/Themida`	S1, S4, S5
`/thermal`	S2
`/thread-count`	S1, S3
`/thread/IPC/memory`	S2
`/thread/IPC/memory-map`	S2
`/thread/memory-map`	S1, S3
`/thread/object/timing`	S1
`/thread/port/D-Bus`	S2
`/threads/ports/D-Bus`	S1, S5
`/time`	S1, S3
`/time-delta`	S1, S5
`/timeline`	S1
`/timezone`	S1, S3
`/timezone/IP`	S1, S3
`/timing`	S3
`/timing-class`	S1, S5
`/timing/device`	S1, S3
`/TitanHide`	S1, S5
`/TLB`	S1
`/TLB/branch-predictor`	S3
`/tlfs/feature-discovery`	S1
`/TLS`	S3
`/TLS-interception`	S1
`/TLS/HTTP/PCAP/proxy`	S1
`/TLS/socket`	S3
`/tool-name`	S1
`/tracer`	S3
`/transaction`	S3
`/translation`	S3
`/trap`	S2
`/Trendyol-Cybersecurity-Instruction-Tuning-Dataset`	S6
`/triage`	S1
`/TSC`	S1
`/TSC/syscall-latency/scheduler-jitter`	S1
`/UI`	S3
`/undefined`	S1
`/Unicorn`	S2
`/unified`	S3
`/unlock`	S3
`/unpacked`	S2
`/uptime`	S1
`/user`	S1, S3
`/user-mode`	S3
`/user-profile`	S3
`/user-space`	S3
`/user/kernel/device`	S1
`/usr/bin`	S3
`/usr/lib/system/libsystem`	S6
`/usr/lib/system/libsystem_kernel.dylib`	S1
`/UUID`	S1, S3
`/v6/v7-a/v8-a`	S1, S5
`/VBoxService/VBoxTray/VBoxMouse`	S5
`/VEH`	S1, S3, S5
`/vendor`	S1, S3
`/version`	S1, S3
`/version-/private-build`	S1
`/version/private`	S1
`/versions/1.11.0`	S6
`/Virtual`	S1, S5
`/VirtualAlloc`	S5
`/VirtualBox/Hyper-V/QEMU/Parallels/virtio`	S1
`/VirtualBox/VMware`	S3
`/virtualization`	S1, S3
`/VM`	S2, S3
`/VM-exit`	S3
`/VM/firmware`	S1
`/VMI`	S1, S2, S3
`/VMProtect`	S1, S5
`/VMware/VBox/Hyper-V/QEMU`	S1
`/VMware/VBox/QEMU`	S1
`/VMware/VirtualBox/QEMU`	S3
`/VMware/VirtualBox/QEMU/Parallels`	S1, S3
`/VPN`	S1, S3
`/VPN/corporate`	S3
`/VPN/corporate-profile`	S1
`/VTIL`	S1, S5
`/VTIL**`	S1
`/wall/network/FS/scheduler`	S1
`/Wayland/VNC`	S1, S3
`/wear-and-tear/user-activity`	S1
`/Wi-Fi`	S1, S3
`/window`	S2, S5
`/window/module`	S1, S3
`/Windows`	S3
`/without`	S1
`/WMI/firmware`	S3
`/working-set`	S5
`/write`	S6
`/write-watch`	S1
`/WSL`	S3
`/x86-64`	S3
`/xattr`	S1, S3
`/XEND`	S5
`/zero`	S1
`/ZF`	S4, S5
`00:0C:29`	S1
`0x0`	S1, S4, S5
`0x00`	S1, S6
`0x00 0xBF`	S1
`0x00000800`	S6
`0x00000ED7`	S1, S5
`0x00244ED7`	S1, S5
`0x02`	S1, S4, S5, S6
`0x07`	S4, S6
`0x0A`	S1, S5
`0x0B`	S1, S5
`0x0C`	S1, S5
`0x1`	S6
`0x10`	S1, S5
`0x10000`	S1, S5
`0x10000000`	S1, S2, S5
`0x10BC`	S1, S5
`0x11`	S1, S4, S5, S6
`0x14`	S1, S5
`0x18`	S1, S5
`0x1E`	S1, S4, S5, S6
`0x1F`	S1, S4, S5, S6
`0x20`	S1, S5
`0x200001A`	S1, S5
`0x23`	S1, S5
`0x244`	S1, S5
`0x246`	S1, S5
`0x29`	S1, S5
`0x30`	S1, S5
`0x4`	S1, S5
`0x40`	S1, S5
`0x40000000`	S1, S4, S5, S6
`0x40000001`	S1, S5
`0x40000024`	S1, S5
`0x40000060`	S1, S5
`0x40000062`	S1, S4, S5
`0x44`	S1, S5
`0x4B4D4551`	S1, S5
`0x564D5868`	S1, S5
`0x5658`	S1, S5
`0x5659`	S1, S5
`0x60`	S1, S5
`0x64`	S1, S5
`0x68`	S1, S4, S5, S6
`0x70`	S1, S2, S4, S5, S6
`0x74`	S1, S5
`0x80`	S1, S4, S6
`0x800`	S1, S4
`0x80000002`	S1, S5
`0x80000003`	S1, S5
`0xBC`	S1, S4, S5, S6
`0xBF`	S1, S6
`0xC0000008`	S1, S5
`0xC3`	S1, S5, S6
`0xC3 RET`	S1
`0xCC`	S1, S2, S4, S5, S6
`0xCD03`	S1, S5
`0xd0000000`	S1, S5
`0xe8XXXXXX`	S1
`0xF1`	S1, S5
`0xF3`	S1, S5
`0xF3 0x64 0xF1`	S1
`0xFFFFFFFF`	S1, S4, S5, S6
`0xffXXXXXX`	S1
`<feature policy='disable' name='hypervisor'/>`	S1, S5
`__attribute__((constructor))`	S1, S5
`__DATA`	S1, S3
`__LINKEDIT`	S1, S3
`__pin_tls`	S1, S5
`_ACCESS`	S6
`_ATTACH`	S6
`_BREAKPOINT`	S6
`_CAPABILITIES`	S6
`_CHECK`	S6
`_DENY`	S6
`_dyld_get_image_name`	S1
`_dyld_image_count`	S1
`_ENABLE`	S6
`_FREE`	S6
`_GUARD`	S6
`_HEAP`	S1, S5, S6
`_KERN`	S6
`_NO_DEBUG_HEAP`	S1, S4, S5
`_NO_DEBUG_HEAP=1`	S1, S4, S5
`_PARAMETERS`	S6
`_PID`	S6
`_POWER`	S6
`_PRELOAD`	S6
`_PROC`	S6
`_SEIZE`	S6
`_TAIL`	S6
`_TRACED`	S6
`_TRACEME`	S6
`_VALIDATE`	S6
`_VIOLATION`	S6
`_vsprintf`	S1, S5
`_xabort`	S4
`AArch64`	S1, S3
`ACM`	S1, S3, S5
`ACPI`	S1, S2, S3, S4, S5, S6
`ADDR_NO_RANDOMIZE`	S1, S2, S5
`AddressOfCallBacks`	S1, S5
`AESNI`	S1, S5
`AI-assisted`	S1, S3
`allow-dyld-environment-variables`	S2
`AMD`	S1, S2, S5
`AMD-V`	S1, S2, S5
`AMFI`	S1, S2, S4, S5
`amfi_check_dyld_policy_self()`	S1
`AmIBeingDebugged`	S1, S5
`AMOS`	S6
`AND`	S6
`ANTI`	S5
`ANTI-DEBUG`	S5
`ANTI-EMULATION`	S5
`ANTI-INSTRUMENTATION`	S5
`ANTI-VM`	S5
`ANY`	S1, S5, S6
`API`	S1, S2, S3, S4, S5, S6
`API-based`	S5
`API-hook`	S3
`API-level`	S3
`API-prologue`	S1
`APIC`	S1, S3
`APIs`	S1, S2, S3, S4, S5, S6
`ARC`	S1, S5
`ARC-style`	S1, S5
`ARM`	S1, S2, S3, S5, S6
`ARM64`	S1, S4, S5, S6
`ARMv5`	S1, S5
`ART`	S5
`ASLR`	S1, S2, S5
`ASLR-disabling`	S1, S5
`ASN`	S1, S3
`AT_`	S1, S5
`ATT`	S1, S3, S6
`AWS`	S1, S3
`BANSHEE`	S1, S6
`BareBox`	S1, S3
`BareCloud`	S1, S3
`BeingDebugged`	S1, S2, S3, S4, S5, S6
`BIOS`	S1, S2, S3, S6
`BIOS-date`	S1
`BlockInput`	S1, S2, S6
`BlockInput(TRUE`	S1, S6
`BlockInput(TRUE)`	S1
`BLX`	S1, S5, S6
`BLX R6`	S1
`board-id`	S1, S4
`BPU`	S5
`BRK`	S1, S6
`BSD`	S6
`BSON`	S2
`BTB`	S5
`C07T40BYG1J2`	S6
`CAL`	S1
`CAL23`	S6
`CAL23_Kar`	S6
`CAP_SYS_PTRACE`	S1, S2, S3, S5
`capabilities(7)`	S1, S3
`CAPE`	S5
`CAPTCHA`	S1, S3
`CAPTCHA-like`	S1, S3
`CCS`	S1, S2, S5
`CD-ROM`	S1, S5
`CFG`	S1, S3
`CFI`	S1, S5
`Channel_to_Evade_Online_Malware_Sandboxes`	S6
`CheckRemoteDebuggerPresent`	S1, S2, S3, S4, S5, S6
`ClientIntC`	S1, S5
`clock_gettime`	S1, S3, S4
`CLOCK_MONOTONIC`	S5
`CloseHandle`	S1, S2, S5
`CodeDirectory`	S1, S5
`COFFSec`	S6
`com.apple.security.cs.allow-dyld-environment-variables`	S1, S5
`com.apple.security.cs.debugger`	S1, S2, S5
`com.apple.security.cs.disable-library-validation`	S1, S5
`com.apple.security.get-task-allow`	S1, S2, S5
`Common KVM`	S1
`configureProcessRestrictions()`	S1
`containerURLForSecurityApplicationGroupIdentifier:`	S1
`CONTEXT`	S1, S6
`CONTEXT_DEBUG_REGISTERS`	S1, S4, S5
`CoreFoundation`	S6
`CPU`	S1, S2, S3, S4, S5, S6
`CPU-bound`	S2
`CPU-count`	S1, S5
`CPU-generation`	S1
`CPU-instruction`	S1, S3
`CPU-level`	S3
`CPU-model`	S1
`CPUID`	S1, S2, S3, S4, S5, S6
`CPUID 0x80000002–4`	S1
`CPUID-forced-VM-exit`	S1
`CPUID-forced-VMEXIT`	S5
`CPUs`	S6
`CrackingWalnuts`	S6
`CRC`	S1, S5
`CreateToolhelp32Snapshot`	S1, S5
`cs_blobs.h`	S2
`CS_DEBUGGED`	S1, S2, S4, S5
`CS_DEBUGGED = 0x10000000`	S2
`CS_OPS_STATUS`	S1, S5
`csops_audittoken`	S1, S2
`CSR_ALLOW_TASK_FOR_PID`	S1, S5
`CsrGetProcessId`	S1, S5
`CTF`	S6
`CTL`	S6
`CTL_KERN`	S1, S2, S4, S5
`CVE`	S2
`DBG_PRINTEXCEPTION_C`	S1, S2, S5
`DbgBreakPoint`	S1, S2, S5
`DbgBreakPoint→0xC3`	S1
`DbgSetDebugFilterState`	S1, S5
`DbgUiDebugActiveProcess`	S1, S5
`DbgUiIssueRemoteBreakin`	S1, S5
`DbgUiRemoteBreakin`	S1, S5
`DBI`	S1, S2, S3, S4, S5
`DBI-specific`	S2
`DBI-translated`	S3
`DBT`	S1, S3
`DEBUG`	S5
`DebugActiveProcess`	S1, S2, S5
`DebugBreak`	S1, S3, S4, S6
`DebugBreak()`	S1
`DebugFlags`	S5
`DebuggerEnabled`	S1, S5
`DebuggerNotPresent`	S1, S5
`DebugObject`	S1, S2, S4, S5, S6
`DebugObjectHandle`	S5
`DebugPort`	S1, S4, S5
`DeepSeek`	S6
`DelayInterval`	S1, S5
`DeviceDrivers`	S3
`DEVICEMAP`	S1, S6
`DHCP`	S3
`DIMVA`	S1, S3, S5
`disable-library-validation`	S2, S5
`disable_directexec`	S1, S5
`DLLs`	S1, S3, S6
`dlopen("/usr/lib/system/libsystem_kernel.dylib")`	S1
`dlsym("ptrace")`	S1
`DMI`	S1, S2, S3, S4, S5, S6
`DMTF`	S1, S3
`DNS`	S1, S3, S5
`DNS-sinkhole`	S1
`DOI`	S1, S2, S3
`DPI`	S1, S3
`DR0`	S1, S4, S5, S6
`DR0-DR3`	S4
`DR3`	S1, S4, S5, S6
`DR6`	S1, S5, S6
`DR7`	S1, S5, S6
`DrvFS`	S1, S3
`DRx`	S1, S5
`DSDT`	S1, S2, S6
`DSP0134`	S1
`DSP0134_3`	S1, S3
`DTrace`	S1, S3
`DX=0x5658`	S1
`DYLD`	S1, S5
`DYLD_`	S1, S2, S5
`DYLD_*`	S1, S2
`DYLD_INSERT_LIBRARIES`	S1, S2, S3, S4, S5
`DynamoRIO`	S1, S2, S3, S4, S5
`EAT`	S1, S3
`EAX`	S1, S5, S6
`EAX=0x564D5868`	S1
`EBX`	S1, S5
`EBX=0x564D5868`	S1
`ECX`	S1, S4, S5, S6
`ECX=0x0A`	S1
`EDR`	S1, S2, S3, S4, S6
`EDR-gated`	S1
`EDR-present`	S3
`EDRs`	S6
`EDX`	S1, S5
`EFLAGS`	S1, S2, S4, S5
`EFLAGS.TF`	S2
`EIP`	S1, S5
`ELF`	S1, S2, S3
`EMULATION`	S5
`EndpointSecurity`	S1, S2, S3
`ENOTSUP`	S1, S2, S4, S5, S6
`EnumProcessModules`	S1, S3
`EnumWindows`	S1, S5, S6
`EnvFaker`	S6
`EPERM`	S1, S4, S5, S6
`EPROCESS`	S1, S4, S5, S6
`EPROCESS.DebugPort`	S1, S4
`EPT`	S1, S2, S4, S5, S6
`EPT-based`	S1, S5
`EPT-hook`	S1
`EPT-Hook`	S1, S5
`EPT-violation`	S1, S5
`EPTs`	S6
`error: process exited with status -1 (unable to attach)`	S5
`ETW`	S1, S2, S3
`ETW-based`	S3
`EtwTiLogSetContextThread`	S1, S5
`EuroSec`	S1, S3
`EvilQuest`	S6
`EXAMPLES`	S6
`EXC_MASK_ALL`	S1, S5
`EXC_MASK_GUARD`	S1, S5
`EXC_MASK_RESOURCE`	S1, S5
`EXCEPTION`	S6
`EXCEPTION_ACCESS_VIOLATION`	S1
`EXCEPTION_BREAKPOINT`	S1, S4, S5
`EXCEPTION_INVALID_HANDLE`	S1, S5
`FADT`	S1, S2, S6
`FALSE`	S1, S6
`FindWindow`	S1, S5, S6
`FindWindowEx`	S1, S5
`FLG`	S6
`FLG_HEAP_`	S5
`FLG_HEAP_ENABLE_FREE_CHECK`	S1, S4, S5
`FLG_HEAP_ENABLE_TAIL_CHECK`	S1, S4, S5
`FLG_HEAP_VALIDATE_PARAMETERS`	S1, S4, S5
`ForceFlags`	S1, S2, S4, S5, S6
`ForceFlags=0`	S1, S4
`ForceFlags=0x40000060`	S1
`fork()`	S1
`FPU`	S1, S2, S3
`frida-agent`	S1, S2
`frida-gadget`	S1, S2
`frida-server`	S1, S2
`FRIDAFrida`	S6
`FS-GS`	S5
`FS:[0x30]`	S1
`GCP`	S1, S3
`GDB`	S1, S4, S6
`GDT`	S3
`get-task-allow`	S1, S2, S3
`get_proc_task`	S1, S5
`GetDiskFreeSpaceExA`	S1, S6
`GetLastError`	S1, S5
`GetLocalTime`	S1, S5
`GetProcessHeap`	S6
`GetPwrCapabilities`	S1, S4, S6
`GetSystemFirmwareTable`	S1, S3, S4, S6
`GetSystemTime`	S1, S5
`GetThreadContext`	S1, S4, S5, S6
`GetTickCount`	S1, S3, S5
`GetTickCount64`	S1, S5
`GetWriteWatch`	S1, S5
`GmbH`	S1, S6
`GOT`	S1, S3
`GPU`	S1, S3
`GS:[0x60]`	S1
`GuardedBox`	S1, S5
`GUI`	S2, S6
`GUID`	S1, S3
`gum-js-loop`	S1, S2, S4
`HackTricks`	S6
`HACR`	S6
`HACR_EL2`	S1, S2, S4
`HARDDISK`	S1, S5
`HARDWARE`	S1, S6
`HARDWARE\ACPI\DSDT\VBOX__`	S1
`HARDWARE\Description\System`	S1
`HARDWARE\DEVICEMAP\Scsi\Scsi Port 0`	S1
`HEAP_FREE_CHECKING_ENABLED`	S1, S5
`HEAP_GROWABLE`	S5
`HEAP_GROWABLE-only`	S5
`HEAP_TAIL_CHECKING_ENABLED`	S1, S5
`HEAP_VALIDATE_PARAMETERS_ENABLED`	S1, S5
`HeapFlags`	S1, S5
`HeNet`	S1, S5
`HID`	S1, S3
`HideFromDebugger`	S4
`HISE`	S6
`HLE`	S2, S6
`hluda-server`	S1
`HOW`	S2
`How_An_Enduring_Timing_Side`	S6
`HPC`	S1, S3
`HPET`	S1, S3
`HTTP`	S1, S3
`Hv#1`	S1
`HW-assisted`	S1
`HW-breakpoint`	S1
`HW-profile`	S1
`HyperDbg`	S1, S2, S4, S5
`IA-32`	S2
`IA32_DEBUGCTL`	S1
`IA32_DEBUGCTL_MSR`	S5
`IAT`	S1, S3
`ICE`	S1, S5
`ICE-exception`	S5
`ICEBP`	S1, S2, S5
`iceext.sys`	S1
`IDA`	S1, S2, S4, S5, S6
`IDA-class`	S5
`ida64.exe`	S1
`IDE`	S3
`IDs`	S1, S3
`IDT`	S1, S3, S5
`IDTR`	S1, S5
`IEEE`	S1, S3
`if (NtGlobalFlag & 0x70)`	S5
`IM-bit`	S1, S5
`innotek GmbH`	S1
`INSDET`	S1, S2, S5
`INSTRUMENTATION`	S5
`INT`	S1, S5
`INT1`	S1, S2, S5
`INT2D`	S1, S2, S5
`INT3`	S1, S2, S4, S5, S6
`Intel(R`	S1, S5
`Intel(R) X86 Encoder`	S1
`IOKit`	S1, S3, S6
`IOKitFundamentals`	S3
`IOPlatformExpertDevice`	S1, S6
`IOPlatformSerialNumber`	S1, S4, S6
`IOPlatformSerialNumber = 0`	S4
`ioreg -rd1 -c IOPlatformExpertDevice`	S1
`IORegistry`	S1, S2, S3, S4, S6
`IPC`	S1, S2, S3
`IPv6`	S1, S3
`ISA`	S1, S2, S3, S4, S6
`ISA-level`	S1, S3
`IsDebuggerPresent`	S1, S3, S4, S5, S6
`IsDebuggerPresent()`	S1, S4, S5
`JA3`	S1, S3
`JA4`	S1, S3
`JCS`	S2
`JCS-220005`	S2
`JIT`	S1, S2, S3, S5
`JIT-compiler`	S1, S5
`JSON`	S2
`KERN`	S6
`kern.proc.pid`	S3
`KERN_PROC`	S1, S2, S4, S5
`KERN_PROC_PID`	S1, S4, S5
`kernel.appcore.dll`	S1
`kernel32!DebugActiveProcess → ntdll!DbgUiDebugActiveProcess → DbgUiIssueRemoteBreakin → RtlpCreateUserThreadEx`	S1
`kinfo_proc`	S1
`KiUserExceptionDispatcher`	S1, S5
`KNOW`	S6
`kp_proc.p_flag & P_TRACED`	S1, S5
`KVM`	S1, S2, S5, S6
`KVMKVMKVM`	S1, S4, S5
`LAN`	S3
`LaunchAgents`	S1, S3
`LaunchDaemons`	S1, S3
`LBR`	S1, S2, S5
`LD_AUDIT`	S1, S2, S4, S5
`LD_PRELOAD`	S1, S2, S3, S4, S5
`LdrInitializeThunk`	S1, S6
`LDT`	S3
`LEN`	S1, S5
`LibIHT`	S1, S5
`LingSec`	S6
`LINUX`	S5
`LLC`	S1, S4, S6
`LLDB`	S1, S2, S3, S4, S5, S6
`LLMNR`	S1, S3
`LNCS`	S1, S5
`LODSB`	S6
`LSM`	S1, S3
`MAC`	S1, S2, S3, S4, S5, S6
`mach_absolute_time`	S1, S3
`MACOS`	S5
`MacOS`	S6
`MACs`	S1, S5
`ManPages_iPhoneOS`	S2, S3
`mask = EXC_MASK_ALL & ~(EXC_MASK_RESOURCE \| EXC_MASK_GUARD)`	S1
`MASTG`	S6
`MASTG-KNOW-0085`	S6
`MD5`	S1, S5
`MDM`	S1, S3
`MethodChannel`	S5
`MIB`	S1, S2, S3, S6
`MIB-based`	S2
`MIB-style`	S2
`MITM`	S1, S3
`MITRE`	S1, S3, S4, S5, S6
`MmHighestUserAddress`	S1, S5
`MODE`	S1, S5
`MODE.TSX`	S1
`MODERN`	S5
`monitor_control.disable_directexec`	S5
`monitor_control.disable_directexec="TRUE"`	S1, S5
`MRU`	S1, S3
`MRUs`	S1, S3, S4
`MSR`	S1, S2, S3, S5
`MSRs`	S1, S5
`NaN`	S1, S2, S3
`NDSS`	S6
`NEON`	S2
`NEON-style`	S2
`NetBIOS`	S1, S3
`NeXTSTEP`	S6
`NIC`	S1, S3
`NoC`	S1, S6
`NoDebugInherit`	S1, S6
`NoIR`	S1, S6
`NOP`	S1, S5, S6
`NoVmp`	S1, S5
`nt!EtwTiLogSetContextThread`	S1
`NT-family`	S1, S3
`NtClose`	S1, S2, S5
`NtContinue`	S1, S5
`NtCreateThreadEx`	S1, S5
`NtDelayExecution`	S1, S3, S5
`NtGetContextThread`	S1, S5
`NtGlobalFlag`	S1, S2, S4, S5, S6
`NtGlobalFlag & 0x70`	S1
`ntice.sys`	S1
`NtQIP`	S1, S5
`NtQueryInformationProcess`	S1, S3, S4, S5, S6
`NtQueryInformationProcess(ProcessDebugPort`	S1, S5
`NtQueryInformationProcess(ProcessDebugPort)`	S1
`NtQueryLicenseValue`	S1, S5
`NtQueryLicenseValue("Kernel-VMDetection-Private`	S1
`NtQueryLicenseValue("Kernel-VMDetection-Private")`	S1
`NtQueryObject`	S1, S2, S4, S5, S6
`NtQuerySystemInformation`	S1, S5
`NtQuerySystemInformation(SystemHandleInformation`	S5
`NtQuerySystemInformation(SystemKernelDebuggerInformation=0x23`	S5
`NtQuerySystemInformation(SystemModuleInformation`	S1, S5
`NtQuerySystemInformation(SystemModuleInformation)`	S1
`NtQuerySystemInformation(SystemModuleInformation=0x0B`	S5
`NtSetDebugFilterState`	S1, S5
`NtSetInformationDebugObject`	S1, S5
`NtSetInformationThread`	S1, S2, S4, S5, S6
`NtSetInformationThread(ThreadHideFromDebugger=0x11`	S1, S5
`NtSetInformationThread(ThreadHideFromDebugger=0x11)`	S1
`NtUser`	S1, S5
`NtUser*`	S1
`NtYieldExecution`	S1, S5
`NULL`	S1, S4, S5, S6
`NullHypothesis`	S6
`NVMe`	S1, S3
`NXDOMAIN`	S1, S3
`ObjectAllTypesInformation`	S1, S4, S6
`ObjectTypeInformation`	S5
`ObjectTypesInformation`	S1, S5
`OceanLotus`	S1, S6
`OEM`	S1, S2, S3, S5, S6
`OEP`	S1, S4, S5
`OllyDbg`	S1, S2, S5, S6
`OLLYDBG`	S1, S5
`ollydbg.exe`	S1
`OpenSSH`	S1, S5
`OS-level`	S6
`OS-policy-dependent`	S2
`OS-specific`	S3
`OS-Specific`	S4
`OS-version-specific`	S2
`OsBuildNumber`	S1, S5
`OSes`	S1, S2
`osfmk/kern/cs_blobs.h`	S1, S5
`OSX`	S6
`OUI`	S1, S2, S3, S5, S6
`OUIs`	S1, S3, S4
`OutputDebugString`	S1, S2, S3, S5
`OutputDebugStringA`	S1, S5
`OVERVIEW`	S5
`OWASP`	S6
`p_flag & P_TRACED (0x800)`	S4
`p_idversion`	S1
`P_LNOATTACH`	S1, S5
`P_TRACED`	S1, S2, S4, S5
`PAC`	S3
`PAGE`	S6
`PAGE_GUARD`	S1, S5
`PANDA`	S1, S3
`PatchGuard`	S1, S6
`PCAP`	S1, S3
`PCI`	S1, S2, S3, S4
`PDF`	S3, S6
`PEB`	S1, S2, S3, S4, S5, S6
`PEB+0x02`	S4
`PEB+0x68`	S4
`PEB+0xBC`	S4
`PEB-based`	S5, S6
`PEB-state`	S4, S5
`PEB.BeingDebugged`	S1, S2, S5
`PEB.ProcessHeap`	S1
`perf_event_open`	S1, S3, S4
`perf_event_open(2)`	S1, S3
`personality(ADDR_NO_RANDOMIZE)`	S1, S2, S5
`PID`	S1, S2, S3, S5, S6
`PID-reuse`	S1, S2, S5
`PIN_SetDebugMode`	S1, S5
`PinCommitHashC`	S1, S5
`PinShield`	S1, S5
`pinvm.dll`	S1, S4
`PinWinMain`	S1, S5
`PKU`	S6
`PKU-Exploit`	S6
`PLT`	S1, S3
`PMC`	S6
`PMC11208535`	S1, S6
`PMU`	S1, S2, S3, S4
`pool-frida`	S1
`POSIX`	S3, S6
`PoW`	S1, S2, S4, S6
`POW`	S2
`POW-HOW`	S2
`PowerShell`	S1, S3
`PR_SET_DUMPABLE`	S1, S2, S5
`PR_SET_DUMPABLE = 0`	S2
`PR_SET_PTRACER`	S1, S2, S5
`PRACTICAL`	S6
`prctl(PR_SET_DUMPABLE, 0)`	S1, S5
`prctl(PR_SET_PTRACER, pid)`	S1, S5
`prctl(PR_SET_PTRACER, …)`	S5
`proc_pid_status`	S1
`proc_pid_status(5)`	S1
`ProcessBasicInformation`	S1, S3
`ProcessDebugFlags`	S1, S4, S5, S6
`ProcessDebugObjectHandle`	S1, S4, S5, S6
`ProcessDebugPort`	S1, S3, S4, S5, S6
`ProcessHacker`	S1, S5
`ProcessHandleTracing`	S1, S5
`ProcessHeap`	S1, S5
`ProcessInformationClass`	S6
`ProcessInstrumentationCallback`	S1, S5
`ProcessWow64Information`	S1, S3
`PT-based`	S5
`PT_DENY_ATTACH`	S1, S2, S3, S4, S5
`PT_TRACE_ME`	S1, S2, S3, S5
`PTRACE`	S6
`ptrace(2)`	S1, S2, S3
`ptrace(PT_DENY_ATTACH)`	S1, S2, S3, S4
`ptrace(PT_DENY_ATTACH=0x1F / 31)`	S1
`ptrace(PT_TRACE_ME)`	S1, S3
`ptrace(PTRACE_TRACEME)`	S1, S3, S4
`ptrace(PTRACE_TRACEME, 0, NULL, 0)`	S4
`ptrace(TRACEME)`	S1
`PTRACE_ATTACH`	S1, S3
`ptrace_scope`	S1, S2, S3, S5
`PTRACE_SEIZE`	S1, S3
`ptrace_stop`	S1, S4
`PTRACE_TRACEME`	S1, S3, S4, S5
`push 0; push -1; mov eax, TerminateProcess; call eax`	S1, S5
`QA1361`	S1, S5
`QBDI`	S1, S2, S5
`QEMU`	S1, S2, S3, S4, S5, S6
`QEMU Virtual CPU`	S1
`QEMU-TCG`	S1, S5
`QEMU-user`	S1, S3
`QG1`	S2, S3
`QG2`	S2, S3
`QG3`	S2, S3
`QG4`	S2, S3
`QG5`	S2, S3
`QG6`	S2, S3
`QG7`	S2, S3
`QPC`	S1, S2
`Qt5QWindowIcon`	S1, S5
`QueryPerformanceCounter`	S1, S3, S4, S5
`RAID`	S1, S3
`RAM`	S1, S2, S4, S5, S6
`RCE`	S6
`RDI`	S1, S5, S6
`RDP`	S1, S3
`RDPMC`	S1, S5
`RDRAND`	S1, S5
`RDTSC`	S1, S3, S4, S5, S6
`RDTSCP`	S1, S3, S5
`RDX`	S5
`readlink /proc/<tracer>/exe`	S1
`RET`	S1, S6
`RFC1918`	S1, S3
`ROM`	S1, S5
`RSDT`	S1, S2, S6
`RSI`	S1, S5, S6
`RtlCaptureContext`	S1, S5
`RtlpCreateUserThreadEx`	S1, S5
`RTM`	S1, S2, S3, S5, S6
`RTM-debug`	S1, S5
`RTM-like`	S3
`rtm_retired.aborted`	S1
`RUN`	S1, S5, S6
`RWX`	S1, S2, S3, S4, S5
`SafeDep`	S6
`SandPrint`	S1, S3
`ScrambleSuit`	S6
`SCSI`	S1, S2, S3, S5, S6
`ScyllaHide`	S1, S4, S5
`SDM`	S2
`SecTask`	S1, S5
`Security.framework`	S1
`SeDebugPrivilege`	S1, S5
`SEH`	S1, S3, S4, S5, S6
`SetLastError`	S1, S5
`SetLastError → OutputDebugStringA → GetLastError`	S1
`SetThreadContext`	S1, S5
`SetupAPI`	S1, S3
`SGDT`	S1, S2, S5
`ShimCache`	S1, S3
`SI-unit`	S3
`sice.sys`	S1
`SID`	S1, S3
`SIDT`	S1, S2, S5
`SIGBUS`	S1, S3
`SIGCONT`	S1, S4, S6
`SIGILL`	S1, S3, S6
`SIGSEGV`	S1, S3, S5, S6
`SIGSTOP`	S1, S6
`SIGSTOP-catching`	S1
`SIGTRAP`	S1, S3, S4, S5
`SIMD`	S1, S2, S3, S4, S6
`SIP`	S1, S2, S3, S4, S5, S6
`SIP-dependent`	S1, S3
`SIP-protected`	S1, S5
`siwvid.sys`	S1
`SLDT`	S1, S2, S5
`SMART`	S1, S3
`SMBIOS`	S1, S2, S3, S4, S5, S6
`SMC`	S1, S2, S5
`SMC-heavy`	S5
`SmoothCriminal`	S1, S5
`SMP`	S1, S5
`SoC`	S2
`SoftICE`	S1, S5
`SOFTWARE`	S1, S6
`SOFTWARE\VMware, Inc.\VMware Tools`	S1
`SonicWall`	S6
`SOs`	S1, S3, S4
`SSH`	S1, S3
`StartupInfo`	S1, S5
`STATE`	S5
`status & CS_DEBUGGED`	S1
`status & CS_DEBUGGED (0x10000000)`	S5
`STATUS_ACCESS_VIOLATION`	S1, S5
`STATUS_DATATYPE_MISALIGNMENT`	S1, S5
`STATUS_GUARD_PAGE_VIOLATION`	S1, S5
`STATUS_NO_YIELD_PERFORMED`	S1, S5
`STR`	S1, S2, S5
`strongR-frida`	S1
`svc #0x80`	S1, S4
`SVGA`	S1, S3, S5
`SwitchToThread`	S1, S5
`sysctl -n hw.model`	S1
`sysctl P_TRACED`	S1, S4
`sysctl(3)`	S2
`sysctl({CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()})`	S5
`sysctl.proc_translated`	S1, S3, S4
`syser.sys`	S1
`SYSTEM`	S6
`SYSTEM_KERNEL_DEBUGGER_INFORMATION`	S5
`SYSTEM_POWER_CAPABILITIES`	S1
`SYSTEM_POWER_CAPABILITIES.ThermalControl == FALSE`	S1
`SystemBiosVersion`	S1, S6
`SystemFirmwareTableInformation`	S1, S5
`SystemHandleInformation`	S1
`SystemKernelDebuggerInformation`	S1, S5
`SystemModuleInformation`	S1
`SystemProcessInformation`	S1, S5
`SystemTimeToFileTime`	S1, S5
`T1497`	S1, S3, S4, S5, S6
`T1497.001`	S1, S3, S6
`T1497.002`	S1, S3, S4
`T1497.003`	S1, S3
`T1622`	S1, S3, S6
`task->ptrace`	S1, S4, S5
`task_for_pid`	S1, S2, S3
`task_for_pid()`	S1
`task_for_pid-allow`	S1
`task_get_exception_ports`	S2, S4
`task_get_exception_ports(mach_task_self(), mask, …)`	S1, S5
`task_set_exception_ports`	S1, S5
`TAXONOMY`	S5
`TB-cache`	S1, S5
`TBs`	S1, S5, S6
`TCC`	S1, S2, S3
`TCG`	S1, S2, S4, S5, S6
`TCGTCGTCGTCG`	S1, S4, S5, S6
`TCP`	S1, S5
`Tear_Artifacts`	S3
`TEB`	S1, S3
`TerminateProcess`	S1, S5
`TF-based`	S5
`THE`	S5
`TheRegistry`	S3
`ThermalControl`	S1, S6
`ThiefQuest`	S1, S6
`THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER`	S1, S5
`ThreadHideFromDebugger`	S1, S2, S3, S4, S6
`ThreadHideFromDebugger (0x11)`	S4
`timeGetTime`	S1
`TIP`	S1, S5
`TitanEngine`	S1, S5
`TitanHide`	S1, S4, S5
`TLB`	S1, S3, S4, S5
`TLB-splitting`	S1, S4, S5
`TLFS`	S1, S3, S5
`TLS`	S1, S3, S4, S5, S6
`TLS-interception`	S1
`TNT`	S1, S5
`TPM`	S1, S3
`TRACEME`	S1, S5
`TracerPid`	S1, S2, S3, S4, S5, S6
`Transactional_Synchronization_Extensions`	S6
`TRUE`	S1, S5, S6
`TSC`	S1, S2, S3
`TSX`	S1, S2, S3, S4, S5, S6
`TSX-based`	S1, S5
`tx_mem.abort_conflict`	S1
`UI-triggered`	S3
`UnhandledExceptionFilter`	S1, S2, S5
`UnSafengine64`	S1, S5
`URL`	S4, S6
`USB`	S1, S3, S4, S6
`USENIX`	S1, S3
`UserAssist`	S1, S3
`UUID`	S1, S3
`V2E`	S6
`VB2021`	S6
`VB2021-Wardle`	S6
`VBox`	S1
`VBOX`	S1, S5, S6
`VBOX CD-ROM`	S1
`VBOX HARDDISK`	S1
`VBOX__`	S1
`VBoxGuest`	S1, S5
`VBoxMouse`	S1, S5
`VBoxMRXNP`	S1, S5
`VBoxService`	S1, S5
`VBoxTray`	S1, S5
`VBoxVBoxVBox`	S1, S5
`VEH`	S1, S3, S4, S5, S6
`VGA`	S1, S3
`VirtualAlloc`	S5
`VirtualBox`	S1, S2, S3, S4, S5, S6
`Virtualization.framework`	S1
`VirtualPC`	S1, S5
`VirtualQuery`	S5
`VM-artifact`	S1
`VM-exit`	S1, S2, S3
`VM-in-sandbox`	S1
`VM-tool`	S1
`VM-vendor`	S1
`VMBus`	S1, S5
`VMDetect`	S6
`VMDetection`	S5
`VMDetection-Private`	S1, S5
`VMEXIT`	S5
`VMI`	S1, S2, S3
`VMMS`	S1, S5
`VMProtect`	S1, S4, S5
`VMs`	S1, S2, S3, S4, S5, S6
`VMware`	S1, S2, S3, S5, S6
`VMWARE`	S1, S6
`VMware SCSI`	S1
`VMware SVGA`	S1
`VMware Virtual Platform`	S1
`VMware-style`	S2
`VMwareVMware`	S1, S4, S5
`VMX`	S1, S2, S5
`VMX-root`	S1, S5
`VMXh`	S1, S5
`VNC`	S1, S3
`VPN`	S1, S3
`VT-x`	S1, S2, S4, S5
`VTIL`	S1, S5
`WeLiveSecurity`	S6
`Win32_ComputerSystem`	S1, S3
`WinDbg`	S1, S2, S5
`windbg -hd`	S1, S5
`windbg.exe`	S1
`WinDbgFrameClass`	S1, S5
`WINDOWS`	S5
`WinHTTP`	S3
`WinMain`	S6
`winuser.h`	S2
`WITH`	S6
`WMI`	S1, S3, S4
`WordPress`	S6
`WOW64`	S1, S3, S5
`WSL`	S1, S3
`WSL-targeted`	S3
`X11`	S1, S3
`x64dbg.exe`	S1
`X86`	S1, S5
`XBEGIN`	S1, S4, S5
`XEND`	S1, S4, S5
`XenVMMXenVMM`	S1, S5
`XNU`	S1, S2, S5, S6
`XOR`	S1, S5
`{CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()}`	S1
`{DebuggerEnabled, DebuggerNotPresent}`	S1

19h/report.md

Document Control

Source Corpus

Integration Contract

0. Assumption Register

1. Normative Vocabulary and Object Model

1.1 Normative terms

1.2 Detection-mode taxonomy

2. Core Anti-Analysis Architecture

2.1 MITRE mapping

3. Windows Specification

3.1 PEB, heap, and process-state checks

3.2 Native API and object-manager checks

3.3 Exception, breakpoint, and control-flow probes

3.4 Anti-attach, self-debugging, and analyst-tool enumeration

3.5 Windows anti-VM / sandbox surface

4. Linux Specification

4.1 Debugging and attach-control primitives

4.2 Procfs, loader, and environment inspection

4.3 Signal, seccomp, self-tracing, and SMC

4.4 Linux anti-VM / sandbox surface

5. macOS / Darwin / iOS-Family Specification

5.1 Core macOS anti-debug matrix

5.2 dyld, library validation, and entitlement drift

5.3 macOS anti-VM and Apple Silicon surface

6. Anti-Instrumentation, Hook, DBI, and Frida Specification

6.1 Generic hook and instrumentation checks

6.2 DBI taxonomy and artifacts

6.3 Frida-specific artifact families

7. Anti-Emulation, Anti-VM, Firmware, and Hardware Specification

7.1 Hypervisor fingerprint hierarchy

7.2 CPU, ISA, and microarchitectural probes

7.3 Emulator correctness and semantic gaps

7.4 Firmware, DMI/SMBIOS, ACPI, IORegistry, and identity

8. Sandbox, Wear-and-Tear, User Activity, Network, Cloud, and Container Specification

8.1 Wear-and-tear and spotless-sandbox indicators

8.2 User-activity and reverse-Turing checks

8.3 Time-based sandbox evasion

8.4 Network, C2, and internet-environment checks

8.5 Container, WSL, cloud, and namespace checks

9. Modern and State-of-the-Art Specification

10. Defensive Analysis-Lab Requirements

10.1 Four-run differential baseline

10.2 Environment consistency ledger

10.3 Tooling contamination rule

10.4 Consistency over string hiding

10.5 macOS entitlement parity

10.6 Cross-view telemetry

11. Detection Engineering Patterns

12. Version-Sensitivity and Downgraded Claims

13. Bounded Scope Expansion

14. Provenance Register

15. Quality Gates

16. Source Metadata and Integrity

17. Source Heading Concordance

S1 — anti-debug-emulation-synthesis.md

Anti-Debugging, Anti-Instrumentation & Anti-Emulation: Unified Cross-Platform Technical Reference (Windows / Linux / macOS)

TL;DR

0. Scope, assumptions, and falsification probes

1. Core model: signal collection + behavior gating

2. Anti-debugging

2.A Windows

2.A.1 PEB / process-state checks (spawn-time vs attach is decisive)

2.A.2 API / kernel-object queries (the strong tier — query the kernel, not the PEB)

2.A.3 Exception-based checks

2.A.4 Hardware breakpoints / debug registers

2.A.5 Timing

2.A.6 Self-debugging / anti-attach

2.A.7 Tool / window / object / module enumeration

2.A.8 Code-integrity / breakpoint scanning

2.A.9 TLS callbacks, page-guard, write-watch, SMC

2.B Linux

2.C macOS / iOS

3. Anti-instrumentation / hook & DBI detection (cross-platform)

4. Anti-emulation / anti-VM / anti-sandbox

4.1 CPU / hypervisor / ISA-level

4.2 Emulator-correctness / semantic-gap discrepancies

4.3 Firmware / DMI / SMBIOS / ACPI / platform identity

4.4 Device / bus / peripheral inventory

4.5 Virtualization software artifacts (drivers/services/devices)

S1 — `anti-debug-emulation-synthesis.md`

S2 — `mit3.md`

A2. Global `DebugObject` and object-type enumeration

A3. `ThreadHideFromDebugger` as active debugger blinding

B1. `prctl` and ptrace-policy manipulation

B2. Procfs beyond `TracerPid`

C1. `PT_DENY_ATTACH` with direct or early invocation

C2. `sysctl` `P_TRACED` and process-state retrieval

C3. `csops`, `csops_audittoken`, and `CS_DEBUGGED`

C5. `task_for_pid`, Hardened Runtime, AMFI/taskgated, and entitlements

S3 — `mit2.md`