Anti-Reverse Engineering

Walkthrough summary

Anti-Reverse Engineering TryHackMe walkthrough with 13 answered prompts and lab methodology notes.

Sample prompts covered

• What is the name of the Windows API function used in a common anti-debugging technique that detects if a debugger is running?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the Windows API function that enumerates windows on the screen so the malware can check the window name?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the hex value of a nop instruction?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the instruction found at memory location 004011CB?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the name of the identifiable process used by malware to check if the machine is running inside VirtualBox?
  Open the walkthrough page to inspect the full answer and command flow.