A .NET library that prevents managed debuggers and profilers from working by exploiting undocumented CLR features.
Antinet is a .NET library that prevents managed debuggers and profilers from working by exploiting undocumented features of Microsoft's CLR. It kills the .NET debugger thread and blocks profiler attachments to protect applications from runtime analysis and debugging.
.NET developers and security engineers who need to protect their applications from reverse engineering, debugging, or profiling by unauthorized parties.
It offers a low-level, CLR-based approach that is more effective than traditional environment variable checks, providing robust protection against managed debugging and profiling tools without affecting non-managed debuggers.
.NET anti-managed debugger and anti-profiler code
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Directly manipulates low-level, undocumented CLR features like debugger threads and profiler status flags, providing more robust protection than high-level environment checks, as detailed in the technical sections.
Tested across CLR 2.0 and 4.0, covering .NET Framework 2.0 to 4.5 on x86 and x64 architectures, ensuring compatibility with a wide range of legacy applications.
Does not interfere with non-managed debuggers like WinDbg or OllyDbg, allowing low-level debugging without disrupting the anti-debugging measures, as specified in the README.
Can block profilers from attaching at runtime by taking ownership of named pipes and patching CLR internals, even when environment variables like COMPlus_AttachThreadAlwaysOn are set.
Relies heavily on undocumented CLR internals that could break or cause unexpected behaviors in future CLR versions, a risk openly admitted in the README's warnings.
Involves low-level memory scanning, patching of CLR structures, and handling edge cases like AttachThreadAlwaysOn, increasing the risk of application crashes or instability if implemented incorrectly.
Only prevents managed debuggers and profilers; non-managed debuggers like WinDbg can still attach, though with limited managed code debugging capabilities, as noted in the anti-managed debugger section.