Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

UNCLASSIFIED
Pique Proof-of-Concept (PoC) Report
Anti-Debugging and Anti-Emulation
(U) An example of an assembly language routine to manually
check the ForceFlags flag is:
Figure 3. ProcessHeap in the PEB at offset 0x18
Raytheon Blackbird Technologies, Inc.
8
07 August 2015
Use or disclosure of data contained on this sheet is subject to the restrictions on the title page of this document.
UNCLASSIFIED
mov eax, large fs:30h ; load PEB structure into EAX
mov eax, dword ptr [eax+18h] ; Go to ProcessHeap offset in PEB
cmp dword ptr ds:[eax+74h], 0 ; Check to see if ForceFlags is 0 (offset varies per Table 1)
j
ne
D
e
bugge
rD
e
t
e
c
t
e
;
D
e
bugge
rD
e
t
e
c
t
e
d
rout
i
ne
de
fi
ne
d e
l
s
e
w
he
re

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh