Anti-Debug

Protection ID: anti_debug

Anti-Debug detects and blocks debugger attachment to your application at runtime. This prevents attackers from stepping through your code, inspecting memory, and modifying execution flow using tools like LLDB.

Configuration

{
  "protections": {
    "anti_debug": true
  }
}

{
  "protections": {
    "anti_debug": true
  }
}

For fine-grained control:

{
  "protections": {
    "anti_debug": {
      "enabled": true,
      "ptrace": true,
      "sysctl": true
    }
  }
}

{
  "protections": {
    "anti_debug": {
      "enabled": true,
      "ptrace": true,
      "sysctl": true
    }
  }
}

How It Works

Debuggers are one of the most powerful tools for reverse engineering iOS applications. By attaching a debugger, an analyst can step through code instruction by instruction, read and modify memory at runtime, set breakpoints on specific functions, and inspect decrypted data that is only available at runtime.

Anti-Debug detects when a debugger is attached to the process and takes defensive action. The detection runs continuously during application execution, not just at startup, so it catches both pre-attached and late-attached debuggers.

What Gets Detected

When to Use

Anti-Debug is recommended for all production applications, especially those handling sensitive operations like payment processing, authentication, DRM/license validation, or any code that processes decrypted data at runtime.

Related

• Anti-Jailbreak - Detect jailbroken devices
• Hook Detection - Detect runtime hooking
• Protections Overview - All available protections