Abstract
There has already been extensive research into the plethora of
tricks used by contemporary malware and executable protectors with the
purpose of breaking debuggers and emulators. Unfortunately malware
authors are aware of such research efforts and the countermeasures
introduced by engine developers. They are also pretty much aware of the
capabilities of AV emulators, and are ready and prepared to deploy
tricks to overcome them. Gabor Szappanos looks at a small cross-section
of the threat landscape.
