LocalSize(0)

The function LocalSize() retrieves the current size of the specified local memory object, in bytes. By setting the hMem parameters with 0 will trigger an exception in a debugger that can be used as an anti-debugging mechanism.

U0128

Code Snippets

#include <iostream>
#include <windows.h>

using namespace std;

int main()
{
	SIZE_T s;
	printf("Starting the LocalSize()\n");
	for (int i = 0; i < 0xFFF; i++){
	    s = LocalSize(0);
	}
	printf("Sempai! :) \n");
	return 0;
}

Detection Rules

rule:
  meta:
    name: trap debugger with localsize
    namespace: anti-analysis/anti-debugging
    author: lordtmk@protonmail.com
    scope: basic block
    examples:
      - B67E5B1985742F62785122B637EF4FBD:0x4B1F5B
  features:
    - and:
      - api: LocalSize
      - mnemonic: push 
      - number: 0

Additional Resources

Subscribe to our Newsletter and don't miss important updates