Library · Integrity
Integrity, anti-debug, anti-hook: layers of defence and their real limits
Integrity and anti-debug checks make analysis costlier, but they run on the attacker's machine and can always be switched off. Use them as signals sent to the server, not as the last wall.
What can be checked
- A hash of the running file compared with your published builds.
- Signs of a debugger attached to the process.
- Hooks on network or crypto functions.
- Running inside a virtual machine or emulator.
Real limits
Every client-side check can be patched. Do not make them crash the app: a crash shows exactly where to patch, and honest users running legitimate tools get caught too.
Turn checks into signals
Send the results to the server. The server adds them to a risk score, weighs them against other behaviour (one key on many machines, bad signatures) and only then decides. One signal alone should not lock anyone out.
Block unknown builds where it is trusted
The server knows the hash of every build you published and signed. An unknown build is a strong signal; blocking a leaked build is your call.
With ClavisAUH
Unknown hashes always raise an Unknown build event on Protect 24/7. In Advanced Protection, turn on Build Integrity Verification to choose warn or block.