CODEWITHSUNDEEP
c++windowsdebuggingwinapianti-debugging
4zu
4zu

Reputation: 11

Is there any way to identify the process that is debugging my process?

If you look up Anti-Debug on the Internet, you will find a lot of information. For example, isDebuggerPresent and NtGlobalFlags were found in the search. However, my process can only protect itself from the debugger by terminating its own process when it detects it. I would like to know how to prevent the debugger from attaching in the first place, or how to identify and detach the debugger process.

Upvotes: 0

Views: 540

Answers (1)

Employed Russian
Employed Russian

Reputation: 213754

I would like to know how to prevent the debugger from attaching in the first place, or how to identify and detach the debugger process.

  1. There isn't a way to do that.
  2. Even if there was, the debugger could have done a lot of things to your process between attaching and detaching -- change global data, change function pointers, create new threads, inject DLLs, etc.

    So even if you could detach the debugger, you shouldn't trust your process' integrity after doing that.

Upvotes: 1

Related Questions