Windows includes lots of ways to detect the presence of a debugger. There are multiple APIs that help detect whether the current process is being debugged or not, as follows:
- IsDebuggerPresent
- CheckRemoteDebuggerPresent
- NtQueryInformationProcess (with the ProcessDebugPort (7) argument)
These APIs access a flag in the process environment block (PEB) called BeingDebugged that is set to True when the process is running under a debugger. To access this flag, malware can execute the following instructions:
mov eax, dword ptr fs:[30h] ; PEB
cmp byte ptr [eax+2], 1 ; PEB.BeingDebugged
jz <debugger_detected>
These are mostly direct ways to check for the presence of a debugger. However, there are also other ways to detect them, such as by observing the differences in the process loading, thread loading, or the initialization phase between a process running with a debugger and another process running without a debugger. One of these techniques...
