CheckRemoteDebuggerPresent
CheckRemoteDebuggerPresent is a kernel32.dll function that sets (-1)0xffffffff in the DebuggerPresent parameter if a debugger is present. Internally, it also uses NtQueryInformationProcess with ProcessDebugPort as a ProcessInformationClass parameter.
Code Snippets
#include "windows.h"
int main(void)
{
BOOL HasDebugPort = FALSE;
if (CheckRemoteDebuggerPresent(GetCurrentProcess(), &HasDebugPort))
{
ExitProcess(0); // Running in ring-3 debugger
}
// Running outside ring-3 debugger
return 0;Detection Rules
rule:
meta:
name: check for debugger via API
namespace: anti-analysis/anti-debugging/debugger-detection
author: michael.hunhoff@fireeye.com
scope: function
mbc:
- Anti-Behavioral Analysis::Debugger Detection::CheckRemoteDebuggerPresent [B0001.002]
- Anti-Behavioral Analysis::Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031]
references:
- https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/CheckRemoteDebuggerPresent.cpp
examples:
- al-khaser_x86.exe_:0x420000
features:
- or:
- api: kernel32.CheckRemoteDebuggerPresent
- api: WUDFPlatform.WudfIsAnyDebuggerPresent
- api: WUDFPlatform.WudfIsKernelDebuggerPresent
- api: WUDFPlatform.WudfIsUserDebuggerPresent