IsDebuggerPresent
Created the Monday 18 March 2019. Updated 3 years, 6 months ago.
This function checks specific flag in the Process Environment Block (PEB) for the field IsDebugged which will return zero if the process is not running into a debugger or a nonzero if a debugger is attached.
If you want to understand the underlying process of IsDebuggerPresent API you can check the code snippet section for the following method: IsDebugged Flag.
Technique Identifier
Technique Tag
Code Snippets
#include <windows.h>
#include <stdio.h>
int main(int argc, char** argv)
{
if (IsDebuggerPresent())
{
printf("Debugger detected!!\n");
}
else
{
printf("No debugger detected!!\n");
}
system("pause");
return 0;
}program IsDebuggerPresent;
{$APPTYPE CONSOLE}
uses
WinAPI.Windows, System.SysUtils;
begin
try
if IsDebuggerPresent() then
WriteLn('Process is currently getting debugged.')
else
WriteLn('Process is not likely getting debugged.');
readln;
except
on E: Exception do
Writeln(E.ClassName, ': ', E.Message);
end;
end.Detection Rules
rule Detect_IsDebuggerPresent : AntiDebug {
meta:
author = "naxonez"
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
strings:
$ ="IsDebugged"
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}