IsDebuggerPresent

IsDebuggerPresent is a Kernel32 API function that simply tells us whether the program is under a debugger. The result is placed in the eax register with a value of either true (1) or false (0). When used, the code looks something like this:

call IsDebuggerPresent
test eax, eax
jz notdebugged

The same concept applies with the CheckRemoteDebuggerPresent API. The difference is that it checks whether either another process or its own process is being debugged. CheckRemoteDebuggerPresent requires two arguments: a handle to a process and an output variable that tells us whether the process is being debugged or not. The following code checks whether its own process is being debugged:

call GetCurrentProcess
push edi
push eax
call CheckRemoteDebuggerPresent
cmp dword ptr [edi], 1
jz beingdebugged

The GetCurrentProcess API is used to retrieve the handle to the running process. This usually returns a -1 (0xFFFFFFFF) value, which is the handle to its own process. The edi register should be a variable address where the output of CheckRemoteDebuggerPresent will be stored.  

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.223.119.17