Is there any way to identify the process that is debugging my process?

485 Views Asked by At

If you look up Anti-Debug on the Internet, you will find a lot of information. For example, isDebuggerPresent and NtGlobalFlags were found in the search. However, my process can only protect itself from the debugger by terminating its own process when it detects it. I would like to know how to prevent the debugger from attaching in the first place, or how to identify and detach the debugger process.

1

There are 1 best solutions below

4
Employed Russian On

I would like to know how to prevent the debugger from attaching in the first place, or how to identify and detach the debugger process.

  1. There isn't a way to do that.
  2. Even if there was, the debugger could have done a lot of things to your process between attaching and detaching -- change global data, change function pointers, create new threads, inject DLLs, etc.

    So even if you could detach the debugger, you shouldn't trust your process' integrity after doing that.