Identifying flags and artifacts
By default, the 0
value is stored in the NtGlobalFlag
field of the Process Environment Block (located at offset 0x68
on 32-bit Windows and 0xBC
on 64-bit Windows):

Figure 5.11 – NtGlobalFlag
The value of the NtGlobalFlag
variable is unaffected by the attachment of a debugger. On the other hand, if a debugger was responsible for creating the process, the following flags will be set:
FLG_HEAP_ENABLE_TAIL_CHECK (0x10)
FLG_HEAP_ENABLE_FREE_CHECK (0x20)
FLG_HEAP_VALIDATE_PARAMETERS (0x40)
To check whether a process has been started with a debugger, check the value of the NtGlobalFlag
field in the PEB structure.
Practical example
Let’s observe the practical implementation and demonstration via a straightforward PoC code for anti-debugging:
/* * Malware Development for Ethical Hackers * hack.c - Anti-debugging tricks * detect debugger via NtGlobalFlag * author: @cocomelonc */ #include...