Detecting debugger presence

The first thing that must be done is to determine whether or not the application is being run with a debugger attached to it. There are a lot of different approaches to debugging detection, and we are going to go over some of them. A malware analyst may, of course, reduce the risk posed by any methodology; nevertheless, some methods are more difficult to implement than others.

It is possible to ask the operating system whether or not a debugger is attached. The IsDebuggerPresent function is responsible for checking whether or not the BeingDebugged flag is set in the process environment block (PEB):

BOOL IsDebuggerPresent();

You can find relevant documentation here: https://learn.microsoft.com/en-us/windows/win32/api/debugapi/nf-debugapi-isdebuggerpresent.

Practical example 1

The full source code of the proof of concept (PoC) looks like this:

/*
 * Malware Development for Ethical Hackers
 * hack.c - Anti-debugging tricks
 * detect debugger...