Skip to content

Instantly share code, notes, and snippets.

@igorsegallafa
Last active September 28, 2020 02:41
Show Gist options
  • Save igorsegallafa/761a6c06577d1991721a26db58c6ca79 to your computer and use it in GitHub Desktop.
Save igorsegallafa/761a6c06577d1991721a26db58c6ca79 to your computer and use it in GitHub Desktop.
/**
* An Anti-Reverse Engineering Guide, Joshua Tully
* https://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide
* You can find all methods of anti-debugging here: https://gist.github.com/igorsegallafa/3dd15c67e7091e9734a417fe1079129b
*/
bool FindDebugger1::HasDebugger()
{
__try { __asm INT 0x2D }
__except (EXCEPTION_EXECUTE_HANDLER){ return false; }
return true;
}
bool FindDebugger2::HasDebugger()
{
__try { __asm INT 0x03 }
__except (EXCEPTION_EXECUTE_HANDLER){ return false; }
return true;
}
bool FindDebugger3::HasDebugger()
{
CONTEXT ctx = {0};
ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
auto hThread = GetCurrentThread();
if( GetThreadContext( hThread, &ctx ) == 0 )
{
return false;
}
//Debugger Found
if( ctx.Dr0 != 0 || ctx.Dr1 != 0 || ctx.Dr2 != 0 || ctx.Dr3 != 0 )
return true;
return false;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment