Debugger detection timing examples

debugger-detection.cpp

BOOL IsDebuggerPresentUsingTickCount()
{
    DWORD tickReference = GetTickCount();
    Sleep(1500); // you can replace this with a function
    DWORD currentTick = GetTickCount();
    DWORD elapsedTime = currentTick - tickReference;
    if (elapsedTime > 2000)
        return TRUE;
    return FALSE;
}

BOOL IsDebuggerPresentUsingLocalTime() { 
    SYSTEMTIME sysStart, sysend; 
    FILETIME fStart, fEnd; 
    ULARGE_INTEGER uiStart, uiEnd; 

    GetLocalTime(&sysStart); 
    Sleep(1500); // you can replace this with a function 
    GetLocalTime(& sysend); 
    
    if (!SystemTimeToFileTime(&sysend„ &fEnd)) 
        return false; 
    if (!SystemTimeToFileTime(&sysStart, &fStart)) 
        return false; 
    
    uiStart.LowPart = fStart.dwLowDateTime; 
    uiStart.HighPart = fStart.dwHighDateTime; 
    uiEnd.LowPart = fEnd.dwLowDateTime; 
    uiEnd.HighPart = fEnd.dwHighDateTime; 
    return (((uiEnd.QuadPart - uiStart.QuadPart)*100)/1000000) > 2000; //convert filetime to milliseconds 
}

BOOL IsDebuggerPresentUsingOPC()
{
    LARGE_INTEGER start, end, frequency;
    QueryPerformanceCounter(&start);
    QueryPerformanceFrequency(&frequency);
    Sleep(1400);
    QueryPerformanceCounter(&end);
    return (end.QuadPart - start.QuadPart) * 1000 / frequency.QuadPart > 15;
}