X Tutup
Skip to content

Latest commit

 

History

History

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 

README.md

Background

Like FindWindow, this is more of a hack than an officially supported detection method. Debuggers typically support communication with processes being debbugged; such processes can send messages to the debugger with with Win32 method OutputDebugString.

If there isn't an attached debugger, then the thread's error code is set, which can be retrieved with the Win32 GetLastError. If there isn't an error code, it most likely means that the communication with the debugger was a success, leading to the conclusion that a debugger is attached.

Note that some Win32 API calls will set the last error to 0 on success and that the thread's error value may be set from something other than OutputDebugString.

Relevant Links

https://docs.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot

X Tutup