Mastering Reverse Engineering

Debugger information from NtQueryInformationProcess

Querying process information using the NtQueryInformationProcess function gives us another way to identify if the process is under a debugger. As sourced from MSDN, the NtQueryInformationProcess syntax declaration is the following:

NTSTATUS WINAPI NtQueryInformationProcess(
  _In_       HANDLE ProcessHandle,
  _In_       PROCESSINFOCLASS ProcessInformationClass,
  _Out_      PVOID ProcessInformation,
  _In_       ULONG ProcessInformationLength,
  _Out_opt_  PULONG ReturnLength
);

More information about this function can be found at https://docs.microsoft.com/en-us/windows/desktop/api/winternl/nf-winternl-ntqueryinformationprocess.

Specific information is returned based on what ID is supplied in the second argument, PROCESSINFOCLASS ...