Mastering Reverse Engineering

IsDebuggerPresent

IsDebuggerPresent is a Kernel32 API function that simply tells us whether the program is under a debugger. The result is placed in the eax register with a value of either true (1) or false (0). When used, the code looks something like this:

call IsDebuggerPresenttest eax, eaxjz notdebugged

The same concept applies with the CheckRemoteDebuggerPresent API. The difference is that it checks whether either another process or its own process is being debugged. CheckRemoteDebuggerPresent requires two arguments: a handle to a process and an output variable that tells us whether the process is being debugged or not. The following code checks whether its own process is being debugged:

call GetCurrentProcesspush edipush eaxcall CheckRemoteDebuggerPresent ...