C#
C++ (7)
Delphi (604)
.NET (2)
Database (72)
Delphi IDE (90)
Network (39)
Printing (3)
Strings (12)
VCL (83)
Windows with Delphi (243)
Java (8)
JavaScript (56)
perl (40)
php (12)
VBScript (1)
Visual Basic (1)
Exchange Links
About this site
How to detect if an application is being debugged
This article has not been rated yet. After reading, feel free to leave comments and rate it.
Have you ever wondered if the user is trying to debug your application? Don�t count on getting feedback from that user, but a registration code, crack, and/or key generator are more likely. Let�s face it: if the user debugging your application is not part of development or testing team chances are he or she is trying to crack it. Of course, your users may feel committed to helping create bug-free programs but don�t count on it =)
There is no need for sophisticated assembly code or any self-written routines. All you need is pretty much provided by Windows API. IsDebuggerPresent() is supported by Windows 98, ME, and of course all new versions of Windows based on the NT kernel (2000, XP). Just call IsDebuggerPresent() and you can use the result of this function to change the behavior of your application if a debugger is present. Also keep in mind that procedure names are stored in the executable, so you might want to change to name of IsDebuggerPresent() to something less obvious like UpdateEditor() or CalculateArray().
 |  | |
function DebuggerPresent : boolean;
type
TDebugProc = function : boolean;
stdcall;
var
Kernel32: HMODULE;
DebugProc: TDebugProc;
begin { DebuggerPresent }
Result := False;
Kernel32 := GetModuleHandle('kernel32');
if Kernel32<>0 then
begin
@DebugProc := GetProcAddress(Kernel32, 'IsDebuggerPresent');
if Assigned(DebugProc) then
Result := DebugProc
end; { Kernel32<>0 }
end; { DebuggerPresent }
| ||
 |  |
Comments:
| ||
|
IsDebuggerPresent can be by passed using close to 40 techniques. For instance the debugged application can be moved to Win95 which has no IsDebuggerPresent API, then start a debugging process.
You can visist some of the site that has info on IsDebuggerPresent: (1)  http://www.hexblog...ebug.html
(2) http://www.hexblog.../2005/11/
Engr. Wale, Mushin, Lagos, Nija. |
