Method _ExitCommonDebuggers

AntiDebug/DebuggerDetections.cpp:259–305

_ExitCommonDebuggers - create remote thread on `ExitProcess` in any common debugger processes This can of course be bypassed with a simple process name change, preferrably we would use a combination of artifacts to find these processes */

	This can of course be bypassed with a simple process name change, preferrably we would use a combination of artifacts to find these processes
*/
DetectionFlags DebuggerDetections::_ExitCommonDebuggers()
{
	bool triedEndDebugger = false;

	for (const std::wstring& debugger : this->CommonDebuggerProcesses)
	{
		std::list<DWORD> pids = Process::GetProcessIdsByName(debugger);

		for (const auto pid : pids)
		{
			uintptr_t K32Base = (uintptr_t)GetModuleHandleW(L"kernel32.dll");

			if (K32Base == NULL)
			{
				Logger::logf(Warning, "Failed to fetch kernel32.dll address @ _ExitCommonDebuggers ");
				return EXECUTION_ERROR;
			}

			uintptr_t ExitProcessAddr = (uintptr_t)GetProcAddress((HMODULE)K32Base, "ExitProcess");

			if (ExitProcessAddr == NULL)
			{
				Logger::logf(Warning, "Failed to fetch ExitProcess address @ _ExitCommonDebuggers ");
				return EXECUTION_ERROR;
			}

			uintptr_t ExitProcessOffset = ExitProcessAddr - K32Base;

			HANDLE remoteProcHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

			if (remoteProcHandle)
			{
				uintptr_t FunctionAddr_ExitProcess = (uintptr_t)Process::GetRemoteModuleBaseAddress(pid, L"kernel32.dll") + ExitProcessOffset;
				HANDLE RemoteThread = CreateRemoteThread(remoteProcHandle, 0, 0, (LPTHREAD_START_ROUTINE)FunctionAddr_ExitProcess, 0, 0, 0);
				triedEndDebugger = true;
				CloseHandle(remoteProcHandle);
				Logger::logf(Info, "Created remote thread at %llX address", FunctionAddr_ExitProcess);
			}
			else
			{
				Logger::logf(Warning, "Failed to open process handle for pid %d @ _ExitCommonDebuggers", pid);
			}
		}
	}

	return (triedEndDebugger ? DEBUG_KNOWN_DEBUGGER_PROCESS : NONE);
}