| 8 | } |
| 9 | |
| 10 | DetectionFlags DebuggerDetections::_IsKernelDebuggerPresent() |
| 11 | { |
| 12 | typedef long NTSTATUS; |
| 13 | HANDLE hProcess = GetCurrentProcess(); |
| 14 | |
| 15 | typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION { bool DebuggerEnabled; bool DebuggerNotPresent; } SYSTEM_KERNEL_DEBUGGER_INFORMATION, * PSYSTEM_KERNEL_DEBUGGER_INFORMATION; |
| 16 | |
| 17 | enum SYSTEM_INFORMATION_CLASS { SystemKernelDebuggerInformation = 35 }; |
| 18 | typedef NTSTATUS(__stdcall* NT_QUERY_SYSTEM_INFORMATION)(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength); |
| 19 | NT_QUERY_SYSTEM_INFORMATION NtQuerySystemInformation; |
| 20 | SYSTEM_KERNEL_DEBUGGER_INFORMATION Info; |
| 21 | |
| 22 | HMODULE hModule = GetModuleHandleA("ntdll.dll"); |
| 23 | |
| 24 | if (hModule == NULL) |
| 25 | { |
| 26 | Logger::logf(Err, "Error fetching module ntdll.dll @ _IsKernelDebuggerPresent: %d", GetLastError()); |
| 27 | return EXECUTION_ERROR; |
| 28 | } |
| 29 | |
| 30 | NtQuerySystemInformation = (NT_QUERY_SYSTEM_INFORMATION)GetProcAddress(hModule, "NtQuerySystemInformation"); |
| 31 | if (NtQuerySystemInformation == NULL) |
| 32 | return EXECUTION_ERROR; |
| 33 | |
| 34 | if (NtQuerySystemInformation(SystemKernelDebuggerInformation, &Info, sizeof(Info), NULL)) |
| 35 | { |
| 36 | if (Info.DebuggerEnabled || !Info.DebuggerNotPresent) |
| 37 | { |
| 38 | return DEBUG_KERNEL_DEBUGGER; |
| 39 | } |
| 40 | } |
| 41 | else |
| 42 | return EXECUTION_ERROR; |
| 43 | |
| 44 | return NONE; |
| 45 | } |
| 46 | |
| 47 | DetectionFlags DebuggerDetections::_IsKernelDebuggerPresent_SharedKData() |
| 48 | { |
nothing calls this directly
no outgoing calls
no test coverage detected