checks the process environment block (peb) for a "beingdebugged" field (gets set if process is launched in a debugger) possible bypass: once the peb b

checks if certain windows are present (not the name that can be easily changed but the window_class_name) possible bypass: set a breakpoint before thi

will throw an exception when trying to close an invalid handle (only when debugged) so if we pass an invalid handle and get the exception, we know tha

checks whether a debugger is present by attempting to output a string to the debugger (helper functions for debugging applications) if no debugger is

returns strings for the check_window_name() function this combined with the xoring of strings is to prevent static analysis / make it harder

same as above

2d is a kernel interrupt (opcode 0x2D), when it gets executed, windows will use the extended instruction pointer register value as the exception addre

i3 is a standard software breakcode (opcode 0xCC), when you set a breakpoint the debugger replaces the opcode under the breakpoint location with 0xCC

another check for the peb flag, this time by the function from winapi.h possible bypass: set a breakpoint before this gets called, single step, set th

single stepping check

looks for process environment block references they usually start with FS:[0x30h]. fs = frame segment, indicates reference to the programs internal he

two checks here, 1. xxx, 2. NoDebugInherit

hides the thread from any debugger, any attempt to control the process after this call ends the debugging session

checks how much time passes between the two query performance counters if more than X (here 30ms) pass, a debugger is slowing execution down (manual b

checks if a debugger is running (in another system/process) possible bypass: set a breakpoint before this gets called, single step, set the return val

we force an exception to occur, if it occurs outside of a debugger the __except() handler is called, if it's inside a debugger it will not be called

thanks to LordNoteworthy/al-khaser for the idea