| 443 | } |
| 444 | |
| 445 | bool CAntiDebug::SeDebugPrivTriggered() |
| 446 | { |
| 447 | auto dwCsrssPid = g_winapiApiTable->CsrGetProcessId(); |
| 448 | if (!dwCsrssPid) |
| 449 | return false; |
| 450 | |
| 451 | auto hProcess = g_winapiApiTable->OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwCsrssPid); |
| 452 | if (IS_VALID_HANDLE(hProcess)) |
| 453 | { |
| 454 | DEBUG_LOG(LL_ERR, "Debugger detected via: SeDebugPrivTriggered"); |
| 455 | return true; |
| 456 | } |
| 457 | |
| 458 | return false; |
| 459 | } |
| 460 | |
| 461 | |
| 462 | bool CheckDebugObjectSize() |
nothing calls this directly
no test coverage detected