[C++] Anti Reverse Methods

 

#1. IsDebuggerPresent

 

BOOL WINAPI IsDebuggerPresent(void);

 

Return value

If the current process is running in the context of a debugger, the return value is nonzero.

If the current process is not running in the context of a debugger, the return value is zero.

 

#2. CheckRemoteDebuggerPresent

 

BOOL WINAPI CheckRemoteDebuggerPresent(
  _In_     HANDLE hProcess,
  _Inout_  PBOOL pbDebuggerPresent
);

Parameters

hProcess [in]

A handle to the process.

pbDebuggerPresent [in, out]

A pointer to a variable that the function sets to TRUE if the specified process is being debugged, or FALSE otherwise.

Return value

If the function succeeds, the return

value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

 

#3 DebugActiveProcess

BOOL WINAPI DebugActiveProcess(
  _In_  DWORD dwProcessId
);

Parameters

dwProcessId [in]

The identifier for the process to be debugged. The debugger is granted debugging access to the process as if it created the process with the DEBUG_ONLY_THIS_PROCESS flag. For more information, see the Remarks section of this topic.

Return value

If the function succeeds, the return value is nonzero.

If the function fails, the return value is 0 (zero). To get extended error information, call GetLastError.