Search code examples
windowsdebuggingkerneldriver

Detect whether a process is being debugged; in kernel land

Is there a way to detect (in kernel-mode) that a debugger (in user-mode) is attached to another process (also in user-mode) on Windows ?

I cannot find any API or flag in the EPROCESS structure that would reveal this information. Ideally, I'm looking for a flag that cannot be altered from a program in user-mode, nonetheless I'm unaware if this information is also kept at kernel level.

Thanks !

Solution

  • exist (from xp) undocumented api

    extern "C"
NTKERNELAPI
BOOLEAN
PsIsProcessBeingDebugged(PEPROCESS Process);

    which return Process->DebugPort != NULL very simply and reliable api, can be used at any irql (because Process object in not paged memory).

    • Library: NtosKrnl.lib
    • IRQL: Any level