8.5 DebuggerPresent

#include <stdio.h>
#include <windows.h>

// 定义指针
typedef BOOL(WINAPI *CHECK_REMOTE_DEBUG_PROCESS)(HANDLE, PBOOL);

BOOL CheckDebugger()
{
    BOOL bDebug = FALSE;
    CHECK_REMOTE_DEBUG_PROCESS CheckRemoteDebuggerPresent;

    HINSTANCE hModule = GetModuleHandle("kernel32");
    CheckRemoteDebuggerPresent = (CHECK_REMOTE_DEBUG_PROCESS)GetProcAddress(hModule, "CheckRemoteDebuggerPresent");

    HANDLE hProcess = GetCurrentProcess();

    CheckRemoteDebuggerPresent(hProcess, &bDebug);
    return bDebug;
}

int main(int argc, char *argv[])
{
    if (CheckDebugger())
    {
        printf("[-] 进程正在被调试 \n");
    }

    system("pause");
    return 0;
}