IsDebuggerPresent Api Replacement

posted 14 Sep 2010, 21:21 by Delphi Basics
It is possible to detect whether or not a debugger is present using the Process Environment Block (PEB). 

unit uIsDebuggerPresent;
//www.delphibasics.info
interface

function IsDebuggerPresent : Boolean;

implementation

type
  PPeb = ^TPeb;
  TPeb = packed record
    InheritedAddressSpace         : Boolean;
    ReadImageFileExecOptions      : Boolean;
    BeingDebugged                 : Boolean;
  end;

function IsDebuggerPresent : Boolean;
var
  PEB : PPEB;
  LPEB : TPEB;
begin
asm
push eax
mov eax,fs: $30;
mov PEB, eax
pop eax
end;
  LPEB := TPEB(PEB^);
  if LPEB.BeingDebugged then
    Result := True
  else
    Result := False;
end;

end.
Comments