IsDebuggerPresent Api Replacement

Post date: Sep 15, 2010 4:21:12 AM

It is possible to detect whether or not a debugger is present using the Process Environment Block (PEB).

unit uIsDebuggerPresent;

//www.delphibasics.info

interface

function IsDebuggerPresent : Boolean;

implementation

type

  PPeb = ^TPeb;

  TPeb = packed record

    InheritedAddressSpace         : Boolean;

    ReadImageFileExecOptions      : Boolean;

    BeingDebugged                 : Boolean;

  end;

function IsDebuggerPresent : Boolean;

var

  PEB : PPEB;

  LPEB : TPEB;

begin

asm

push eax

mov eax,fs: $30;

mov PEB, eax

pop eax

end;

  LPEB := TPEB(PEB^);

  if LPEB.BeingDebugged then

    Result := True

  else

    Result := False;

end;

end.