Debugger Detection with PEB Inspection - White Knight Labs

PEB_Debugger_Detection.cpp

# White Knight Labs - Offensive Development
# Debugger Check - PEB

#include <windows.h>
#include <iostream>

void TriggerBreakpoint() {
    __asm {
        int 3 // Software Breakpoint
    }
}

// Function to check the BeingDebugged flag in the PEB for x64
bool IsBeingDebuggedPEB() {
    BOOL isDebugged = FALSE;

    __asm {
        mov rax, gs:[0x60] // Access the PEB through GS segment for x64 applications
        mov al, [rax + 0x2] // BeingDebugged offset is 2
        mov isDebugged, al
    }

    return isDebugged;
}

int main() {
    if (IsBeingDebuggedPEB()) {
        std::cout << "Debugger detected, triggering breakpoint." << std::endl;
        TriggerBreakpoint();
    } else {
        std::cout << "No debugger detected." << std::endl;
    }

    return 0;
}