So in this little movie, seeing how to check if the process is being under the debugger or not.
So we can use this function is debugger present so it will return boolean value whether the process
is being debugged or not.
So it's very simple one.
You can see this translates in the candidate to the dealer.
You can just simply copy this one.
So I can go and simply print this one.
If I go and run this and will get the value because this process is being run under this nursery worker,
the main problem with this function is many idiots will try to monitor the MPAA speakers and if there
is any call to this function, then our process will not be executed.
So this malware will try to first detect whether the binary is learning under the debugger or not.
Whenever the malware finds out that it is running under the debugger, it will simply edit the code.
So you can just simply open exit if that is present.
If there is a good, you can normally run the code.
Actually this function, they try to fetch their information from the process environment block.
So this is the structure and windows can either initiate all of these values.
So there are not many unknown.
So there are many unknown voters here.
But the third byte is being debugged.
So you can see the first one is reserve point and the third byte is being debugged.
So we can get this information by using this integrated information process.
This resides in the integrator so we can get the process information.
And what type of information we need depends on the second parameter.
The first parameters, the process handle.
And the second parameter is about this information class.
And is normally in beta.
So you can will be passing this process basic information.
And here you can see this is a structure.
These are normal pointers.
And here you can see the second memory is the pointer to this.
The structure.
And that parameter is actually a the structure, this function, you can see the parameter.
And the next one is proxy information length.
So we'll be sending this are children and the output is the return.
So let's go and import this one.
I say, let's go and open this in our Expo file explorer.
And if I go and run this normally Under Armour of Common Ground Window, I get fires because there is
not the burglary to normal process.
But when I run under this business area, this daredevil girl who ran this program.
So this disturbance is in beta.
So the first one is the pointer, which is the handle to the process.
And the second one is process information.
The type of.
You can see the basic process.
Basic information.
Uh, we can just say integer.
And the third one is the pointer.
And the next one is Berlin.
We can say this as you're in and out could be the variable to the variable of the size of the length
of this structure.
So they different the function.
Now I have already copied this process information that is process, basic information structure.
So you can see all of these other pointers.
So we can go to this, uh, website here.
We can search for, uh, process basic information.
Where you can see the results, the signature.
And here you have this enum containing all of the values.
So it's clear the German border.
And when you do also create your own talent of this one.
And we cannot read this interview in.
And we can get the current process under using this process that the current process so we'll be passing
this but can do.
And the second one is the process information.
That is the raw process, basic information that should be accurate.
And the third one is the pointer.
Red circle, the size to hold.
That much I want to shatter so we can save face.
So let's pass that point here.
And the process, the structure of the project, basic information that is size.
And now for the.
Miranda should be permanently available.
Okay.
I think we are good to go.
And after that, we'll be getting the.
We'll be getting the pointer to this structure.
So what we did is we needed to convert this pointer structure to be a PDA and that type of basic information.
So we created this common this.
So what about this structure?
So, PBA either structure.
Now we can sit in PPR every year.
So that is the pointer to the be restructured.
We can see the PBA dot.
Me base address.
Something at this PBT are a pointer to this structure.
So all we need to do is we need to just move forward and retrieve the content.
So we can sell Marshall DA rebate, so we can use this function to read the byte at the particular address.
So we are going to be able to ah press boot.
So that uh gives us the value of this being debugged value so we can just print this one.
So now we should get the value one and you can see we got the value one.
Now if we go and run this in the past, we should get the value zero.
So we are good.
Now we can just write some code.
If the cost is close to one.
We were Gary's present greeting.
No.
They were goodies.
Prison.
Let's go on this and you can see that God present and future and this there is not a.
So this is uh uh one of the techniques to find whether the process uses under the debugger or not.
We can also pass the but I just hand it off another process as well.
So this, uh, technique is also used by the
game anti cheating and we can see, uh, this is a valorant game and this valorant game has this, uh.
Right.
Vanguard that is burned, beaten by these riot games.
So these were that if you try to just open that they were good and open this practice.
And if you run this and this right, Vanguard will be in the background and it will benefit from the
game.
So it will not only benefit from the game, it will band your hardware.
So that means you cannot play this game under this, uh, computer.
So you need to buy another computer to play the game.
So, uh, this is the best, uh, and the cheating in.
I have to note from this that I had games returned.
So that's why you need to just go wait before if you are attaching any game to that, even if it's your
first game.
If it's a single game, it's no need to worry if it's a multiplayer game.
So then you need to be so more cautious about.