BOOL IsDebuggerPresent();

#include <windows.h>
#include <stdio.h>
BOOL CheckDebug()
{
	return IsDebuggerPresent();
}
int main() 
{
	if (CheckDebug())
	{
		printf("a");
		//exit(0);
	}
	else
	{
		printf("b");
		//shellcodeloader();
	}
    return 0;
}

BOOL CheckRemoteDebuggerPresent(
  [in]      HANDLE hProcess,
  [in, out] PBOOL  pbDebuggerPresent
);

参数
[in] hProcess
进程的句柄。
[in, out] pbDebuggerPresent
如果正在调试指定的进程，则函数设置为 TRUE 的变量的指针，否则为 FALSE 。
    
返回值
如果该函数成功，则返回值为非零值。
如果函数失败，则返回值为零。 要获得更多的错误信息，请调用 GetLastError。

BOOL CheckDebug1()
{
	BOOL ret;//定义了一个布尔类型的变量
	CheckRemoteDebuggerPresent(GetCurrentProcess(), &ret);//变量就有地址，这个api函数就可以找到这个地址直接在地址里面写true还是false
	return ret;//直接返回变量的值就是刚才修改的内容
}
int main()
{
	if (CheckDebug1())
	{
		printf("a");
	}
	else
	{
		printf("b");
	}
}

__kernel_entry NTSTATUS NtQueryInformationProcess(
  [in]            HANDLE           ProcessHandle,
  [in]            PROCESSINFOCLASS ProcessInformationClass,
  [out]           PVOID            ProcessInformation,
  [in]            ULONG            ProcessInformationLength,
  [out, optional] PULONG           ReturnLength
);

bool NtQueryInformationProcessApproach()

{

    int debugPort = 0;

    HMODULE hModule = LoadLibrary(TEXT("Ntdll.dll "));

    NtQueryInformationProcessPtr NtQueryInformationProcess = (NtQueryInformationProcessPtr)GetProcAddress(hModule, "NtQueryInformationProcess");

    if (NtQueryInformationProcess(GetCurrentProcess(), (PROCESSINFOCLASS)7, &debugPort, sizeof(debugPort), NULL)) 
    {

        printf("[ERROR NtQueryInformationProcessApproach] NtQueryInformationProcess failed\n");
    }
    else
    {
        return debugPort == -1;
    }

    return false;

}

int main()
{
    if (NtQueryInformationProcessApproach())
    {
        printf("a");
    }
    else
    {
        printf("b");
    }
}

#include <windows.h>
#include <stdio.h>
BOOL CheckDebug()
{
    DWORD ret = CloseHandle((HANDLE)0x1234);
    //SetLastError
    if (ret != 0 || GetLastError() != ERROR_INVALID_HANDLE)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}


int main() 
{
    if (CheckDebug())
    {
        printf("a");
    }
    else
    {
        printf("b");
    }
}

#include "kernelmode_antidbg.h"
#include <iostream>
#include "connector.h"
#ifdef __cplusplus
extern "C" {
#endif 




#define KUSER_SHARED_VA 0x7FFE0000
#define KUSER_SHARED_SIZE 0x3B8
 //_KUSER_SHARED_DATA
    inline bool is_kuser_shared_mapped()
    {
        if (IsBadReadPtr((BYTE*)KUSER_SHARED_VA, KUSER_SHARED_SIZE)) {
            std::cerr << "KDB: Failed to retrieve KUSER_SHARED_DATA\n";
            return false;
        }
        return true;
    }

    // from Hidden Bee malware:
    t_kdb_mode is_kernelmode_dbg_enabled() {
        const ULONGLONG KdDebuggerEnable_offset = 0x2d4;
        if (!is_kuser_shared_mapped()) {
            return KDB_UNKNOWN;
        }
        BYTE* KdDebuggerEnable = (BYTE*)(KUSER_SHARED_VA + KdDebuggerEnable_offset);
       
        if (*KdDebuggerEnable) {
            if (*KdDebuggerEnable == 3) {
                std::cout << "KDB: Remote enabled!\n";
                //windbg双机调试 一台虚拟机作为被调试的对象 一台机器作为调试结果查看的机器
                return KDB_REMOTE_ENABLED;
            }
            std::cout << "KDB: Local enabled!\n";
            return KDB_LOCAL_ENABLED;
        }
        std::cout << "KDB: Disabled\n";
        return KDB_DISABLED;
    }

#ifdef __cplusplus
}
#endif

#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>
#include <winternl.h>
BOOL CheckDebug()
{
    DWORD ID;
    DWORD ret = 0;
    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(pe32);
    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == INVALID_HANDLE_VALUE)
    {
        return FALSE;
    }
    BOOL bMore = Process32First(hProcessSnap, &pe32);
    while (bMore)
    {
        if (_stricmp(pe32.szExeFile, "OllyDBG.EXE") == 0 || _stricmp(pe32.szExeFile, "OllyICE.exe") == 0 || _stricmp(pe32.szExeFile, "x64_dbg.exe") == 0 || _stricmp(pe32.szExeFile, "windbg.exe") == 0 || _stricmp(pe32.szExeFile, "ImmunityDebugger.exe") == 0)
        {
            return TRUE;
        }
        bMore = Process32Next(hProcessSnap, &pe32);
    }
    CloseHandle(hProcessSnap);
    return FALSE;
}
int main() 
{
    if (CheckDebug())
    {
        printf("a");
    }
    else
    {
        printf("b");
    }
}

#include <windows.h>
#include <stdio.h>
BOOL CheckDebug()//就到这里来了
{
    DWORD time1 = GetTickCount();
    __asm
    {
        mov     ecx, 10
        mov     edx, 6
        mov     ecx, 10
    }
    DWORD time2 = GetTickCount();
    if (time2 - time1 > 0xA)
                           
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

int main() //入口点
{
    if (CheckDebug())//肯定是这个
    {
        printf("a");
    }
    else
    {
        printf("b");
    }
    return 0;

#include <stdio.h>  
#include <windows.h>  

void NTAPI __stdcall TLS_CALLBACK1(PVOID DllHandle, DWORD dwReason, PVOID Reserved);

#ifdef _M_IX86  
#pragma comment (linker, "/INCLUDE:__tls_used")  
#pragma comment (linker, "/INCLUDE:__tls_callback")  
#else  
#pragma comment (linker, "/INCLUDE:_tls_used")  
#pragma comment (linker, "/INCLUDE:_tls_callback")  
#endif  
EXTERN_C
#ifdef _M_X64  
#pragma const_seg (".CRT$XLB")  
const
#else  
#pragma data_seg (".CRT$XLB")  
#endif  

PIMAGE_TLS_CALLBACK _tls_callback[] = { TLS_CALLBACK1,0 };
#pragma data_seg ()  
#pragma const_seg ()  

#include <iostream>  

void NTAPI __stdcall TLS_CALLBACK1(PVOID DllHandle, DWORD Reason, PVOID Reserved)
{
    if (IsDebuggerPresent())
    {
        exit(0);
    }
    else
    {
        MessageBox(NULL,"aaaaaaaa","bbbbbbbb",0);
    }
}

int main(int argc, char* argv[])
{
    printf("233\n");
    return 0;
}

#include <windows.h>
#include <stdio.h>
BOOL CheckDebug()
{
    __try
    {
        __asm int 3
    }
    __except (1)
    {
        return FALSE;
    }
    return TRUE;
}

int main() 
{
    if (CheckDebug())
    {
        printf("a");
    }
    else
    {
        printf("b");
    }
    return 0;
}