0

How do I check if a C# program is being put into a debugger in C#? The OS is Windows 10. I have tried to check the user of the person running the program, but it always gave me the current user logged in. Does anyone have any ideas on how I can do this?

Note: This question is marked as a duplicate because someone thought it was a duplicate of this, but its not. By checking if a program is being put into a debugger I mean checking if the program is being reverse engineered. An example of a debugger is this. I also got a comment saying "If the program is being debugged, the user of the debugger can circumvent your checks.", I'm aware they can circumvent my checks, but I would still like to check.

jimobo3865
  • 9
  • 1
  • If the program is being debugged, the user of the debugger can circumvent your checks. – madreflection May 13 '21 at 16:08
  • I know, I would still like to check though. @madreflection – jimobo3865 May 13 '21 at 16:13
  • @OlivierRogier If I were to plug my program into a debugger (x64dgb for example) would it be able to detect that? – jimobo3865 May 13 '21 at 16:16
  • Does this answer your question? [Is there a way to detect if a debugger is attached to another process from C#?](https://stackoverflow.com/questions/2188201/is-there-a-way-to-detect-if-a-debugger-is-attached-to-another-process-from-c) –  May 13 '21 at 16:17
  • @OlivierRogier, It doesn't – jimobo3865 May 13 '21 at 16:18
  • @jimobo3865 I don't know, I just found that duplicate via [CodeProject](https://www.codeproject.com/Articles/670193/Csharp-Detect-if-Debugger-is-Attached) –  May 13 '21 at 16:18
  • Debugger.IsAttached doesnt help – jimobo3865 May 13 '21 at 16:19
  • @jimobo3865 Have you tried CheckRemoteDebuggerPresent that is the purpose of the suggested duplicate, detect non managed (native) debuggers on Windows using this WinAPI ? –  May 13 '21 at 16:20
  • nono I want it to check if its being debugged. Even if its using a native debugger – jimobo3865 May 13 '21 at 16:28
  • @ jimobo3865 I don't understand. Your application "*is being debugged*" when a debugger is attached. The latter can be native or managed. `IsAttached` is for native. `CheckRemoteDebuggerPresent` works for native. As said duplicates and the CodePeoject article. Thus what is your question and what about are you talking since x64dbg is a debugger that acts in place of for example the VS Debugger but being native? Thus to detect it you should use CheckRemoteDebuggerPresent. Have you tried? What's the result? Else consider updating the question, please. –  May 13 '21 at 16:32
  • @OlivierRogier just want to check if the program is being debugged. Regardless if its a native debugger or not. If it is being debugged I want to make a request. – jimobo3865 May 13 '21 at 16:37
  • @jimobo3865 "*I want to make a request*" to what and how and why? –  May 13 '21 at 16:37
  • Ignore the request part. I already have that figured out. I just want to check if a program is being debugged regardless if its a native debugger or not – jimobo3865 May 13 '21 at 16:38
  • @jimobo3865 Therefore you have now all the tools to detect if a https://en.wikipedia.org/wiki/Debugger is running your app as a child controlled process. –  May 13 '21 at 16:40
  • what. what tools? – jimobo3865 May 13 '21 at 16:46
  • @jimobo3865 That: https://stackoverflow.com/questions/67522457/how-to-detect-if-an-unmanaged-native-debugger-is-running-the-current-net-applic#comment119348168_67522457 and that: https://stackoverflow.com/questions/67522457/how-to-detect-if-an-unmanaged-native-debugger-is-running-the-current-net-applic#comment119348221_67522457. Else you can check if x64dbg is running with Process.GetProcesses, and has your app exe as child process. –  May 13 '21 at 17:03
  • @OlivierRogier But you said those only check if its not a windows native debugger. – jimobo3865 May 13 '21 at 17:26

0 Answers0