vx-api
  • Introduction
  • Code base
    • Headers
    • CRT Recreation
      • CaplockString
      • CopyMemory
      • SecureStringCopy
      • StringCompare
      • StringConcat
      • StringCopy
      • StringLength
      • StringLocateChar
      • StringFindSubstring (unstable)
      • ByteArrayToCharArray
      • CharArrayToByteArray
      • CharStringToWCharString
      • WCharStringToCharString
      • StringTerminateStringAtChar
      • RtlInitAnsiString
      • RtlInitUnicodeString
      • ShlwapiCharStringToWCharString
      • ShlwapiWCharStringToCharString
      • Random Integer (NTDLL)
      • ConvertCharStringToInt (NTDLL)
      • ZeroMemory
        • ImplZeroMemory1
        • ImplZeroMemory2
  • String Hashing
    • Djb2
    • FowlerNollVoVariant1a
    • JenkinsOneAtATime32Bit
    • LoseLose
    • Murmur
    • Rotr32
    • Sdbm
    • SipHash
    • SuperFastHash
    • UnknownGenericHash1
  • Antidebugging Methods
    • CloseHandleOnInvalidAddress
    • IsDebuggerPresentEx
    • IsIntelHardwareBreakpointPresent
  • Library Loading
    • GetTeb
    • GetPeb
    • GetKUserSharedData
    • RtlLoadPeHeaders
    • LdrLoadGetProcedureAddress
    • GetRtlUserProcessParameters
    • ProxyRegisterWaitLoadLibrary
    • ProxyWorkItemLoadLibrary
    • Function Import Methods
      • GetProcAddress (Safe)
      • GetProcAddressDjb2
      • GetProcAddressFowlerNollVoVariant1a
      • GetProcAddressJenkinsOneAtATime32Bit
      • GetProcAddressLoseLose
      • GetProcAddressMurmur
      • GetProcAddressRotr32
      • GetProcAddressSdbm
      • GetProcAddressSipHash
      • GetProcAddressSuperFastHash
      • GetProcAddressUnknownGenericHash1
  • Error Handling
    • GetLastErrorFromTeb
    • GetLastNtStatusFromTeb
    • RtlNtStatusToDosErrorViaImport
    • Win32FromHResult
  • Fingerprinting
    • GetNumberOfLinkedDlls
    • PEB / TEB related
      • GetCurrentLocaleFromTeb
      • GetOsBuildNumberFromPeb
      • GetOsMajorVersionFromPeb
      • GetOsMinorVersionFromPeb
      • GetOsPlatformIdFromPeb
    • GetPidFromEnumProcesses
    • IsNvidiaGraphicsCardPresent
    • IsProcessRunning (simple)
  • Wrappers and Helpers
    • GetProcessHeapFromTeb
    • GetCurrentThread
    • IsPathValid
    • IsDllLoaded
    • GetFileSizeFromPath
    • IsRegistryKeyValid
    • GetCurrentProcess
    • GetCurrentProcessIdFromTeb
    • GetCurrentProcessIdFromOffset
    • ExecuteBinaryShellExecuteEx
    • GetProcessPathFromLoaderLoad
    • GetProcessPathFromUserProcessParameters
    • GetProcessBinaryNameFromHwnd
    • GetCurrentDirectoryFromUserProcessParameters
    • GetSystemWindowsDirectory
    • ImplGetModuleHandle
  • Process Creation Techniques
    • WindowsRHotKey
    • WindowsRHotKeyEx
    • IeFrameOpenUrl
    • INFSectionInstallString
    • INFSectionInstallString2
    • INFSetupCommand
    • CreateProcessFromMsHTML
    • CreateProcessFromPcwUtilW
    • ShdocVwOpenUrl
    • ShellExecRunDLL
    • UrlFileProtocolHandler
    • UrlOpenUrl
    • ZipfldrRouteCall
    • CreateProcessViaNtCreateUserProcess
    • CreateProcessWithCfGuard
  • Shellcode Execution
    • CreateThreadAndWaitForCompletion
    • CDefFolderMenu_Create2
    • CertEnumSystemStore
    • CertEnumSystemStoreLocation
    • ChooseColorW
    • ClusWorkerCreate
    • CreateTimerQueueTimer
    • CryptEnumOIDInfo
    • DSA_EnumCallback
    • EnumChildWindows
    • EnumDateFormatsW
    • EnumDesktopsW
    • EnumDesktopWindows
    • EnumDirTreeW
    • EnumDisplayMonitors
    • EnumerateLoadedModules64
    • EnumFontFamiliesExW
    • EnumFontsW
    • EnumLanguageGroupLocalesW
    • EnumObjects
    • EnumPwrSchemes
    • EnumResourceTypesExW
    • EnumSystemCodePagesW
    • EnumSystemGeoID
    • EnumSystemLanguageGroupsW
    • EnumSystemLocalesEx
    • EnumThreadWindows
    • EnumTimeFormatsEx
    • EnumUILanguagesW
    • EnumWindows
    • EnumWindowStationsW
    • EvtSubscribe
    • FlsAlloc
    • ImageGetDigestStream
    • ImmEnumInputContext
    • InitOnceExecuteOnce
    • K32EnumPageFilesW
    • MessageBoxIndirectW
    • SymEnumProcesses
    • SymEnumSourceFilesW
    • VerifierEnumerateResource
  • Compression
    • Lempel-Ziv
      • LzStandardDecompressBuffer
      • LzStandardCompressBuffer
      • LzMaximumDecompressBuffer
      • LzMaximumCompressBuffer
    • Xpress
      • XpressMaximumCompressBuffer
      • XpressMaximumDecompressBuffer
      • XpressStandardCompressBuffer
      • XpressStandardDecompressBuffer
    • Xpress Huff
      • XpressHuffMaximumCompressBuffer
      • XpressHuffMaximumDecompressBuffer
      • XpressHuffStandardCompressBuffer
      • XpressHuffStandardDecompressBuffer
  • Networking
    • IPv4IpAddressStructureToString
    • IPv4IpAddressUnsignedLongToString
    • IPv4StringToUnsignedLong
    • DnsGetDomainNameIPv4AddressAsString
    • DnsGetDomainNameIPv4AddressUnsignedLong
    • GetDomainNameFromIPV4AddressAsString
    • GetDomainNameFromUnsignedLongIPV4Address
    • SendIcmpEchoMessageToIPv4Host
    • UrlDownloadToFileSynchronous
  • Lsass Related
    • GetLsaPidFromNamedPipe
    • GetLsaPidFromRegistry
    • GetLsaPidFromServiceManager
  • Proxied Functions
    • CopyFileViaSetupCopyFile
    • CreateFileFromDsCopyFromSharedFile
    • DeleteDirectoryAndSubData
    • IeCreateDirectory
    • IeCreateFile
    • IsProcessRunningAsAdmin2
    • IEGetFileAttributesEx
    • IEMoveFileEx
    • IERemoveDirectory
  • Evasion
    • AmsiBypass by Patching (OLD)
    • Delay execution until monitor off
    • Unlink DLL from process
    • Sleep Obfuscation (unstable)
  • Component Object Model
    • Process Creation
      • IHxInteractiveUser
      • WmiWin32_CreateProcess
      • IHxHelpPaneServer
      • CoShellWindowExecute
      • CoShellExecute
    • IsComInitialized
    • CoGetEnvironmentVariableW
    • CoCreateIsoForMounting
    • CoXMLHTTPDownloadByteFileW
    • CoEnumUPnPDevices
  • My Projects
    • "Jeff", COM-only keylogger
    • "Russian Doll", Recursive file loader
    • "Branchy", Branchless keylogger
    • "Fever Dream" - Code executing when the Windows machine is locked
    • Creating "Ransomware" Using WinRT
Powered by GitBook
On this page
  1. Antidebugging Methods

IsDebuggerPresentEx

BOOL IsDebuggerPresentEx(VOID)
{
	return GetPeb()->BeingDebugged;
}

PreviousCloseHandleOnInvalidAddressNextIsIntelHardwareBreakpointPresent

Last updated 29 days ago