DelphiFAQ Home Search:

How to detect if an application is being debugged


commentsThis article has not been rated yet. After reading, feel free to leave comments and rate it.

Have you ever wondered if the user is trying to debug your application? Don�t count on getting feedback from that user, but a registration code, crack, and/or key generator are more likely. Let�s face it: if the user debugging your application is not part of development or testing team chances are he or she is trying to crack it. Of course, your users may feel committed to helping create bug-free programs but don�t count on it =)

There is no need for sophisticated assembly code or any self-written routines. All you need is pretty much provided by Windows API. IsDebuggerPresent() is supported by Windows 98, ME, and of course all new versions of Windows based on the NT kernel (2000, XP). Just call IsDebuggerPresent() and you can use the result of this function to change the behavior of your application if a debugger is present. Also keep in mind that procedure names are stored in the executable, so you might want to change to name of IsDebuggerPresent() to something less obvious like UpdateEditor() or CalculateArray().

function DebuggerPresent : boolean;
  TDebugProc = function : boolean;
  Kernel32: HMODULE;
  DebugProc: TDebugProc;
begin { DebuggerPresent }
  Result := False;
  Kernel32 := GetModuleHandle('kernel32');
  if Kernel32<>0 then
    @DebugProc := GetProcAddress(Kernel32, 'IsDebuggerPresent');
    if Assigned(DebugProc) then
      Result := DebugProc
  end; { Kernel32<>0 }
end; { DebuggerPresent }

Content-type: text/html


2006-01-15, 12:18:26 from Nigeria  
IsDebuggerPresent can be by passed using close to 40 techniques. For instance the debugged application can be moved to Win95 which has no IsDebuggerPresent API, then start a debugging process.

You can visist some of the site that has info on IsDebuggerPresent:
(1) http://www.hexblog...ebug.html
(2) http://www.hexblog.../2005/11/

Engr. Wale,
Mushin, Lagos,



NEW: Optional: Register   Login
Email address (not necessary):

Rate as
Hide my email when showing my comment.
Please notify me once a day about new comments on this topic.
Please provide a valid email address if you select this option, or post under a registered account.

Show city and country
Show country only
Hide my location
You can mark text as 'quoted' by putting [quote] .. [/quote] around it.
Please type in the code:

Please do not post inappropriate pictures. Inappropriate pictures include pictures of minors and nudity.
The owner of this web site reserves the right to delete such material.

photo Add a picture: