Debugger detection based on the exclusive access to NtDll

[AndyWatterman]

Operating System

Windows 10, x64, 19043.1055

x64dbg Version

Jun 14 2021 (NO plugins)

Describe the issue

This PoC will fail if you have running debugging:

#include <Windows.h>
#include <iostream>

const auto NTDLL = L"C:\\Windows\\system32\\ntdll.dll";

int main()
{
    auto isOK = CreateFileW(NTDLL, 0x80000000, NULL, NULL, 0x3, 0x80, NULL);
    std::cout << std::hex << isOK << std::endl;
    system("pause");
}

Steps to reproduce

1. Start any 32-bit file debugging in x64dbg from Admin (I have not checked x64)
2. Run PoC (just click in Explorer)
3. Look at 0xFFFFFFFF

Attachments

No response

[dauthleikr]

I might be wrong but I think this is x64dbg/TitanEngine#5

[AndyWatterman]

Hmm... Actually I guess you could be right. I'll test it again soon.
However, this is not about the process itself. It is about system library.