How can I detect a debugger or other tool that might be analysing my software?

Question

A very simple situation. I\'m working on an application in Delphi 2007 which is often compiled as \'Release\' but still runs under a debugger. And occasionally it will run under

Answer 1

You can check the parent process that started your application. With CreateToolhelp32Snapshot/Process32First/Process32Next get the parent PID (PROCESSENTRY32.th32ParentProcessID or TProcessEntry32.th32ParentProcessID) for your application PID. Then get the filename for the parent PID to compare with the applications you want to check for, like SilkTest.

Check this article for code usage.

In addition to IsDebuggerPresent and CheckRemoteDebuggerPresent, you can also query PEB.BeingDebugged (PEB is Process Environment Block, to get PEB you must query TEB, which is the Thread Enviroment Block).