How can I detect a debugger or other tool that might be analysing my software?

Question

A very simple situation. I\'m working on an application in Delphi 2007 which is often compiled as \'Release\' but still runs under a debugger. And occasionally it will run under

Answer 1

You can also do

if DebugHook <> 0 then ...

Answer 2

To detect SilkTest, you could try to attach to a DLL which is used only by SilkTest in order to detect its presence. For example, if the Open Agent is attached to a process, Win32HookDll_x86.dll or Win32HookDll_amd64.dll will be present (the names can be easily found out with a tool like Process Explorer.

Answer 3

You can check the parent process that started your application. With CreateToolhelp32Snapshot/Process32First/Process32Next get the parent PID (PROCESSENTRY32.th32ParentProcessID or TProcessEntry32.th32ParentProcessID) for your application PID. Then get the filename for the parent PID to compare with the applications you want to check for, like SilkTest.

Check this article for code usage.

In addition to IsDebuggerPresent and CheckRemoteDebuggerPresent, you can also query PEB.BeingDebugged (PEB is Process Environment Block, to get PEB you must query TEB, which is the Thread Enviroment Block).

Answer 4

You're probably looking for the IsDebuggerPresent function.