void check_debugger_presence() {
bool debugger_detected = false;
#ifdef _WIN32
debugger_detected = IsDebuggerPresent();
if (!debugger_detected) {
BOOL remote_debugger = FALSE;
CheckRemoteDebuggerPresent(GetCurrentProcess(), &remote_debugger);
debugger_detected = (remote_debugger == TRUE);
}
#else
debugger_detected = (ptrace(PTRACE_TRACEME, 0, 0, 0) == -1);
#endif
auto start = std::chrono::high_resolution_clock::now();
volatile uint64_t dummy = 0;
for (int i = 0; i < 1000000; ++i) {
dummy += i * i;
asm volatile("" : "+r" (dummy) : : "memory");
}
auto end = std::chrono::high_resolution_clock::now();
auto duration = std::chrono::duration_cast<std::chrono::microseconds>(end - start);
if (duration.count() > 5000) {
debugger_detected = true;
}
if (debugger_detected) {
AnalysisThreat threat;
threat.description = "Debugger detected";
threat.level = AnalysisThreat::HIGH;
threat.detection_time = std::chrono::duration_cast<std::chrono::milliseconds>(
std::chrono::system_clock::now().time_since_epoch()).count();
threat.countermeasure = [this]() { activate_debugger_evasion(); };
add_threat(threat);
}
}
