Anti Debugging using CheckRemoteDebuggerPresent

Windows XP 이상부터 사용 가능

BOOL WINAPI CheckRemoteDebuggerPresent(
  _In_    HANDLE hProcess,
  _Inout_ PBOOL  pbDebuggerPresent
);

Parameters

hProcess [in]

A handle to the process.

pbDebuggerPresent [in, out]

A pointer to a variable that the function sets to TRUE if the specified process is being debugged, or FALSEotherwise.

Return value

If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

https://msdn.microsoft.com/ko-kr/library/windows/desktop/ms679280(v=vs.85).aspx