I am interested in the following technique to detect if a debugger is attached or not.
http://spareclockcycles.org/2012/02/14/stack-necromancy-defeating-debuggers-by-raising-the-dead/
However I tried the examples and they don't seem to work.
Do the Windows Debug API modify the debugee stack when they are attached or when they are present?
Thanks !