What are some things I can do to do anti kernel debugging from user-mode C++?
I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityWhat are some things I can do to do anti kernel debugging from user-mode C++?
I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.
There is little you can do to prevent/detect kernel mode debugging of your application from user mode. Even if you can detect, it's because no one is interested enough to by-pass them.
For example, your technique will be by-passed by hooking ZwQuerySystemInformation in the kernel to fool your checks.
If you want protection, you should invest into techniques that make the analysis/reversing harder (code protectors).
Just for reference, the opposite question.