How can I detect if my application is running in x64debug?

Question

I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response.

When building the application, I am easily able to detect it is being debugged with System.Diagnostics.Debugger.IsAttached or kernel32.dll's CheckRemoteDebuggerPresentmethod.

if (System.Diagnostics.Debugger.IsAttached)
            {
                //code if being debugged
            }

When I debug my release in x64dbg though, the debugger is not detected. Is there a way to detect this?

Answer 1

Pretty sure System.Diagnostics.Debugger.IsAttached detects only managed debuggers, whereas the code you mentioned CheckRemoteDebuggerPresent, should work on any kind of debugger, provided there is no anti-anti-debugging protection applied. Managed debuggers, refer to those such as your .net managed debugger.

Note that CheckRemoteDebuggerPresent, when the handle is set to the current process, is essentially the same as IsDebuggerPresent

IsDebuggerPresent is the simplest way to check if a debugger is attached to your process, but also the easiest debugging detection technique to bypass.

You can checkout this article for a list of some of the common techniques used (there are many ways to detect !) : https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software