Is this correct?

[shrikantbmali]

I'd expect the DebugPort to have a valid pointer if the status was successful?
Which also then indicates the debugger port is active?

Anti-DebugNET/Anti-DebugNET/AntiDebug/DebugProtect2.cs

Line 73 in fce1a11

if (DebugPort == new IntPtr(-1))

[Mecanik]

Yes, that's correct; sorry about that.

I might have done small mistakes due to being rushed to write it... please use it with a grain of salt and always test.

Soon, I will update the code with improved checks, more checks and system calls.

[vibheksoni]

private static int CheckDebugPort()
            {
                NtStatus status;
                IntPtr DebugPort = IntPtr.Zero;
                int ReturnLength;

                unsafe
                {
                    status = NtQueryInformationProcess(System.Diagnostics.Process.GetCurrentProcess().Handle, PROCESSINFOCLASS.ProcessDebugPort, out DebugPort, Marshal.SizeOf(DebugPort), out ReturnLength);

                    if (status == NtStatus.Success && DebugPort != IntPtr.Zero)
                    {
                        return 1;
                    }
                }

                return 0;
            }