Debugger Detection

Protection Module: DebuggerDetection

Detects if a debugger is attached to your application process and triggers the configured action.

Available for:

• Desktop Applications (Windows, Linux, macOS)
• Mobile Applications (iOS, Android)
• Server Applications

How It Works

Debugger Detection continuously monitors your application to detect if a debugger is attached. It uses multiple detection techniques to identify both managed and native debuggers.

Detection Techniques:

• Managed debugger API (System.Diagnostics.Debugger.IsAttached)
• Native debugger detection (Windows: IsDebuggerPresent, CheckRemoteDebuggerPresent)
• Linux/macOS: ptrace detection, /proc filesystem checks
• Dynamic debugging detection (breakpoint analysis)

Common Debuggers Detected:

• Visual Studio Debugger
• JetBrains Rider Debugger
• WinDbg / x64dbg
• GDB / LLDB
• dnSpy / ILSpy debuggers

Configuration

JSON Configuration

{
  "protections": {
    "DebuggerDetection": {
      "enabled": true,
      "action": "close"
    }
  }
}

{
  "protections": {
    "DebuggerDetection": {
      "enabled": true,
      "action": "close"
    }
  }
}

Code-Based Configuration

await Payload.ConfigureAsync(config =>
{
    config.AddProtection(ProtectionModuleType.DebuggerDetection, ActionType.Close);
});

await Payload.ConfigureAsync(config =>
{
    config.AddProtection(ProtectionModuleType.DebuggerDetection, ActionType.Close);
});

Advanced: Custom Interval

For performance tuning, specify check interval (default: 30 seconds):

{
  "protections": {
    "DebuggerDetection": {
      "enabled": true,
      "action": "close",
      "intervalMs": 15000
    }
  }
}

{
  "protections": {
    "DebuggerDetection": {
      "enabled": true,
      "action": "close",
      "intervalMs": 15000
    }
  }
}

Available Actions

See Actions for detailed action documentation.

When to Use

Recommended for:

• Applications with valuable intellectual property
• Licensing validation code
• Financial applications
• Security-critical algorithms (authentication, encryption)
• Production builds distributed to end users

Not recommended for:

• Development builds (you won't be able to debug)
• Applications that need debugging in production
• Open-source applications where debugging is expected

Code Examples

Development vs Production

await Payload.ConfigureAsync(config =>
{
#if DEBUG
    config.AddProtection(ProtectionModuleType.DebuggerDetection, ActionType.Log);
#else
    config.AddProtection(ProtectionModuleType.DebuggerDetection, ActionType.Close);
#endif
});

await Payload.ConfigureAsync(config =>
{
#if DEBUG
    config.AddProtection(ProtectionModuleType.DebuggerDetection, ActionType.Log);
#else
    config.AddProtection(ProtectionModuleType.DebuggerDetection, ActionType.Close);
#endif
});

Custom Action with Logging

await Payload.ConfigureAsync(config =>
{
    config.RegisterCustomAction("debugger-alert", async (threat) =>
    {
        await File.AppendAllTextAsync("security.log",
            $"[{DateTime.Now}] Debugger detected: {threat.Description}\n");

        await SendEmailAsync("security@company.com",
            $"Debugger attached to {Environment.MachineName}");

        Environment.Exit(-1);
    });

    config.AddProtection(ProtectionModuleType.DebuggerDetection, "debugger-alert");
});

await Payload.ConfigureAsync(config =>
{
    config.RegisterCustomAction("debugger-alert", async (threat) =>
    {
        await File.AppendAllTextAsync("security.log",
            $"[{DateTime.Now}] Debugger detected: {threat.Description}\n");

        await SendEmailAsync("security@company.com",
            $"Debugger attached to {Environment.MachineName}");

        Environment.Exit(-1);
    });

    config.AddProtection(ProtectionModuleType.DebuggerDetection, "debugger-alert");
});

Mobile-Specific Alert

config.RegisterCustomAction("mobile-debugger-alert", async (threat) =>
{
    await Application.Current.MainPage.DisplayAlert(
        "Security Warning",
        "Debugger detected. Application will close.",
        "OK"
    );

    await Task.Delay(2000);
    Environment.Exit(-1);
});

config.AddProtection(ProtectionModuleType.DebuggerDetection, "mobile-debugger-alert");

config.RegisterCustomAction("mobile-debugger-alert", async (threat) =>
{
    await Application.Current.MainPage.DisplayAlert(
        "Security Warning",
        "Debugger detected. Application will close.",
        "OK"
    );

    await Task.Delay(2000);
    Environment.Exit(-1);
});

config.AddProtection(ProtectionModuleType.DebuggerDetection, "mobile-debugger-alert");

Platform Compatibility

Performance Impact

CPU Usage: Minimal (~0.1% CPU during checks) Memory: <1 MB Check Frequency: Every 30 seconds (default)

Performance Tuning:

{
  "protections": {
    "DebuggerDetection": {
      "enabled": true,
      "action": "close",
      "intervalMs": 60000
    }
  }
}

{
  "protections": {
    "DebuggerDetection": {
      "enabled": true,
      "action": "close",
      "intervalMs": 60000
    }
  }
}

• Aggressive (15s): Higher security, more CPU usage
• Balanced (30s): Recommended default
• Conservative (60s): Lower overhead, slower detection

Threat Detection Details

When a debugger is detected, the ThreatInfo object contains:

{
  "threatId": "DBG-2025-12-28-1234",
  "description": "Debugger attached to process",
  "moduleType": "DebuggerDetection",
  "detectedAt": "2025-12-28T10:30:45Z",
  "confidence": 1.0,
  "metadata": {
    "processId": 1234,
    "processName": "MyApp.exe",
    "debuggerType": "managed",
    "platform": "Windows"
  }
}

{
  "threatId": "DBG-2025-12-28-1234",
  "description": "Debugger attached to process",
  "moduleType": "DebuggerDetection",
  "detectedAt": "2025-12-28T10:30:45Z",
  "confidence": 1.0,
  "metadata": {
    "processId": 1234,
    "processName": "MyApp.exe",
    "debuggerType": "managed",
    "platform": "Windows"
  }
}

Related Protections

• Tampering Detection - Detects code modifications
• Memory Dump Detection - Prevents memory dumping
• Virtual Machine Detection - Detects VM environments

Next Steps