> For the complete documentation index, see [llms.txt](https://easyauth.papelship.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://easyauth.papelship.com/csharp-document/other-func/anti-debugging.md).

# Anti Debugging

qPapel EasyAuth implements multi-layered user-mode and kernel-mode anti-debugging defenses to detect and neutralize interactive disassemblers, debuggers, and dynamic analysis tools.

## Detection Vectors

The anti-debugging module monitors and mitigates:

1. **Kernel Debugger Ports**: `NtQueryInformationProcess(ProcessDebugPort)` and `ProcessDebugObjectHandle` direct syscalls.
2. **Hardware Breakpoints**: Continuous inspection of CPU context registers (`DR0` through `DR3` and `DR7`).
3. **Software Breakpoints**: Inline scanning for `0xCC` (`INT 3`) and `0xCD 0x03` instructions.
4. **Thread Hiding**: Automatic execution of `NtSetInformationThread(ThreadHideFromDebugger)` on application threads.
5. **VEH Handler Integrity**: Vectored Exception Handlers trap and neutralize hardware page guard breaks.
6. **Kernel Object Probes**: Detection of DBGK handles and kernel debugger attachments.

## C# Implementation

```csharp
using System;
using qPapelEasyAuth;

public class SecurityAuditor
{
    public static void RunDebuggerAudit()
    {
        // 1. Direct active debugger check
        bool isDebugging = qPapelEasyAuth.qPapelEasyAuth.IsDebuggerDetected();
        
        if (isDebugging)
        {
            Console.WriteLine("[!] ALERT: Active debugger detected attached to process!");
            // Perform security mitigation or report to server
            qPapelEasyAuth.qPapelEasyAuth.ReportSuspicious("Debugger attached", "anti_debug", "critical");
            Environment.Exit(0);
        }
        else
        {
            Console.WriteLine("[+] Anti-Debug Check: Clean.");
        }

        // 2. Comprehensive security check across all subsystems
        bool securityViolation = qPapelEasyAuth.qPapelEasyAuth.ProtectionCheck();
        if (securityViolation)
        {
            Console.WriteLine("[!] Memory or environment tampering detected.");
            Environment.Exit(0);
        }
    }
}
```

## Active Mitigation Responses

{% tabs %}
{% tab title="Standard Response" %}
The native core halts all thread execution immediately, wipes cryptographic session tokens from RAM, and terminates the process with `ExitProcess` / direct kernel syscall termination.
{% endtab %}

{% tab title="Honeypot Response" %}
If `ProtectionFlags.Honeypot` is enabled, the core delays termination by a randomized interval (`HoneypotDelayMs`), delivers decoy encrypted payloads, reports the forensic profile to the server, and bans the device.
{% endtab %}
{% endtabs %}

{% hint style="warning" %}
When debugging your application during development inside Visual Studio, disable `ProtectionFlags.AntiDebug` in your debug configuration to prevent the security engine from terminating your IDE debug session.
{% endhint %}