> For the complete documentation index, see [llms.txt](https://easyauth.papelship.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://easyauth.papelship.com/documentation/core-functions/security-antidebug.md).

# Security Antidebug

This page covers the proactive threat detection, anti-debugging, honeypot traps, and hook scanning mechanisms built into EasyAuth.

## Anti-Debugging & Hook Scanners

### `easyauth::protection_check`

Executes an immediate comprehensive security audit across all active protection modules.

```cpp
bool protection_check();
```

#### Returns

* `true` if the environment is clean and safe; `false` if any debugger, memory modification, or hook is detected.

### `easyauth::is_debugger_detected`

Checks for user-mode and kernel-mode debuggers through multiple low-level checks:

* PEB `BeingDebugged` and `NtGlobalFlag`.
* Hardware Breakpoints (`DR0`–`DR7` debug registers).
* `NtQueryInformationProcess` (`ProcessDebugPort`, `ProcessDebugObjectHandle`).
* Timing anomalies via `RDTSC`.

```cpp
bool is_debugger_detected();
```

### `easyauth::is_injection_detected`

Inspects loaded DLL modules, scans for proxy/hooking libraries (e.g. `MinHook`, `Detours`, `PolyHook`), and monitors unmapped memory pages.

```cpp
bool is_injection_detected();
```

### `easyauth::scan_network_hooks`

Scans critical Winsock (`ws2_32.dll`) and HTTP networking functions (`connect`, `send`, `recv`, `WinHttpSendRequest`) for inline byte patches and trampolines often inserted by proxy sniffers like HTTP Debugger or Fiddler.

```cpp
bool scan_network_hooks();
```

### `easyauth::hide_thread`

Hides the calling thread from user-mode debuggers by invoking `NtSetInformationThread` with `ThreadHideFromDebugger (0x11)`.

```cpp
bool hide_thread();
```

## Stealth Honeypots

Honeypots are decoy memory structures designed to detect memory scanners (e.g. Cheat Engine, ArtMoney). When a cracker scans or writes to these memory traps, EasyAuth captures their telemetry and queues a stealth ban.

### `easyauth::arm_honeypot`

Arms the in-memory honeypot traps.

```cpp
void arm_honeypot(uint32_t delay_ms = 5000);
```

#### Parameters

* `delay_ms`: Grace period in milliseconds before ban enforcement (allows the attacker to reveal more tooling before termination).

### `easyauth::is_honeypot_armed`

Checks whether the honeypot subsystem is currently armed and active.

```cpp
bool is_honeypot_armed();
```

## Summary Code Example

```cpp
#include "qPapelEasyAuth.h"
#include <iostream>

void SecurityRoutine() {
    // 1. Check overall protection health
    if (!easyauth::protection_check()) {
        std::cerr << "[-] Security check failed! Tampering detected.\n";
        exit(1);
    }

    // 2. Query individual detectors
    if (easyauth::is_debugger_detected()) {
        std::cerr << "[-] Debugger is attached!\n";
        exit(1);
    }

    if (easyauth::is_injection_detected()) {
        std::cerr << "[-] Unauthorized module injected!\n";
        exit(1);
    }

    if (easyauth::scan_network_hooks()) {
        std::cerr << "[-] Network packet sniffer hook detected!\n";
        exit(1);
    }
}
```