Fix some processes not showing as being debugged
@@ -208,6 +208,32 @@ PhGetProcessIsBeingDebugged(
{
*IsBeingDebugged = !!debugPort;
}
+ else
+ {
+ HANDLE debugHandle;
+
+ // The ProcessDebugPort is only set by CsrCreateProcess when DEBUG_PROCESS is specified during process creation.
+ // Processes that are debugged at runtime (without the CreateProcess DEBUG_PROCESS flag) won't have a ProcessDebugPort and
+ // will instead only have the ProcessDebugObjectHandle and so we have to check both classes. (dmex)
+ status = NtQueryInformationProcess(
+ ProcessHandle,
+ ProcessDebugObjectHandle,
+ &debugHandle,
+ sizeof(HANDLE),
+ NULL
+ );
+
+ if (NT_SUCCESS(status))
+ {
+ *IsBeingDebugged = TRUE;
+ NtClose(debugHandle);
+ }
+ else if (status == STATUS_ACCESS_DENIED)
+ {
+ *IsBeingDebugged = TRUE;
+ status = STATUS_SUCCESS;
+ }
+ }
return status;
}
