NtDebugActiveProcess

Prototype

NTSTATUS NtDebugActiveProcess(
  HANDLE ProcessHandle,
  HANDLE DebugObjectHandle
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 D6 00 00 00      mov eax, 0xD6
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Internally calls DbgkpSetProcessDebugObject, which walks the EPROCESS, checks that DebugPort is NULL, and atomically stores the DebugObject pointer. The NULL-check is the source of the single-debugger limitation: if a process is already being debugged (DebugPort != NULL) the call returns STATUS_PORT_ALREADY_SET (0xC0000048). Sending a NULL DebugObjectHandle (or one without DEBUG_PROCESS_ASSIGN) gives STATUS_INVALID_HANDLE / STATUS_ACCESS_DENIED. After attach, every primary action in the target (image load, thread create/exit, exception, breakpoint) is funneled through DbgkSendApiMessage into the DebugObject's event queue for the owning debugger to consume.

Common malware usage

Pair with NtCreateDebugObject for the classic self-debug anti-attach: the loader attaches its own PID to a DebugObject it owns, occupying the single allowed debug port. Sometimes the inverse is used: malware attaches an EDR or analyst-spawned debugger process to a fake DebugObject (very rare, requires PROCESS_ALL_ACCESS to the EDR — only seen in PoCs). Some loaders also attach a freshly spawned suspended child to a DebugObject so they can intercept exceptions raised by the child's unpacking stub — effectively a userland debugger driving their own protection scheme.

Detection opportunities

Microsoft-Windows-Threat-Intelligence ETW provider raises an event when a process is attached for debugging — EtwTiLogDebugActiveProcess. Defender for Endpoint, Elastic Endpoint Security and CrowdStrike Falcon all subscribe. The high-fidelity pivot is `parent_pid == child_pid` (self-debug) or `actor_image` not in a small allowlist of legitimate debuggers. Sysmon does not currently log this directly, but Sysmon ProcessAccess Event 10 with `GrantedAccess` containing PROCESS_SUSPEND_RESUME|PROCESS_CREATE_THREAD by a non-debugger image is a reasonable proxy when ETW is unavailable.

Direct syscall examples

// Plug-in to InstallSelfDebug() — see NtCreateDebugObject example.
// External DebugActiveProcess() against us now returns 0xC0000048.
typedef NTSTATUS(NTAPI* fnNtDebugActiveProcess)(HANDLE, HANDLE);

BOOL OccupyDebugPort(HANDLE hDebugObject) {
    HMODULE n = GetModuleHandleA("ntdll.dll");
    fnNtDebugActiveProcess pAttach = (fnNtDebugActiveProcess)
        GetProcAddress(n, "NtDebugActiveProcess");
    NTSTATUS s = pAttach((HANDLE)-1 /* current process */, hDebugObject);
    return s == 0; // anything else (incl. 0xC0000048) means a debugger beat us to it
}

; SSN 0xD6 on win11-24h2 / winserver-2025.
NtDebugActiveProcess PROC
    mov  r10, rcx
    mov  eax, 0D6h
    syscall
    ret
NtDebugActiveProcess ENDP

// If NtDebugActiveProcess returns STATUS_PORT_ALREADY_SET (0xC0000048),
// something is already debugging us — anti-debug check.
use std::ffi::c_void;
use windows_sys::Win32::System::LibraryLoader::{GetModuleHandleA, GetProcAddress};

type NtDebugActiveProcess = unsafe extern "system" fn(p: isize, d: isize) -> i32;

pub unsafe fn already_debugged(self_handle: isize, dbg: isize) -> bool {
    let n = GetModuleHandleA(b"ntdll.dll\0".as_ptr());
    let addr = GetProcAddress(n, b"NtDebugActiveProcess\0".as_ptr()).unwrap();
    let f: NtDebugActiveProcess = std::mem::transmute(addr);
    f(self_handle, dbg) as u32 == 0xC000_0048
}

fn _unused(_: *mut c_void) {}

MITRE ATT&CK mappings

• T1622Debugger Evasionmitre ↗
• T1106Native APImitre ↗