NtSystemDebugControl + KdPitchDebugger

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//Using the "NtSystemDebugControl" function with the "ControlCode" parameter set to any value
//but 0x1D.
//If KdPitchDebugger is set to true (i.e. No Kernel Debugger is attached), then an error
// 0xC0000354 STATUS_DEBUGGER_INACTIVE is returned.
//On the other hand, if KdPitchDebugger is set to false, a check for the "SeDebugPrivilege"
//privilege is conducted, a sign of presence of Kernel and/or UserMode debugger(s).

extern "C"
{
    int __stdcall ZwSystemDebugControl(unsigned long ControlCode,
                                   void* InputBuffer,
                       unsigned long InputBufferLength,
                       void* OutputBuffer,
                       unsigned long OutputBufferLength,
                       unsigned long* pResultLength);
}


//Tested with Win7 - SP1
void main()
{
    unsigned long In=0;
    unsigned long Out;
    unsigned long Result;
    int retValue = ZwSystemDebugControl(0x6 /* Anything but 0x1D */,
                                        0,
                        0,
                        0,
                        0,
                        0);
    printf("return value is %x\r\n",retValue);
    if(retValue == 0xC0000354) printf("No Kernel Debugger\r\n");
    else
    {
        printf("Kernel Debugger present\r\n");
        if(retValue != 0xC0000022) printf("UserMode Debugger present as well\r\n");
    }
}