Additional PEB.BeingDebugged Check

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar
#include "stdafx.h"
#include "windows.h"
#include "iostream.h"


int main(int argc, char* argv[])
{
    unsigned long IsWow64=0;
    unsigned char BeingDebugged32=0;
    unsigned char BeingDebugged64=0;
    //--------The old check-----------------------
    __asm
    {
        pushad
        mov eax,dword ptr fs:[0xC0]
        mov IsWow64,eax
        mov eax,dword ptr fs:[0x30]
        mov al,byte ptr[eax+0x2]
        mov BeingDebugged32,al
        popad
    }
    if(BeingDebugged32)
    {
        cout<<"Being debugged.."<<endl; exit(0);
    }
    if(IsWow64)
    {
        __asm
        {
            pushad
            mov eax, dword ptr fs:[0x18]
            sub eax,0x2000 ;64bit TEB precedes 32bit TEB by 2 pages
            mov eax, dword ptr[eax+0x60] ;;At offset 0x60 you can find pointer to 64bit PEB
            mov al,byte ptr[eax+0x2]
            mov BeingDebugged64,al
            popad
        }
        if(BeingDebugged64)
        {
            cout<<"Being debugged..."<<endl; exit(0);
        }
    }
    return 0;
}