DebuggerIs32Bit

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//As of the 64-bit versions of Windows, a new flag (0x4) has been introduced in the "_DEBUG_OBJECT" structure. This flag is set if the debugger is a 32-bit debugger. I prefer to call it DebuggerIs32Bit.

//For example,
//64-bit WinDbg debugging 32-bit calc.exe---> The flag is not set.
//32-bit WinDbg debugging 32-bit calc.exe---> The flag is set.


nt!NtCreateDebugObject+0xe8:
fffff800`036b7ce8 65488b042588010000 mov   rax,qword ptr gs:[188h] ;RAX is now _ETHREAD
fffff800`036b7cf1 488b4870           mov     rcx,qword ptr [rax+70h] ;RCX is now _EPROCESS
fffff800`036b7cf5 48399120030000     cmp     qword ptr [rcx+320h],rdx ; if(_EPROCESS->Wow64Process)
fffff800`036b7cfc 7405               je      nt!NtCreateDebugObject+0x103 (fffff800`036b7d03)

nt!NtCreateDebugObject+0xfe:
fffff800`036b7cfe 4183496004         or      dword ptr [r9+60h],4 ;Sets the DebuggerIs32Bit





typedef struct _DEBUG_OBJECT
{
       KEVENT EventsPresent;
       FAST_MUTEX Mutex;
       LIST_ENTRY EventList;
       union
       {
          ULONG Flags;
          struct
          {
              UCHAR DebuggerInactive:1;
              UCHAR KillProcessOnExit:1;
              UCHAR DebuggerIs32Bit:1; //The new flag
          };
       };
} DEBUG_OBJECT, *PDEBUG_OBJECT;