KdDebuggerEnabled

#include "stdafx.h"
#include "windows.h"


#pragma comment(linker,"/NODEFAULTLIB")
#pragma comment(linker,"/INCREMENTAL:NO")
#pragma comment(lib,"ntdll")
#pragma comment(linker,"/entry:main")


extern "C"
{
    int __stdcall ZwQuerySystemInformation(int,void*,unsigned long,int*);
}


int main(int argc, char* argv[])
{
    unsigned char* pSharedUserData=(unsigned char*)0x7FFE0000; //Always at the same address even on 64-bit and /3GB user address spaces
    if( *(pSharedUserData+0x2D4) )
    {
        MessageBox(0,"Kernel debugger is found","waliedassar",0);
        ExitProcess(0);
    }
    else
    {
        unsigned char px[0x2]={0};
        if(ZwQuerySystemInformation(0x23,&(px[0]),0x2,0)>=0)
        {
            if(px[0])
            {
                //You seem to have patched _KUSER_SHARED_DATA::KdDebuggerEnabled
                MessageBox(0,"Kernel debugger is found","waliedassar",0);
                ExitProcess(0);
            }
        }
    }
    return 0;
}