Repository: ayoubfaouzi/al-khaser (language: cpp)

Issue:
Debugger Detection BUG
你好，我在github上发现了al-khaser，于是编译了一份进行了测试，但是al-khaser-[Debugger Detection]好像存在一些问题，因为我并没有使al-khaser处于调试状态，但是它的某些选项依旧显示了[BAD]。
很抱歉，我没有足够的专业知识，并且不会使用英语进行沟通交流，所以可能无法提供更多详细的详细，但是我觉得还是应该提交一个issues能够让你发现al-khaser存在一些问题，以便于及时修复它。
——————————————————————————————————————————————————————————
Hello, I found al khaser on github, so I compiled a copy for testing, but there seems to be some problems with al khaser - [Debugger Detection], because I did not make al khaser in debugging state, but some of its options still show [BAD].

I'm sorry, I don't have enough professional knowledge, and I can't communicate in English, so I may not be able to provide more details. But I think you should submit an issue to let you find some problems with al khaser, so that you can fix it in time.
———————————————————————————————————————————————————————————
[log.txt](https://github.com/LordNoteworthy/al-khaser/files/10201465/log.txt)
![1](https://user-images.githubusercontent.com/112924145/206885773-b82a76be-a616-4667-b8c8-96d6a6773855.jpg)




Discussion / hints:
Windows 10 X64
21H2
19044.2251
i5-11260H
al-khaser x86
`NtSystemDebugControl` seems to fail on some Windows builds with NTSTATUS `0xC0000002` (STATUS_NOT_IMPLEMENTED)

Fix patch:
diff --git a/al-khaser/AntiDebug/NtSystemDebugControl.cpp b/al-khaser/AntiDebug/NtSystemDebugControl.cpp
index ce7a5b3..792093e 100644
--- a/al-khaser/AntiDebug/NtSystemDebugControl.cpp
+++ b/al-khaser/AntiDebug/NtSystemDebugControl.cpp
@@ -7,7 +7,10 @@ BOOL NtSystemDebugControl_Command() {
 
 	const auto STATUS_DEBUGGER_INACTIVE = 0xC0000354L;
 	const auto STATUS_ACCESS_DENIED = 0xC0000022L;
-	if (status == STATUS_DEBUGGER_INACTIVE) {
+	const auto STATUS_NOT_IMPLEMENTED = 0xC0000002L;
+
+	// some windows build not supports SysDbgCheckLowMemory which returns 0xC0000002L
+	if (status == STATUS_DEBUGGER_INACTIVE || status == STATUS_NOT_IMPLEMENTED) {
 		return FALSE;
 	} else {
 		// kernel debugger found
@@ -16,4 +19,4 @@ BOOL NtSystemDebugControl_Command() {
 		}
 		return TRUE;
 	}
-}
\ No newline at end of file
+}


Test patch: