To detect if a user mode debugger is attached to your process, do the following steps:
- Allocate some memory with HeapAlloc.
- Write something to the allocated memory
- Free the allocation with HeapFree.
- Check if the pattern you’ve written is still present at the given address. If a debugger is attached, it is overwritten with a fixed pattern when HeapFree gets called.
This is probably because attaching a debugger activates the “debug mode” in the heap allocator.