Check if Current Process is Being Debugged in C

In low-level programming, it is sometimes useful to determine whether a process is currently under the control of a debugger. This information can assist with diagnostics, conditional logging, or altering runtime behavior during development. Operating systems expose different mechanisms to indicate whether a process is being debugged.

The C language itself does not provide a built-in function for debugger detection. Instead, platform-specific APIs or system interfaces must be used. Windows operating system offers a direct function for this purpose. On Unix-like systems such as Linux, debugger presence can be inferred by inspecting process status information exposed through the /proc filesystem.

The following example demonstrates a portable approach:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef _WIN32
#include <windows.h>

int is_being_debugged() {
    return IsDebuggerPresent();
}
#else
int is_being_debugged() {
    FILE *file = fopen("/proc/self/status", "r");
    if (!file) {
        return 0;
    }

    char line[256];
    int attached = 0;
    while (fgets(line, sizeof(line), file)) {
        if (strncmp(line, "TracerPid:", 10) == 0) {
            attached = strtol(line + 10, NULL, 10) != 0;
            break;
        }
    }
    fclose(file);

    return attached;
}
#endif

int main() {
    printf("%d", is_being_debugged());

    return 0;
}

This program defines a helper function that hides platform-specific details behind a single interface. On Windows, the function IsDebuggerPresent is used to determine whether the current process is being debugged. On Linux and other Unix-like systems, the program reads /proc/self/status, where the TracerPid field indicates whether another process is tracing the current one. A value of 0 means no debugger is attached, while a non-zero value represents the process ID of the debugger.