Proposals / #1519

Mac CRASHY_IsDebuggerAttached: BOOL __cdecl (void)

checked · by KierTaylor · submitted 2026-11-08

It reads no register or stack args (only locals and the stack guard). It fills a kinfo_proc via sysctl 0x0030b45c (CTL_KERN/KERN_PROC/KERN_PROC_PID, size 0x1ec) and returns (p_flag >> 11) & 1, the P_TRACED bit, or 0 if sysctl fails (MOV EAX,ESI at 0x0000368f). Callers use it as a bool: isDebuggerPresent 0x000035d7 and CRASHY_InstallHandlers 0x00006b00.

Changes 1, applied together

1. Set prototype mac 0x000035f2

   signatureundefined CRASHY_IsDebuggerAttached(void)→BOOL CRASHY_IsDebuggerAttached(void)
   conventionunknown→__cdecl