Determining if a Debugger is Attached
Kernel-mode code can determine the status of kernel debugging by using the following variables and routines:
The KD_DEBUGGER_ENABLED global kernel variable indicates whether kernel debugging is enabled.
The KD_DEBUGGER_NOT_PRESENT global kernel variable indicates whether a kernel debugger is currently attached.
The KdRefreshDebuggerNotPresent routine refreshes the value of KD_DEBUGGER_NOT_PRESENT.