# V2 Anti-Debugging Detection

V2 anti-debugging detection is a protected-build release contract for shipping
clients. It defines which debugger-presence signals are allowed, how timing
based detection is sampled, how hardware breakpoint scanning is represented as
release evidence, and how the game responds without crashing the player.

## Signal Families

The manifest covers three signal families on `Win64-Shipping`, `Linux-Shipping`,
and `Mac-Shipping`:

- platform debugger presence, including the Win64 `IsDebuggerPresent` label
- timing-based detection
- hardware breakpoint scanning

These are configured through `V2/ue/Build/DRM/v2-anti-debugging-detection.json`.
The manifest is deliberately descriptive; this repository does not add low-level
debugger-detection code.

## Response Policy

Anti-debugging detection must be evidence-oriented. A detection enters safe-boot
offline-only mode, emits structured telemetry for review, and does not crash the
process. The response is `do not crash`, with manual review before penalty and
support override allowed. The response label is `safe-boot offline-only`.

This layer does not perform process scanning, driver inspection, kernel-driver
loading, or anti-cheat sanctions. Those are separate tasks and require their own
privacy and security review.

## CI Gates

`V2/ue/Tools/plan-v2-anti-debugging-detection.py` emits the deterministic
anti-debugging detection plan.
`V2/ue/Tools/check-v2-anti-debugging-detection.py` validates the manifest,
planner output, code-virtualization dependency, Horde wiring, CI workflow
wiring, and this runbook.

Required release gates:

- `drm-anti-debugging-plan-generated`
- `drm-anti-debugging-platform-coverage`
- `drm-anti-debugging-signal-family-coverage`
- `drm-anti-debugging-safe-response`
- `drm-anti-debugging-false-positive-guardrails`

The `drm-anti-debugging-false-positive-guardrails` gate requires safe response,
manual review before penalty, support override, and a false-positive budget for
every shipping desktop profile.