- 01
- 02
- 03
- 04
- 05
- 06
- 07
- 08
- 09
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
#define _CRT_SECURE_NO_WARNINGS
#pragma comment(lib, "ntdll.lib")
#include <Windows.h>
#include <string>
#define FLG_HEAP_ENABLE_TAIL_CHECK 0x10
#define FLG_HEAP_ENABLE_FREE_CHECK 0x20
#define FLG_HEAP_VALIDATE_PARAMETERS 0x40
#define NT_GLOBAL_FLAG_DEBUGGED (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)
typedef NTSTATUS(NTAPI* pfnNtSetInformationThread)(
_In_ HANDLE ThreadHandle,
_In_ ULONG ThreadInformationClass,
_In_ PVOID ThreadInformation,
_In_ ULONG ThreadInformationLenght);
const ULONG ThreadHideFromDebugger = 0x11;
typedef NTSTATUS(NTAPI* pfnNtQueryInformationProcess)(
_In_ HANDLE ProcessHandle,
_In_ ULONG ProcessInformationClass,
_In_ PVOID ProcessInformation,
_In_ ULONG ProcessInformationLenght,
_Out_opt_ PULONG ReturnLenght);
const UINT ProcessDebugPort = 7;
void HideFromDebugger()
{
HMODULE hNtDll = LoadLibrary("ntdll.dll");
if (!hNtDll)
throw std::exception("can't load kernel");
pfnNtSetInformationThread NtSetInformatioThread = (pfnNtSetInformationThread)
GetProcAddress(hNtDll, "NtSetInformationThread");
NTSTATUS status = NtSetInformatioThread(GetCurrentThread(), ThreadHideFromDebugger, NULL, NULL);
}
PVOID GetPEB()
{
return (PVOID)__readfsword(0x0C * sizeof(PVOID));
}
int main()
{
pfnNtQueryInformationProcess NtQueryInformationProcess = nullptr;
NTSTATUS status;
DWORD IsDebuggerPresent = 0;
HMODULE hNtDll = LoadLibrary("ntdll.dll");
if (!hNtDll)
throw std::exception("can't load kernel");
NtQueryInformationProcess = (pfnNtQueryInformationProcess)GetProcAddress(hNtDll, "NtQueryInformationProcess");
void HideFromDebugger();
while (true)
{
PVOID pPEB = GetPEB();
DWORD offsetNtGlobalFlag = 0x68;
DWORD NtGlobalFlag = (DWORD)((PBYTE)pPEB + offsetNtGlobalFlag);
NTSTATUS stat = NtQueryInformationProcess(GetCurrentProcess(), ProcessDebugPort,
&IsDebuggerPresent, sizeof(DWORD), NULL);
if ((NtGlobalFlag & NT_GLOBAL_FLAG_DEBUGGED) || (stat == 0x00000000 && IsDebuggerPresent != 0))
{
MessageBox(NULL, "Close your fucking debuger!", "FUCK YOU", MB_OK);
return -1;
}
}
return 0;
}