ProcessInstrumentationCallback

//http://waleedassar.blogspot.com/
//http://www.twitter.com/waleedassar

//Certain information classes of the "ZwSetInformationProcess" function requires
// the "SeDebugPrivilege" privilege. If the caller's thread does not have this
//privilege, an error (0xC0000061) STATUS_PRIVILEGE_NOT_HELD is returned.
//OllyDbg has that privilege and passes it to its child processes i.e. debuggees.
//Thus, this information class can be used as an anti-debug trick. If 0xC0000061
//is not returned, then a debugger is present.

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"

#define ProcessInstrumentationCallback 0x28

extern "C"
{
    int __stdcall ZwSetInformationProcess(HANDLE,unsigned long,unsigned long*,unsigned long);
}

int main()
{
    unsigned long PebAddress=0;
    unsigned long Value=0xCECEFEFE;
    int ret=ZwSetInformationProcess(GetCurrentProcess(),ProcessInstrumentationCallback,&Value,0x4);
    if(ret>=0)
    {
        __asm
        {
            mov eax,dword ptr fs:[0x30]
            mov PebAddress,eax
        }
        PebAddress+=0x254;
        if(*(unsigned long*)PebAddress==0xCECEFEFE) printf("Being debugged\r\n");
    }
    else if(ret==0xC0000061) printf("Expected\r\n");
    return 0;
}


//N.B. Also the "ProcessBreakOnTermination" information class requires this privilege. Nasty?!