DebugActiveProcess(ParentProcessPid) Trick

//http://waleedassar.blogspot.com/
//http://www.twitter.com/waleedassar
//This code shows how to use the DebugActiveProcess(parent_process_pid)
//as anti-stepping/anti-tracing trick.
//N.B. For fear to lose any unsaved work, don't use it on your production system.

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"



typedef struct _PROCESS_BASIC_INFORMATION {
    unsigned long Reserved1;
    unsigned long PebBaseAddress;
    unsigned long Reserved2[2];
    unsigned long UniqueProcessId;
    unsigned long ParentProcessId;
}PROCESS_BASIC_INFORMATION;

extern "C"
{
    int __stdcall ZwQueryInformationProcess(HANDLE,unsigned long,PROCESS_BASIC_INFORMATION*,unsigned long,void*);
}

struct UNICODE_STRING
{
    unsigned short len;        //length in bytes
    unsigned short max_len;    //length in bytes + 2 null zeros
    wchar_t* pStr;
};

struct OBJECT_ATTRIBUTES
{
  unsigned long      Length;
  HANDLE          RootDirectory;
  UNICODE_STRING* ObjectName;
  unsigned long           Attributes;
  void*           SecurityDescriptor;
  void*           SecurityQualityOfService;
};

extern "C"
{
    int __stdcall DebugActiveProcessStop(unsigned long);
    BOOL __stdcall DebugSetProcessKillOnExit(BOOL);
    int __stdcall ZwCreateDebugObject(void*,unsigned long,OBJECT_ATTRIBUTES*,BOOL);
    int __stdcall ZwClose(unsigned long);
    int __stdcall ZwDebugActiveProcess(unsigned long handle,unsigned long debugObject);
}

BOOL Debug()
{

    LUID X;
    if(!LookupPrivilegeValue(0,"SeDebugPrivilege",&X))
    {
           return FALSE;
    }
    HANDLE hToken;
    if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
    {
        return FALSE;
    }
    TOKEN_PRIVILEGES T={0};
    T.PrivilegeCount=1;
    T.Privileges[0].Luid=X;
    T.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;

    if(!AdjustTokenPrivileges(hToken,FALSE,&T,0,0,0) )
    {
        return FALSE;
    }
    return TRUE;
}

int main(int argc, char* argv[])
{
    unsigned long teb=0;
    Debug(); //Acquire SeDebugPrivilege
    DebugSetProcessKillOnExit(FALSE); //Detach upon debugger exit.

    PROCESS_BASIC_INFORMATION PBI={0};
    int ret=ZwQueryInformationProcess(GetCurrentProcess(),0,&PBI,sizeof(PBI),0);
    if(ret<0) return 0;


    unsigned long exception_code=0;
    unsigned long f=0;
    DEBUG_EVENT DE={0};
    if(DebugActiveProcess(PBI.ParentProcessId))
    {
      while(9)
      {
        WaitForDebugEvent(&DE,0x32);
        switch(DE.dwDebugEventCode)
        {
        case CREATE_PROCESS_DEBUG_EVENT:
            f++;
            ContinueDebugEvent(DE.dwProcessId,DE.dwThreadId,DBG_CONTINUE);
            break;
        case CREATE_THREAD_DEBUG_EVENT:
            f++;
            ContinueDebugEvent(DE.dwProcessId,DE.dwThreadId,DBG_CONTINUE);
            break;
        case EXCEPTION_DEBUG_EVENT:
            f++;
            exception_code=DE.u.Exception.ExceptionRecord.ExceptionCode;
            ContinueDebugEvent(DE.dwProcessId,DE.dwThreadId,DBG_CONTINUE);
            break;
        default:
            ContinueDebugEvent(DE.dwProcessId,DE.dwThreadId,DBG_CONTINUE);
            break;
        }
        if(f>=3)
        {
              DebugActiveProcessStop(PBI.ParentProcessId);
              break;
        }
      }
    }
    MessageBox(0,"Congrats","waliedassar",0);
    ExitProcess(0);
    return 0;
}