Advertisement
waliedassar

InstrumentationCallback Anti-Debug+Redirection

Apr 19th, 2013
2,528
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 0.82 KB | None | 0 0
  1. //http://waleedassar.blogspot.com
  2. //https://twitter.com/waleedassar
  3. //Thanks to https://twitter.com/nickeverdox
  4. //------64-Bit---------------
  5. #define ProcessInstrumentationCallback 0x28
  6. extern "C"
  7. {
  8.         void DbgBreakPoint();
  9.         int __stdcall ZwSetInformationProcess(HANDLE,unsigned long long,unsigned long long*,unsigned long long);
  10. }
  11.  
  12. void* BeingDebugged()
  13. {
  14.     unsigned long long Cano= 0;
  15.     ZwSetInformationProcess(GetCurrentProcess(),ProcessInstrumentationCallback,&Cano,0x8);
  16.     MessageBox(0,L"Being Debugged\r\n",L"waliedassar",0);
  17.     ExitProcess(0);
  18. }
  19. int main()
  20. {
  21.         unsigned long long Cano= (unsigned long long)&BeingDebugged;
  22.         int ret=ZwSetInformationProcess(GetCurrentProcess(),ProcessInstrumentationCallback,&Cano,0x8);
  23.         if(ret==0xC0000061) printf("Expected\r\n");
  24.         return 0;
  25. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement