Need a unique gift idea?
A Pastebin account makes a great Christmas gift
SHARE
TWEET

InstrumentationCallback Anti-Debug+Redirection

waliedassar Apr 19th, 2013 1,063 Never
Upgrade to PRO!
ENDING IN00days00hours00mins00secs
 
  1. //http://waleedassar.blogspot.com
  2. //https://twitter.com/waleedassar
  3. //Thanks to https://twitter.com/nickeverdox
  4. //------64-Bit---------------
  5. #define ProcessInstrumentationCallback 0x28
  6. extern "C"
  7. {
  8.             void DbgBreakPoint();
  9.         int __stdcall ZwSetInformationProcess(HANDLE,unsigned long long,unsigned long long*,unsigned long long);
  10. }
  11.  
  12. void* BeingDebugged()
  13. {
  14.         unsigned long long Cano= 0;
  15.     ZwSetInformationProcess(GetCurrentProcess(),ProcessInstrumentationCallback,&Cano,0x8);
  16.         MessageBox(0,L"Being Debugged\r\n",L"waliedassar",0);
  17.         ExitProcess(0);
  18. }
  19. int main()
  20. {
  21.         unsigned long long Cano= (unsigned long long)&BeingDebugged;
  22.         int ret=ZwSetInformationProcess(GetCurrentProcess(),ProcessInstrumentationCallback,&Cano,0x8);
  23.         if(ret==0xC0000061) printf("Expected\r\n");
  24.         return 0;
  25. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top