OdbgScript for anti-analysis

VAR remotedebugger
VAR is_debugger_present
VAR create_toolhelp
VAR nt_query_info_process


GPA "CheckRemoteDebuggerPresent", "kernel32"
MOV remotedebugger, $RESULT


GPA "IsDebuggerPresent", "kernel32"
MOV is_debugger_present, $RESULT

GPA "CreateToolhelp32Snapshot", "kernel32"
MOV create_toolhelp, $RESULT

GPA "NtQueryInformationProcess", "ntdll"
MOV nt_query_info_process, $RESULT


CMP remotedebugger, 0
JE api_not_found
BP remotedebugger
CMT remotedebugger, "CheckRemoteDebuggerPresent"

CMP is_debugger_present, 0
JE api_not_found
BP is_debugger_present
CMT is_debugger_present, "IsDebuggerPresent"

CMP create_toolhelp, 0
JE api_not_found
BP create_toolhelp
CMT create_toolhelp, "CreateToolhelp32Snapshot"

CMP nt_query_info_process, 0
JE api_not_found
BP nt_query_info_process
CMT nt_query_info_process, "NtQueryInformationProcess"

MSG "All APIs have been located and broken on"

JMP the_end
api_not_found:
MSG "There was a problem finding one or more APIs, check the breakpoint list"

the_end:
RET