waliedassar

GetWriteWatch Trick

Jun 30th, 2014
354
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. //GetWriteWatch Anti-SoftwareBP trick.
  2. #include "stdafx.h"
  3. #include "windows.h"
  4.  
  5.  
  6.  
  7. #define MEM_WRITE_WATCH 0x00200000
  8.  
  9. extern "C"
  10. {
  11.     int __stdcall GetWriteWatch(unsigned long,void*,unsigned long,void*,void*,unsigned long*);
  12.     int __stdcall ResetWriteWatch(void*,unsigned long);
  13. }
  14.  
  15. //This code is just for demostration, it represents nothing new
  16. char codee[]="\xE8\x00\x00\x00\x00\x5B\x8D\x5B\x31\x53\x64\xFF\x35\x00\x00\x00\x00\x64\x89\x25\x00\x00\x00\x00"
  17.              "\x90\x9C\xCC\x9D\x9C\xCC\x9D\x9C\xCC\x9D\x9C\xCC\x9D\x9C\xCC\x9D"
  18.              "\x64\x8F\x05\x00\x00\x00\x00\x58"
  19.              "\xE8\x0E\x00\x00\x00\xC3\x8B\x5C\x24\x0C\xFF\x83\xB8\x00\x00\x00\x33\xC0\xC3\x90"
  20.              "\x81\xC3\x9C\x00\x00\x00\x53\x64\xFF\x35\x00\x00\x00\x00\x64\x89\x25\x00\x00\x00\x00\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0"
  21.              "\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xF1\xF0"
  22.              "\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0"
  23.              "\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0"
  24.              "\xF1\xF0\xF1\xF0\xF1"
  25.              "\x64\x8F\x05\x00\x00\x00\x00\x58\xC3"
  26.              "\x8B\x5C\x24\x0C\xFF\x83\xB8\x00\x00\x00\xFF\x83\xB8\x00\x00\x00\x33\xC0\xC3";
  27.  
  28.  
  29.  
  30. int main(int argc, char* argv[])
  31. {
  32.     char* p=(char*)VirtualAlloc(0,0x2000,MEM_COMMIT|MEM_RESERVE|MEM_WRITE_WATCH,PAGE_EXECUTE_READWRITE);
  33.     if(p)
  34.     {
  35.         memcpy(p,codee,sizeof(codee));
  36.         ResetWriteWatch(p,0x2000);
  37.  
  38.         unsigned long pageSize=0;
  39.         unsigned long size=0x400;    //0x400*4=0x1000
  40.         char* px=(char*)LocalAlloc(LMEM_ZEROINIT,0x1000);
  41.  
  42.         __asm
  43.         {
  44.             mov eax,p
  45.             call eax ;//Any modification (Write - TraceOver -StepOver- INT3 BPs) to this code will cause the following code to detect the debugger
  46.         }
  47.         if(!GetWriteWatch(0,p,0x2000,px,&size,&pageSize) && size)
  48.         {
  49.             MessageBox(0,"Being debugged","waliedassar",0);
  50.             ExitProcess(0);
  51.         }
  52.         else MessageBox(0,"Okay","waliedassar",0);
  53.     }
  54.     return 0;
  55. }
RAW Paste Data