Anti-ChildDebugging

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar
//The following code prevents the debugger e.g. WinDbg or OllyDbg v2.x from catching
//the child process and debugging it.
#include "stdafx.h"
#include "windows.h"
#include "stdio.h"

#define ProcessDebugFlags 0x1F

extern "C"
{
int __stdcall ZwSetInformationProcess(HANDLE,unsigned long,unsigned long*,unsigned long);
}


int main(int argc, char* argv[])
{
    //The following call cause the "NoDebugInherit" bit of the _EPROCESS structure to be set to 1.
    unsigned long value=0x0; //This value will be inversed and stored in NoDebugInherit.
    int ret=ZwSetInformationProcess(GetCurrentProcess(),ProcessDebugFlags,&value,0x4);
    if(ret>=0)
    {
        STARTUPINFO SI={sizeof(SI)};
        PROCESS_INFORMATION PI;
        if(!CreateProcess(0,"calc.exe",0,0,TRUE,0,0,0,&SI,&PI)) return 0;
        while(1) Sleep(1000);
    }
    return 0;
}