Wow64-Specific Anti-Debug Trick

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//A Wow64-specific anti-debug trick. This trick detects 32-bit debuggers. To bypass this trick you have
//to use a 64-bit debuggers e.g. 64-bit WinDbg.

#include "stdafx.h"
#include "windows.h"

extern "C"
{
    int __stdcall DbgPrompt(unsigned char*,unsigned char*,unsigned long);
}

int __cdecl Handler(EXCEPTION_RECORD* pRec,void* est_frame,unsigned char* pContext,void* disp)
{
    MessageBox(0,"No 32-bit debugger attached","waliedassar",0);
    ExitProcess(0);
    return ExceptionContinueExecution;
}

int main(int argc, char* argv[])
{
    __asm
    {
        push offset Handler
        push dword ptr fs:[0x0]
        mov dword ptr fs:[0],esp
    }
    unsigned char* resp=(unsigned char*)LocalAlloc(LMEM_ZEROINIT,0x100);
    DbgPrompt((unsigned char*)"waliedassar",resp,0x100);
    MessageBox(0,"32-bit debugger detected","waliedassar",0);
    return 0;
}