DebugActiveProcess(-1)

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar
//This code shows how to use the DebugActiveProcess(-1) as anti-stepping/anti-tracing trick.
//N.B. For fear to lose any unsaved work, don't use it on your production system since it freezes the whole system.

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"

struct UNICODE_STRING
{
    unsigned short len;        //length in bytes
    unsigned short max_len;    //length in bytes + 2 null zeros
    wchar_t* pStr;
};

struct OBJECT_ATTRIBUTES
{
  unsigned long      Length;
  HANDLE          RootDirectory;
  UNICODE_STRING* ObjectName;
  unsigned long           Attributes;
  void*           SecurityDescriptor;
  void*           SecurityQualityOfService;
};

extern "C"
{
    int __stdcall DebugActiveProcessStop(unsigned long);
    BOOL __stdcall DebugSetProcessKillOnExit(BOOL);
    int __stdcall ZwCreateDebugObject(void*,unsigned long,OBJECT_ATTRIBUTES*,BOOL);
    int __stdcall ZwClose(unsigned long);
    int __stdcall ZwDebugActiveProcess(unsigned long handle,unsigned long debugObject);
}

BOOL Debug()
{

    LUID X;
    if(!LookupPrivilegeValue(0,"SeDebugPrivilege",&X))
    {
           return FALSE;
    }
    HANDLE hToken;
    if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
    {
        return FALSE;
    }
    TOKEN_PRIVILEGES T={0};
    T.PrivilegeCount=1;
    T.Privileges[0].Luid=X;
    T.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;

    if(!AdjustTokenPrivileges(hToken,FALSE,&T,0,0,0) )
    {
        return FALSE;
    }
    return TRUE;
}

int main(int argc, char* argv[])
{
    unsigned long teb=0;
    __asm
    {
self:
      jmp self
    }
    Debug();
    DebugSetProcessKillOnExit(FALSE);

    unsigned long exception_code=0;
    unsigned long f=0;
    DEBUG_EVENT DE={0};
    if(DebugActiveProcess(-1))
    {
      while(9)
      {
        WaitForDebugEvent(&DE,0x32);
        switch(DE.dwDebugEventCode)
        {
        case CREATE_PROCESS_DEBUG_EVENT:
            f++;
            ContinueDebugEvent(DE.dwProcessId,DE.dwThreadId,DBG_CONTINUE);
            break;
        case CREATE_THREAD_DEBUG_EVENT:
            f++;
            ContinueDebugEvent(DE.dwProcessId,DE.dwThreadId,DBG_CONTINUE);
            break;
        case EXCEPTION_DEBUG_EVENT:
            f++;
            exception_code=DE.u.Exception.ExceptionRecord.ExceptionCode;
            ContinueDebugEvent(DE.dwProcessId,DE.dwThreadId,DBG_CONTINUE);
            break;
        default:
            ContinueDebugEvent(DE.dwProcessId,DE.dwThreadId,DBG_CONTINUE);
            break;
        }
        if(f>=3)
        {
              DebugActiveProcessStop(-1);
              break;
        }
      }
    }
    MessageBox(0,"Congrats","waliedassar",0);
    return 0;
}