Saturday 3 | 02:37:AM
I am going to share a simple method for detecting whether your program (it may be viral code as well) is being debugged. Anti-debugging is an essential trick for survival of your malicious code.
Windows API provides a simple function isDebuggerPresent() but it can be bypassed too easily, and therefore should NOT be used. I will show you how to use Process Control Box to test debugging.
Process Control Box or PCB is a kernel level stuff, and therefore is accessible by Native API (not Win32 API). The following code shows how to do it. Code is self explanatory.
To use it in your code, simply call alert() function. You may want to modify it to return a value (true/false) instead of printing string.
Windows API provides a simple function isDebuggerPresent() but it can be bypassed too easily, and therefore should NOT be used. I will show you how to use Process Control Box to test debugging.
Process Control Box or PCB is a kernel level stuff, and therefore is accessible by Native API (not Win32 API). The following code shows how to do it. Code is self explanatory.
Code:
void alert()
{
typedef unsigned long (__stdcall *pfnNtQueryInformationProcess)(IN HANDLE, IN unsigned int, OUT PVOID, IN ULONG, OUT PULONG);
const int ProcessDbgPort = 7;
pfnNtQueryInformationProcess NtQueryInfoProcess = NULL;
unsigned long Ret;
unsigned long IsRemotePresent = 0;
HMODULE hNtDll = LoadLibrary(TEXT("ntdll.dll"));
if(hNtDll == NULL)
{
cout<<"\nFATAL ERROR!!!!\nPress any key to terminate....";
_getch();
exit(0);
}
NtQueryInfoProcess = (pfnNtQueryInformationProcess)
GetProcAddress(hNtDll, "NtQueryInformationProcess");
if(NtQueryInfoProcess == NULL)
{
cout<<"\nFATAL ERROR!!!!\nPress any key to terminate....";
_getch();
exit(0);
}
Ret = NtQueryInfoProcess(GetCurrentProcess(), ProcessDbgPort, &IsRemotePresent, sizeof(unsigned long), NULL);
if(Ret == 0x00000000 && IsRemotePresent != 0)
{
cout<<"\nClose your bloody debugger!!!\n";
}
else
{
cout<<"\nI am not being debugged...\n";
}
}To use it in your code, simply call alert() function. You may want to modify it to return a value (true/false) instead of printing string.
![[Image: zHUQ5w8.png]](https://i.imgur.com/zHUQ5w8.png)
![[Image: u1WxV4y.png]](https://i.imgur.com/u1WxV4y.png)
![[Image: JbpXowl.png]](https://i.imgur.com/JbpXowl.png)
WesternUnion Tracking link: https://cardingmafia.to/misc.php?page=wu-trackingemail: [email protected]
