[SRC] isDebugged

[L]ord [R]NA · Junio 20, 2013, 02:09:40 AM

Función para verificar si un proceso esta siendo Debuggeado

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login

Código: cpp

#include <windows.h>
#include <winternl.h>


typedef NTSTATUS (WINAPI *NtQueryInformationProc)(HANDLE, PROCESSINFOCLASS,PVOID,ULONG,PULONG);

bool isDebugged(HANDLE ProcessHandle)
{
	PVOID deb = 0;
	NTSTATUS status;

	NtQueryInformationProc NtQueryInfo = (NtQueryInformationProc)GetProcAddress(LoadLibraryA("ntdll.dll"),"NtQueryInformationProcess");

	status = NtQueryInfo(ProcessHandle,
					(PROCESSINFOCLASS)7, //ProcessDebugPort
					&deb,
					sizeof(DWORD),
					NULL);

	if (status == STATUS_WAIT_0)
		return (deb == 0);
	else 
		return false;		  

}

[SRC] isDebugged

[L]ord [R]NA

Junio 20, 2013, 02:09:40 AM Ultima modificación: Junio 20, 2013, 02:18:32 AM por [L]ord [R]NA