Underc0de

Programación General => C / C++ => Códigos Fuentes => Mensaje iniciado por: [L]ord [R]NA en Junio 20, 2013, 02:09:40 AM

Título: [SRC] isDebugged
Publicado por: [L]ord [R]NA en Junio 20, 2013, 02:09:40 AM
Función para verificar si un proceso esta siendo Debuggeado  8)

https://www.virustotal.com/en/file/fe9a1df641ed546c661c8f78cab485e6b0beeeae18262f0e30d3ba4ebf77cde2/analysis/1371705333/ (https://www.virustotal.com/en/file/fe9a1df641ed546c661c8f78cab485e6b0beeeae18262f0e30d3ba4ebf77cde2/analysis/1371705333/)

Código (cpp) [Seleccionar]
#include <windows.h>
#include <winternl.h>


typedef NTSTATUS (WINAPI *NtQueryInformationProc)(HANDLE, PROCESSINFOCLASS,PVOID,ULONG,PULONG);

bool isDebugged(HANDLE ProcessHandle)
{
PVOID deb = 0;
NTSTATUS status;

NtQueryInformationProc NtQueryInfo = (NtQueryInformationProc)GetProcAddress(LoadLibraryA("ntdll.dll"),"NtQueryInformationProcess");

status = NtQueryInfo(ProcessHandle,
(PROCESSINFOCLASS)7, //ProcessDebugPort
&deb,
sizeof(DWORD),
NULL);

if (status == STATUS_WAIT_0)
return (deb == 0);
else
return false;  

}