Jo Hyun-Suk evernick
evernick
/ FindWindow.cpp
Created
June 18, 2015 08:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <windows.h> | |
| #include <stdio.h> | |
| BOOL anti_debug() | |
| { | |
| BOOL result = FALSE; | |
| if(FindWindow("OLLYDBG", 0) || FindWindow("WinDbgFrameClass", 0)) | |
| result = TRUE; | |
| return result; | |
| } |
evernick
/ OutputDebugString.cpp
Created
June 18, 2015 08:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <windows.h> | |
| #include <stdio.h> | |
| BOOL anti_debug() | |
| { | |
| DWORD Val = 123; | |
| SetLastError(Val); | |
| OutputDebugString(L"random"); | |
| if(GetLastError() == Val) { | |
| return 1; |
evernick
/ Registry.cpp
Created
June 18, 2015 08:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <windows.h> | |
| #include <stdio.h> | |
| BOOL anti_debug() | |
| { | |
| BOOL result = FALSE; | |
| HKEY hKey; | |
| char lpData[256]; | |
| DWORD lpSize = sizeof(lpData); |
evernick
/ OllyDbgFilenameFormatString.cpp
Created
June 18, 2015 08:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <windows.h> | |
| #include <stdio.h> | |
| BOOL anti_debug() | |
| { | |
| TCHAR pathname[512]; | |
| TCHAR * filename; | |
| GetModuleFileName(0, pathname, 512); | |
| filename = wcsrchr(pathname, L'\\'); | |
| if (wcsncmp(filename, L"\\%s%s.exe", 10) == 0) { |
evernick
/ OllyDbgOutputDebugStringBug.cpp
Created
June 18, 2015 08:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <windows.h> | |
| #include <stdio.h> | |
| BOOL anti_debug() | |
| { | |
| DWORD Val = 123; | |
| SetLastError(Val); | |
| OutputDebugString(L"%s%s%s%s%s%s%s%s"); | |
| if(GetLastError() == Val) { | |
| return 1; |
evernick
/ ZwSetInformationThread.cpp
Created
June 18, 2015 08:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include<windows.h> | |
| #include<stdio.h> | |
| typedef DWORD (WINAPI *PFZWSETINFORMATIONTHREAD) ( | |
| HANDLE ThreadHandle, | |
| DWORD ThreadInformationClass, // Original : _THREAD_INFORMATION_CLASS | |
| PVOID ThreadInformation, | |
| ULONG ThreadInformationLength | |
| ); |
evernick
/ ZwQueryInformationProcess_ProcessDebugPort.cpp
Created
June 18, 2015 08:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include<windows.h> | |
| #include<stdio.h> | |
| typedef DWORD (WINAPI *PFZWQUERYINFORMATIONPROCESS) ( | |
| HANDLE ProcessHandle, | |
| DWORD ProcessInformationClass, // Origianl : _PROCESS_INFORMATION_CLASS | |
| PVOID ProcessInformation, | |
| ULONG ProcessInformationLength, | |
| PULONG ReturnLength | |
| ); |
evernick
/ OllyDbgStaticString.cpp
Created
June 18, 2015 08:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <windows.h> | |
| #include <stdio.h> | |
| #include <psapi.h> | |
| #pragma comment(lib, "psapi.lib") | |
| BOOL anti_debug() | |
| { | |
| DWORD All_process[1024], cb, process_cnt, value; | |
| int read; | |
| unsigned int i; |
evernick
/ ZwQueryInformationProcess_ProcessDebugObjectHandle.cpp
Created
June 18, 2015 08:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include<windows.h> | |
| #include<stdio.h> | |
| typedef DWORD (WINAPI *PFZWQUERYINFORMATIONPROCESS) ( | |
| HANDLE ProcessHandle, | |
| DWORD ProcessInformationClass, // Origianl : _PROCESS_INFORMATION_CLASS | |
| PVOID ProcessInformation, | |
| ULONG ProcessInformationLength, | |
| PULONG ReturnLength | |
| ); |
evernick
/ ZwQueryInformationProcess_ProcessDebugFlags.cpp
Created
June 18, 2015 08:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include<windows.h> | |
| #include<stdio.h> | |
| typedef DWORD (WINAPI *PFZWQUERYINFORMATIONPROCESS) ( | |
| HANDLE ProcessHandle, | |
| DWORD ProcessInformationClass, // Origianl : _PROCESS_INFORMATION_CLASS | |
| PVOID ProcessInformation, | |
| ULONG ProcessInformationLength, | |
| PULONG ReturnLength |