spnow’s gists

spnow / OllyDbgFilenameFormatString.cpp

Created August 1, 2017 23:13 — forked from evernick/OllyDbgFilenameFormatString.cpp

	#include <windows.h>
	#include <stdio.h>

	BOOL anti_debug()
	{
	TCHAR pathname[512];
	TCHAR * filename;
	GetModuleFileName(0, pathname, 512);
	filename = wcsrchr(pathname, L'\\');
	if (wcsncmp(filename, L"\\%s%s.exe", 10) == 0) {

spnow / OllyDbgOutputDebugStringBug.cpp

Created August 1, 2017 23:13 — forked from evernick/OllyDbgOutputDebugStringBug.cpp

	#include <windows.h>
	#include <stdio.h>

	BOOL anti_debug()
	{
	DWORD Val = 123;
	SetLastError(Val);
	OutputDebugString(L"%s%s%s%s%s%s%s%s");
	if(GetLastError() == Val) {
	return 1;

spnow / ZwSetInformationThread.cpp

Created August 1, 2017 23:12 — forked from evernick/ZwSetInformationThread.cpp

	#include<windows.h>
	#include<stdio.h>

	typedef DWORD (WINAPI *PFZWSETINFORMATIONTHREAD) (
	HANDLE ThreadHandle,
	DWORD ThreadInformationClass, // Original : _THREAD_INFORMATION_CLASS
	PVOID ThreadInformation,
	ULONG ThreadInformationLength
	);

spnow / ZwQueryInformationProcess_ProcessDebugPort.cpp

Created August 1, 2017 23:12 — forked from evernick/ZwQueryInformationProcess_ProcessDebugPort.cpp

	#include<windows.h>
	#include<stdio.h>

	typedef DWORD (WINAPI *PFZWQUERYINFORMATIONPROCESS) (
	HANDLE ProcessHandle,
	DWORD ProcessInformationClass, // Origianl : _PROCESS_INFORMATION_CLASS
	PVOID ProcessInformation,
	ULONG ProcessInformationLength,
	PULONG ReturnLength
	);

spnow / OllyDbgStaticString.cpp

Created August 1, 2017 23:12 — forked from evernick/OllyDbgStaticString.cpp

	#include <windows.h>
	#include <stdio.h>
	#include <psapi.h>
	#pragma comment(lib, "psapi.lib")

	BOOL anti_debug()
	{
	DWORD All_process[1024], cb, process_cnt, value;
	int read;
	unsigned int i;

spnow / ZwQueryInformationProcess_ProcessDebugObjectHandle.cpp

Created August 1, 2017 23:12 — forked from evernick/ZwQueryInformationProcess_ProcessDebugObjectHandle.cpp

	#include<windows.h>
	#include<stdio.h>

	typedef DWORD (WINAPI *PFZWQUERYINFORMATIONPROCESS) (
	HANDLE ProcessHandle,
	DWORD ProcessInformationClass, // Origianl : _PROCESS_INFORMATION_CLASS
	PVOID ProcessInformation,
	ULONG ProcessInformationLength,
	PULONG ReturnLength
	);

spnow / ZwQueryInformationProcess_ProcessDebugFlags.cpp

Created August 1, 2017 23:12 — forked from evernick/ZwQueryInformationProcess_ProcessDebugFlags.cpp


	#include<windows.h>
	#include<stdio.h>

	typedef DWORD (WINAPI *PFZWQUERYINFORMATIONPROCESS) (
	HANDLE ProcessHandle,
	DWORD ProcessInformationClass, // Origianl : _PROCESS_INFORMATION_CLASS
	PVOID ProcessInformation,
	ULONG ProcessInformationLength,
	PULONG ReturnLength

spnow / ParentProcess.cpp

Created August 1, 2017 23:11 — forked from evernick/ParentProcess.cpp

	#include <stdio.h>
	#include <windows.h>
	#include <tlhelp32.h>
	#include <psapi.h>

	#pragma comment(lib, "psapi.lib")

	int GetProcssName(DWORD PID, char *buff, int size)
	{
	int len = 0;

spnow / BlockInput.cpp

Created August 1, 2017 23:11 — forked from evernick/BlockInput.cpp

spnow / SelfDebugging_DebugActiveProcess.cpp

Created August 1, 2017 23:11 — forked from evernick/SelfDebugging_DebugActiveProcess.cpp