1. Список говнокодов пользователя PVOID

    Всего: 1

  2. C++ / Говнокод #28187

    0

    1. 01
    2. 02
    3. 03
    4. 04
    5. 05
    6. 06
    7. 07
    8. 08
    9. 09
    10. 10
    11. 11
    12. 12
    13. 13
    14. 14
    15. 15
    16. 16
    17. 17
    18. 18
    19. 19
    20. 20
    21. 21
    22. 22
    23. 23
    24. 24
    25. 25
    26. 26
    27. 27
    28. 28
    29. 29
    30. 30
    31. 31
    32. 32
    33. 33
    34. 34
    35. 35
    36. 36
    37. 37
    38. 38
    39. 39
    40. 40
    41. 41
    42. 42
    43. 43
    44. 44
    45. 45
    46. 46
    47. 47
    48. 48
    49. 49
    50. 50
    51. 51
    52. 52
    53. 53
    54. 54
    55. 55
    56. 56
    57. 57
    58. 58
    59. 59
    60. 60
    61. 61
    62. 62
    63. 63
    64. 64
    65. 65
    66. 66
    67. 67
    68. 68
    69. 69
    70. 70
    71. 71
    72. 72
    73. 73
    74. 74
    75. 75
    76. 76
    77. 77
    #define _CRT_SECURE_NO_WARNINGS
#pragma comment(lib, "ntdll.lib")

#include <Windows.h>
#include <string>

#define FLG_HEAP_ENABLE_TAIL_CHECK 0x10
#define FLG_HEAP_ENABLE_FREE_CHECK 0x20
#define FLG_HEAP_VALIDATE_PARAMETERS 0x40
#define NT_GLOBAL_FLAG_DEBUGGED (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)

typedef NTSTATUS(NTAPI* pfnNtSetInformationThread)(
	_In_ HANDLE	ThreadHandle,
	_In_ ULONG ThreadInformationClass,
	_In_ PVOID ThreadInformation,
	_In_ ULONG ThreadInformationLenght);

const ULONG ThreadHideFromDebugger = 0x11;

typedef NTSTATUS(NTAPI* pfnNtQueryInformationProcess)(
	_In_ HANDLE	ProcessHandle,
	_In_ ULONG ProcessInformationClass,
	_In_ PVOID ProcessInformation,
	_In_ ULONG ProcessInformationLenght,
	_Out_opt_ PULONG ReturnLenght);

const UINT ProcessDebugPort = 7;

void HideFromDebugger()
{
	HMODULE hNtDll = LoadLibrary("ntdll.dll");

	if (!hNtDll)
		throw std::exception("can't load kernel");

	pfnNtSetInformationThread NtSetInformatioThread = (pfnNtSetInformationThread)
		GetProcAddress(hNtDll, "NtSetInformationThread");

	NTSTATUS status = NtSetInformatioThread(GetCurrentThread(), ThreadHideFromDebugger, NULL, NULL);
}

PVOID GetPEB()
{
	return (PVOID)__readfsword(0x0C * sizeof(PVOID));
}

int main()
{
	pfnNtQueryInformationProcess NtQueryInformationProcess = nullptr;
	NTSTATUS status;
	DWORD IsDebuggerPresent = 0;
	HMODULE hNtDll = LoadLibrary("ntdll.dll");

	if (!hNtDll)
		throw std::exception("can't load kernel");
	
	NtQueryInformationProcess = (pfnNtQueryInformationProcess)GetProcAddress(hNtDll, "NtQueryInformationProcess");
	void HideFromDebugger();

	while (true)
	{
		PVOID pPEB = GetPEB();
		DWORD offsetNtGlobalFlag = 0x68;
		DWORD NtGlobalFlag = (DWORD)((PBYTE)pPEB + offsetNtGlobalFlag);

		NTSTATUS stat = NtQueryInformationProcess(GetCurrentProcess(), ProcessDebugPort,
			&IsDebuggerPresent, sizeof(DWORD), NULL);

		if ((NtGlobalFlag & NT_GLOBAL_FLAG_DEBUGGED) || (stat == 0x00000000 && IsDebuggerPresent != 0))
		{
			MessageBox(NULL, "Close your fucking debuger!", "FUCK YOU", MB_OK);
			return -1;
		}
	}

	return 0;
}

    PVOID, 23 Мая 2022

    Комментарии (26)