anti-debug's Introduction

Hello im codepulze, self taught developer with 5 - 6 years experience, my stack is below.

All my projects are for educitional purpoeses and shouldnt have be abused

GitHub Profile Stats 💻

🎫 Coding Services SEND DM 🎫

https://t.me/codepulze
t.me/codepulze
discord: codpulze

github contribution grid snake animation

anti-debug's People

Stargazers

Watchers

anti-debug's Issues

C code won't compile in antidbgbetter

Tried porting the C code to a test.c file and compile it with gcc. Here are the errros.

antidbg.c:7:26: error: 'NtSetInformationThread' redeclared as different kind of symbol
    7 | typedef NTSTATUS(WINAPI *NtSetInformationThread)(IN HANDLE, IN THREADINFOCLASS, IN PVOID, IN ULONG);
      |                          ^~~~~~~~~~~~~~~~~~~~~~
In file included from antidbg.c:2:
C:/ProgramData/mingw64/mingw64/x86_64-w64-mingw32/include/winternl.h:1103:18: note: previous declaration of 'NtSetInformationThread' with type 'NTSTATUS(void *, THREADINFOCLASS,  void *, ULONG)' {aka 'long int(void *, THREADINFOCLASS,  void *, long unsigned int)'}
 1103 |   NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
      |                  ^~~~~~~~~~~~~~~~~~~~~~
antidbg.c: In function 'hehehidehthread':
antidbg.c:12:33: warning: comparison between pointer and integer
   12 |     if (pNtSetInformationThread != NULL)
      |                                 ^~
antidbg.c:15:9: error: called object 'pNtSetInformationThread' is not a function or function pointer
   15 |         pNtSetInformationThread(GetCurrentThread(), ThreadHideFromDebugger, NULL, 0);
      |         ^~~~~~~~~~~~~~~~~~~~~~~
antidbg.c:11:28: note: declared here
   11 |     NtSetInformationThread pNtSetInformationThread = (NtSetInformationThread)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtSetInformationThread");
      |                            ^~~~~~~~~~~~~~~~~~~~~~~
antidbg.c: At top level:
antidbg.c:54:11: warning: 'GetTickCount64' redeclared without dllimport attribute: previous dllimport ignored [-Wattributes]
   54 | ULONGLONG GetTickCount64();

The code I tried to compile is as following

#include <windows.h>
#include <winternl.h>
#include <process.h>

// C Part CODED BY MUZA

typedef NTSTATUS(WINAPI *NtSetInformationThread)(IN HANDLE, IN THREADINFOCLASS, IN PVOID, IN ULONG);

void hehehidehthread()
{
 NtSetInformationThread pNtSetInformationThread = (NtSetInformationThread)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtSetInformationThread");
 if (pNtSetInformationThread != NULL)
 {
     THREADINFOCLASS ThreadHideFromDebugger = (THREADINFOCLASS)0x11;
     pNtSetInformationThread(GetCurrentThread(), ThreadHideFromDebugger, NULL, 0);
 }
}
BOOL checksysreq()
{
 SYSTEM_INFO systemInfo;
 GetSystemInfo(&systemInfo);
 DWORD numberOfProcessors = systemInfo.dwNumberOfProcessors;
 if (numberOfProcessors < 2)
     return FALSE;

 MEMORYSTATUSEX memoryStatus;
 memoryStatus.dwLength = sizeof(memoryStatus);
 GlobalMemoryStatusEx(&memoryStatus);
 DWORD RAMMB = (DWORD)(memoryStatus.ullTotalPhys / (1024 * 1024));
 if (RAMMB < 2048)
     return FALSE;

 HANDLE hDevice = CreateFileW(L"\\\\.\\PhysicalDrive0", 0, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
 if (hDevice == INVALID_HANDLE_VALUE)
     return FALSE;

 DISK_GEOMETRY pDiskGeometry;
 DWORD bytesReturned;
 if (!DeviceIoControl(hDevice, IOCTL_DISK_GET_DRIVE_GEOMETRY, NULL, 0, &pDiskGeometry, sizeof(pDiskGeometry), &bytesReturned, (LPOVERLAPPED)NULL))
 {
     CloseHandle(hDevice);
     return FALSE;
 }

 DWORD diskSizeGB = (DWORD)(pDiskGeometry.Cylinders.QuadPart * (ULONG)pDiskGeometry.TracksPerCylinder * (ULONG)pDiskGeometry.SectorsPerTrack * (ULONG)pDiskGeometry.BytesPerSector / (1024 * 1024 * 1024));
 CloseHandle(hDevice);
 if (diskSizeGB < 100)
     return FALSE;

 return TRUE;
}

ULONGLONG GetTickCount64();