反调试（未完工）

bool FD_CheckRemoteDebuggerPresent()
{
DWORD pFuncAddr ;
HMODULE hDllHandle = GetModuleHandle(“kernel32.dll”);
if (INVALID_HANDLE_VALUE==hDllHandle)
return;
(DWORD&) pFuncAddr = GetProcAddress(hDllHandle, “CheckRemoteDebuggerPresent”);
if (pFuncAddr != NULL)
{
__asm
{
push eax;
push esp;
//hProcess
push 0xffffffff;
call pFuncAddr;
//error？
test eax,eax;
//error!
je rf_label;
//no error
pop eax;
test eax,eax
je rf_label;
}
return true;
rf_label:
return false;
}
}

bool FD_NtQueryInfoProc_DbgPort()
{
DWORD pFuncAddr ;
HMODULE hDllHandle = GetModuleHandle(“ntdll.dll”);
if (INVALID_HANDLE_VALUE==hDllHandle)
return;
(DWORD&) pFuncAddr = GetProcAddress(hDllHandle, “ZWQueryInformationProcess”);
if (pFuncAddr != NULL)
{
__asm{
push 0
push 4 ;ProcessInformationLength
push eax;ProcessInformation
push esp
push 7;ProcessDebugPort
push 0xffffffff ;ProcessHandle
call NtQueryInformationProcess
test eax,eax;
//error!
je rf_label;
//no error
pop eax;
test eax,eax
je rf_label;
}
return true;//正在被调试
rf_label:
return false;
}
}

//2.9