ThreadHideFromDebugger技术

#include <stdio.h> 
#include <windows.h>
#include <tchar.h>

typedef DWORD (WINAPI *ZW_SET_INFORMATION_THREAD)(HANDLE, DWORD, PVOID, ULONG);
#define ThreadHideFromDebugger 17
VOID DisableDebugEvent(VOID)
{
    HINSTANCE hModule;
    ZW_SET_INFORMATION_THREAD ZwSetInformationThread;

    hModule = GetModuleHandleA("Ntdll");
    ZwSetInformationThread = 
        (ZW_SET_INFORMATION_THREAD)GetProcAddress(hModule, "ZwSetInformationThread");
    ZwSetInformationThread(GetCurrentThread(), ThreadHideFromDebugger, NULL, NULL);
}

int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,
                    PSTR szCmdLine, int iCmdShow)
{
DisableDebugEvent();
     return 0 ;
}

也可以使用汇编，不依赖于任何获取地址的函数

//code by shoooo
push    0
push    0
push    11
push    -2
mov     eax, 0C7
mov     edx, esp
int     2E
mov     eax, 0E5
mov     edx, esp
int     2E
mov     eax, 0EE
mov     edx, esp
int     2E
mov     eax, 136
mov     edx, esp
int     2E
add     esp, 10