ThreadHideFromDebugger技术
#include <stdio.h>
#include <windows.h>
#include <tchar.h>
typedef DWORD (WINAPI *ZW_SET_INFORMATION_THREAD)(HANDLE, DWORD, PVOID, ULONG);
#define ThreadHideFromDebugger 17
VOID DisableDebugEvent(VOID)
{
HINSTANCE hModule;
ZW_SET_INFORMATION_THREAD ZwSetInformationThread;
hModule = GetModuleHandleA("Ntdll");
ZwSetInformationThread =
(ZW_SET_INFORMATION_THREAD)GetProcAddress(hModule, "ZwSetInformationThread");
ZwSetInformationThread(GetCurrentThread(), ThreadHideFromDebugger, NULL, NULL);
}
int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,
PSTR szCmdLine, int iCmdShow)
{
DisableDebugEvent();
return 0 ;
}
也可以使用汇编，不依赖于任何获取地址的函数
//code by shoooo
push 0
push 0
push 11
push -2
mov eax, 0C7
mov edx, esp
int 2E
mov eax, 0E5
mov edx, esp
int 2E
mov eax, 0EE
mov edx, esp
int 2E
mov eax, 136
mov edx, esp
int 2E
add esp, 10
