几种常见的反调试方法

#include <Windows.h>
#include <stdio.h>

BOOL IsDebug1()
{
   
	return IsDebuggerPresent();
}

BOOL IsDebug2()
{
   
	HANDLE hProcess = GetCurrentProcess();
	BOOL bDebug;
	if (0 == CheckRemoteDebuggerPresent(hProcess, &bDebug))
	{
   
		return TRUE;
	}
	return bDebug;
}

BOOL IsDebug3()
{
   
	HANDLE hProcess = GetCurrentProcess();
	HMODULE hDll = GetModuleHandleA("ntdll.dll");
	FARPROC NtQueryInformationProcess = GetProcAddress(hDll, "NtQueryInformationProcess");
	DWORD IsDebug;
	if (0 == ((ULONG  (WINAPI *)(HANDLE,DWORD,DWORD*,DWORD,DWORD))NtQueryInformationProcess)(hProcess,0x7, &IsDebug, 4, 0) &&
		IsDebug)
	{
   
		return TRUE;
	}
	return