反调试 - WUDFPlatform.dll 导出函数

在 C:\Windows\System32 目录下有一个 WUDFPlatform.dll ， 这个 dll 中有三个导出函数 —— WudfIsAnyDebuggerPresent，WudfIsKernelDebuggerPresent，WudfIsUserDebuggerPresent：
代码示例：

// Test_Console_1.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//

#include <iostream>
#include <Windows.h>

using namespace std;

typedef INT(NTAPI* pWudfIsAnyDebuggerPresent)();
typedef INT(NTAPI* pWudfIsKernelDebuggerPresent)();
typedef INT(NTAPI* pWudfIsUserDebuggerPresent)();

int main()
{
    HMODULE h_wudf = LoadLibrary(L"WUDFPlatform.dll");
    if (h_wudf == NULL) {
        cout << "WUDFPlatform.dll LoadLibrary failed." << endl;
        goto main_end;
    }

    // WudfIsAnyDebuggerPresent
    pWudfIsAnyDebuggerPresent WudfIsAnyDebuggerPresent = (pWudfIsAnyDebuggerPresent)GetProcAddress(h_wudf, "WudfIsAnyDebuggerPresent");
    if (WudfIsAnyDebuggerPresent == NULL) {
        cout << "WudfIsAnyDebuggerPresent GetProcAddress failed." << endl;
        goto main_end;
    }
    if (WudfIsAnyDebuggerPresent() != 0) {
        cout << "WudfIsAnyDebuggerPresent 发现调试器" << endl;
    }
    
    // WudfIsKernelDebuggerPresent
    pWudfIsKernelDebuggerPresent WudfIsKernelDebuggerPresent = (pWudfIsKernelDebuggerPresent)GetProcAddress(h_wudf, "WudfIsKernelDebuggerPresent");
    if (WudfIsKernelDebuggerPresent == NULL) {
        cout << "WudfIsKernelDebuggerPresent GetProcAddress failed." << endl;
        goto main_end;
    }
    if (WudfIsKernelDebuggerPresent() != 0) {
        cout << "WudfIsKernelDebuggerPresent 发现调试器" << endl;
    }

    // pWudfIsUserDebuggerPresent
    pWudfIsUserDebuggerPresent WudfIsUserDebuggerPresent = (pWudfIsUserDebuggerPresent)GetProcAddress(h_wudf, "WudfIsUserDebuggerPresent");
    if (WudfIsUserDebuggerPresent == NULL) {
        cout << "WudfIsUserDebuggerPresent GetProcAddress failed." << endl;
        goto main_end;
    }
    if (WudfIsUserDebuggerPresent() != 0) {
        cout << "WudfIsUserDebuggerPresent 发现调试器" << endl;
    }

main_end:
    getchar();
    return 0;
}

效果图：
（1）正常情况下运行

（2）使用 VS 调试运行

（3） 放在双机调试的虚拟机里运行

特别注意，该功能只支持 x64程序