防OD附加的代码

bool InstallAntiAttach()
{
 HMODULE ntDll;
 void *pDbgUiRemoteBreakin; //函数头
 DWORD dwOldProtect;
 DWORD dwCodeSize;

 ntDll = GetModuleHandle("ntdll.dll");
 if (ntDll)
 {
  pDbgUiRemoteBreakin = GetProcAddress(ntDll,"DbgUiRemoteBreakin");
  if (pDbgUiRemoteBreakin)
  {
   __asm
   {
    //get code size
    lea eax,__CodeToCopyStart
    lea ecx,__CodeToCopyEnd
    sub ecx,eax
    mov dwCodeSize,ecx
   }
   //Make sure that we have write right
   if (VirtualProtect(pDbgUiRemoteBreakin,dwCodeSize,PAGE_EXECUTE_READWRITE,
    &dwOldProtect))
   {
    __asm
    {
     mov edi,pDbgUiRemoteBreakin
     lea esi,__CodeToCopyStart
     mov ecx,dwCodeSize
     rep movsb
     jmp __CodeEnd
    __CodeToCopyStart:
     lea eax,__CodeToCopyEnd
     jmp eax
    __CodeToCopyEnd:
    }
    __asm
    {
     xor eax,eax
     pushfd
     mov [esp],eax
     popfd
     xor ebx,ebx
     xor ecx,ecx
     xor edx,edx
     xor edi,edi
     xor esi,esi
     xor esp,esp
     xor ebp,ebp
     jmp eax
    }
   __CodeEnd:
    return true;
   }
  }
 }
 return false;
}

只是修改了 DbgUiRemoteBreakin这个函数的一些字节