反调试1

//用调试器载入并运行后，调试器会一片空白

#include <windows.h>
#define ThreadHideFromDebugger 17
typedef DWORD (WINAPI *ZW_SET_INFORMATION_THREAD)(HANDLE,DWORD,PVOID,ULONG);
int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
     // TODO: Place code here.
    HMODULE hDll = ::GetModuleHandleA("ntdll.dll");
    if (!hDll)
    {
        ::MessageBoxA(NULL,"GetModuleHandleA失败","错误",NULL);
        return 0;
    }
    ZW_SET_INFORMATION_THREAD ZwSetInformationThread = (ZW_SET_INFORMATION_THREAD)::GetProcAddress(hDll,"ZwSetInformationThread");
    if (!ZwSetInformationThread)
    {
        ::MessageBoxA(NULL,"ZwSetInformationThread获取失败","错误",NULL);
    }
    ZwSetInformationThread(::GetCurrentThread(),ThreadHideFromDebugger,0,0);
    ::MessageBoxA(NULL,"程序运行成功，没有调试器","",NULL);
    return 0;
}