反调试技术

#include <windows.h>
int APIENTRY WinMain(HINSTANCE hInstance,
	HINSTANCE hPrevInstance,
	LPSTR     lpCmdLine,
	int       nCmdShow)
{
	HMODULE hModule = GetModuleHandleW(L"ntdll.dll");
	if (!hModule)
	{
		MessageBox(NULL, "get module fail", "tips", NULL);
		return 0;
	}
	typedef DWORD(WINAPI *_SetInformationThread)
		(HANDLE, DWORD, PVOID, ULONG);
	_SetInformationThread MySetInformationThread = (_SetInformationThread)GetProcAddress(hModule, "ZwSetInformationThread");
	if (!MySetInformationThread)
	{
		MessageBox(NULL, "get func address fail", "tips", NULL);
		return 0;
	}
	//set 0x11
	MySetInformationThread(GetCurrentThread(), 0x11, 0, 0);
	MessageBox(NULL, "current safe....", "tips", NULL);
	return 0;
}

效果如图所示：