메뉴 닫기

[VB6] Anti Attach

Option Explicit
Private Declare Sub RtlMoveMemory Lib "kernel32.dll" (ByRef Destination As Any, ByRef Source As Any, ByVal Length As Long)
Private Declare Function GetProcAddress Lib "kernel32.dll" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function GetModuleHandle Lib "kernel32.dll" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
Private Declare Function VirtualProtect Lib "kernel32.dll" (ByRef lpAddress As Any, ByVal dwSize As Long, ByVal flNewProtect As Long, ByRef lpflOldProtect As Long) As Long
Private Const PAGE_EXECUTE_READWRITE As Long = &H40

Private Sub Form_Load()
Dim Tmp2(6) As Byte, Tmp As Long: Tmp2(0) = &H68: Tmp2(5) = &HC3
Dim Addr As Long, Addr2 As Long
Addr = GetProcAddress(GetModuleHandle("ntdll.dll"), "DbgUiRemoteBreakin")
Addr2 = GetProcAddress(GetModuleHandle("kernel32.dll"), "ExitProcess")
Call RtlMoveMemory(Tmp2(1), Addr2, 4)
Call VirtualProtect(ByVal Addr, 6, PAGE_EXECUTE_READWRITE, Tmp)
Call RtlMoveMemory(ByVal Addr, Tmp2(0), 6)
Call VirtualProtect(ByVal Addr, 6, Tmp, 0&)
End Sub

댓글 남기기

이메일은 공개되지 않습니다.