Option Explicit Private Declare Sub RtlMoveMemory Lib "kernel32.dll" (ByRef Destination As Any, ByRef Source As Any, ByVal Length As Long) Private Declare Function GetProcAddress Lib "kernel32.dll" (ByVal hModule As Long, ByVal lpProcName As String) As Long Private Declare Function GetModuleHandle Lib "kernel32.dll" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long Private Declare Function VirtualProtect Lib "kernel32.dll" (ByRef lpAddress As Any, ByVal dwSize As Long, ByVal flNewProtect As Long, ByRef lpflOldProtect As Long) As Long Private Const PAGE_EXECUTE_READWRITE As Long = &H40 Private Sub Form_Load() Dim Tmp2(6) As Byte, Tmp As Long: Tmp2(0) = &H68: Tmp2(5) = &HC3 Dim Addr As Long, Addr2 As Long Addr = GetProcAddress(GetModuleHandle("ntdll.dll"), "DbgUiRemoteBreakin") Addr2 = GetProcAddress(GetModuleHandle("kernel32.dll"), "ExitProcess") Call RtlMoveMemory(Tmp2(1), Addr2, 4) Call VirtualProtect(ByVal Addr, 6, PAGE_EXECUTE_READWRITE, Tmp) Call RtlMoveMemory(ByVal Addr, Tmp2(0), 6) Call VirtualProtect(ByVal Addr, 6, Tmp, 0&) End Sub