ZwClose As Anti-Debug Trick

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

ZwClose(Invalid or protected handle); has been used as an effective anti-debug trick since
in the presence of a debugger, an exception of type 0xC0000008 (STATUS_INVALID_HANDLE) or
0xC0000235 (STATUS_HANDLE_NOT_CLOSABLE) is raised and then the installed exception handler
will detect the state of being under a debugger. On the other hand, if no debugger is present,
the function simply return 0xC0000008 (STATUS_INVALID_HANDLE) or 0xC0000235.

There is a risk using this function as anti-debug, which is randomly choosing a value that is
already a valid handle value. To bypass this risk, we have to understand the inner working of
the "NtCloseHandle" function in kernel-mode.

1) Don't use zero since NtClose in this case will not raise any exceptions.
 See. the "nt!ObpCloseHandle" function.
2) Don't use -1 or -2 since both values are reserved for GetCurrentProcess() and
GetCurrentThread() and NtClose in this case will not raise any exceptions.
 See the "nt!ObpCloseHandle" function.

fffff800`035888b2 4885db        test    rbx,rbx
fffff800`035888b5 0f848d000000  je      nt! ?? ::NNGAKEGL::`string'+0x34fec (fffff800`03588948)

nt! ?? ::NNGAKEGL::`string'+0x34f5b:
fffff800`035888bb 4883fbfe      cmp     rbx,0FFFFFFFFFFFFFFFEh
fffff800`035888bf 0f8483000000  je      nt! ?? ::NNGAKEGL::`string'+0x34fec (fffff800`03588948)

nt! ?? ::NNGAKEGL::`string'+0x34f65:
fffff800`035888c5 4883fbff      cmp     rbx,0FFFFFFFFFFFFFFFFh
fffff800`035888c9 747d          je      nt! ?? ::NNGAKEGL::`string'+0x34fec (fffff800`03588948)

nt! ?? ::NNGAKEGL::`string'+0x34fec:
fffff800`03588948 b8080000c0    mov     eax,0C0000008h
fffff800`0358894d e942270400    jmp     nt!ObpCloseHandle+0x94 (fffff800`035cb094)


3) To be very sure that the handle value is invalid, unset all the bits of 0x3FC.
In other word, invalid_handle=random_value ^ 0x3FC;
See the "ExMapHandleToPointer" function.

nt!ExMapHandleToPointer:
fffff800`035cb0d0 4883ec28      sub     rsp,28h
fffff800`035cb0d4 f7c2fc030000  test    edx,3FCh
fffff800`035cb0da 747c          je      nt!ExMapHandleToPointer+0x88 (fffff800`035cb158)


OR
Make the value look like a kernel handle by setting the most significant bit(s) of the value
by ORing with 0x80000000 (32-Bit system) or ORing with 0xFFFFFFFF80000000 (64-bit system).

One famous method of bypassing this trick is intercepting the call and changing the parameter
of the stack to a valid value or even changing the system call number to something like
ZwFlushKey such that no exceptions are raised.

So, to enhance the trick, make sure that the return value of the calls
is 0xC0000008 or 0x0xC0000235. Also, make sure to check the dead stack i.e. dword ptr[esp-4]
for the invalid value you supplied.