ZwClose (Anti-Debug)

//http://waleedassar.blogspot.com - (@waleedassar)
int __cdecl handler(EXCEPTION_RECORD* pRec,void* est_frame,CONTEXT* pContext)
{
    if(pRec->ExceptionCode==0xC0000235||pRec->ExceptionCode==0xC0000008)
    {
        MessageBox(0,"Debugger detected","waliedassar",0);
        ExitProcess(-1);
    }
    return ExceptionContinueSearch;
}
int main(int argc, char* argv[])
{
bool OKAY=false;
//change "c:\\olly.exe" to any file you guarantee it exists on disk.
HANDLE h=CreateFile("c:\\olly.exe",GENERIC_READ,FILE_SHARE_READ|FILE_SHARE_WRITE,0,OPEN_EXISTING,0,0);
if(h!=INVALID_HANDLE_VALUE)
{
    if(SetHandleInformation(h,HANDLE_FLAG_PROTECT_FROM_CLOSE,HANDLE_FLAG_PROTECT_FROM_CLOSE)) OKAY=true;
}

__asm
{
        push offset handler
        push dword ptr fs:[0x0]
        mov dword ptr fs:[0x0],esp
}

//Close a protected handle
CloseHandle(h);

//Close an invalid handle
CloseHandle((HANDLE)0xCECECECE);

__asm
{
        pop dword ptr fs:[0x0]
        add esp,0x4
}

MessageBox(0,"No debugger","waliedassar",0);
return 0;
}