GetWriteWatch Trick

//GetWriteWatch Anti-SoftwareBP trick.
#include "stdafx.h"
#include "windows.h"



#define MEM_WRITE_WATCH 0x00200000

extern "C"
{
    int __stdcall GetWriteWatch(unsigned long,void*,unsigned long,void*,void*,unsigned long*);
    int __stdcall ResetWriteWatch(void*,unsigned long);
}

//This code is just for demostration, it represents nothing new
char codee[]="\xE8\x00\x00\x00\x00\x5B\x8D\x5B\x31\x53\x64\xFF\x35\x00\x00\x00\x00\x64\x89\x25\x00\x00\x00\x00"
             "\x90\x9C\xCC\x9D\x9C\xCC\x9D\x9C\xCC\x9D\x9C\xCC\x9D\x9C\xCC\x9D"
             "\x64\x8F\x05\x00\x00\x00\x00\x58"
             "\xE8\x0E\x00\x00\x00\xC3\x8B\x5C\x24\x0C\xFF\x83\xB8\x00\x00\x00\x33\xC0\xC3\x90"
             "\x81\xC3\x9C\x00\x00\x00\x53\x64\xFF\x35\x00\x00\x00\x00\x64\x89\x25\x00\x00\x00\x00\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0"
             "\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xF1\xF0"
             "\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0"
             "\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xCC\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0\xF1\xF0"
             "\xF1\xF0\xF1\xF0\xF1"
             "\x64\x8F\x05\x00\x00\x00\x00\x58\xC3"
             "\x8B\x5C\x24\x0C\xFF\x83\xB8\x00\x00\x00\xFF\x83\xB8\x00\x00\x00\x33\xC0\xC3";



int main(int argc, char* argv[])
{
    char* p=(char*)VirtualAlloc(0,0x2000,MEM_COMMIT|MEM_RESERVE|MEM_WRITE_WATCH,PAGE_EXECUTE_READWRITE);
    if(p)
    {
        memcpy(p,codee,sizeof(codee));
        ResetWriteWatch(p,0x2000);

        unsigned long pageSize=0;
        unsigned long size=0x400;    //0x400*4=0x1000
        char* px=(char*)LocalAlloc(LMEM_ZEROINIT,0x1000);

        __asm
        {
            mov eax,p
            call eax ;//Any modification (Write - TraceOver -StepOver- INT3 BPs) to this code will cause the following code to detect the debugger
        }
        if(!GetWriteWatch(0,p,0x2000,px,&size,&pageSize) && size)
        {
            MessageBox(0,"Being debugged","waliedassar",0);
            ExitProcess(0);
        }
        else MessageBox(0,"Okay","waliedassar",0);
    }
    return 0;
}