SystemFunction0035

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//On windows 7, the cryptsp.dll exports a function called "SystemFunction035"
//This function Silently detects kernel debuggers. It wraps up call to the
//"ZwQuerySystemInformation" function with the "SystemInformationClass" parameter set
//to SystemKernelDebuggerInformation (0x23).
//If a kernel debugger is detected, the function returns 1.


typedef unsigned long(__stdcall *SysFunc0035)(wchar_t*);

void main()
{
    HMODULE hM=LoadLibrary("cryptsp.dll");
    if(hM)
    {
          SysFunc0035 SystemFunction035=(SysFunc0035)GetProcAddress(hM,"SystemFunction035");
          if(SystemFunction035)
          {
              //This silently wraps up a call to the "ZwQuerySystemInformation" function.
              unsigned long ret=SystemFunction035(L"xxxsxxxx::AnyThing::xxxxxxxxxd");
              if(ret==1)
              {
                  printf("Kernel debugger detected!!\r\n");
                  ExitProcess(-1);
              }
              else printf("Expected\r\n");
          }
          FreeLibrary(hM);
    }
    return;
}