Typical Sequence Of Antidebug Tricks

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar
#include "stdafx.h"
#include "windows.h"
#include "iostream.h"


extern "C"
{
       int __stdcall ZwSetInformationThread(HANDLE,int,unsigned long*,unsigned long);
       int __stdcall ZwQueryInformationProcess(HANDLE,int,unsigned long*,unsigned long,unsigned long*);
}

#define ThreadHideFromDebugger 0x11
#define ProcessDebugPort   0x7
#define ProcessDebugObjectHandle 0x1E
#define ProcessDebugFlags 0x1F

int main(int argc, char* argv[])
{
    //------------------------------------
    unsigned long _port_=0;
    ZwQueryInformationProcess(GetCurrentProcess(),ProcessDebugPort,&_port_,0x4,0);
    if(_port_)
    {
        MessageBox(0,"BeingDebugged","waliedassar",0);
        ExitProcess(-1);
    }
    //------------------------------------
    unsigned long DbgObjHand=0;
    int ret=ZwQueryInformationProcess(GetCurrentProcess(),ProcessDebugObjectHandle,&DbgObjHand,0x4,0);
    if(ret>=0 || DbgObjHand)
    {
        MessageBox(0,"BeingDebugged","waliedassar",0);
        ExitProcess(-2);
    }
    //------------------------------------
    unsigned long DbgFlags=0;
    ZwQueryInformationProcess(GetCurrentProcess(),ProcessDebugFlags,&DbgFlags,0x4,0);
    if(DbgFlags==0)
    {
            //Only if Process was spawned by the "DEBUG_ONLY_THIS_PROCESS" flag of
            //The "CreateProcess" function i.e. No Child Debugging.
            //Does not harm you code, though.
        MessageBox(0,"BeingDebugged","waliedassar",0);
        ExitProcess(-2);
    }
    //------------------------------------
    ZwSetInformationThread(GetCurrentThread(),ThreadHideFromDebugger,0,0);


    MessageBox(0,"Can you see me under debugger","waliedassar",0);
    return 0;
}