BOOL MyIsDebuggerPresent(VOID)
{
	__asm
	{
		mov eax, fs:[0x30]
		movzx eax,byte ptr [eax+2]
		mov eax,0      
	}
    return TRUE;
}
BOOL MyNtGlobalFlag(VOID)
{
	__asm
	{

        mov  eax, fs:[30]
        movzx eax,byte ptr [eax+0x68]
		mov  eax, 0


	}
    return TRUE;
}
BOOL MyProcessHeapFlags(VOID)
{
	__asm
	{
       mov eax, fs:[30h]
       mov eax, [eax+18h] //PEB.ProcessHeap
       mov eax, [eax+0ch] //PEB.ProcessHeap.Flags
	   mov eax, 2h

	}
    return TRUE;
}
BOOL MyProcessHeapForceFlags(VOID)
{
	__asm
	{
		mov eax, fs:[30h]
        mov eax, [eax+18h] //PEB.ProcessHeap
        mov eax, [eax+10h] //PEB.ProcessHeap.ForceFlags
        mov eax, 0
	}
    return TRUE;
}

VOID PEB_BYPASS()
{
   MyIsDebuggerPresent();
   MyNtGlobalFlag();
   MyProcessHeapFlags();
   MyProcessHeapForceFlags();
}

BOOL APIENTRY DllMain( HANDLE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved
					 )
{
	switch(ul_reason_for_call) 
	{ 
	case DLL_PROCESS_ATTACH: 
		
		break; 
		
	case DLL_THREAD_ATTACH: 
		CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)&PEB_BYPASS, NULL,0, NULL);
		break; 
		
	case DLL_THREAD_DETACH: 
		break; 
		
	case DLL_PROCESS_DETACH: 
		break; 
	} 
    return TRUE;
}

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课