module("Anti",package.seeall)
_LOAD_DLL_DEBUG_EVENT  = 0
_EXCEPTION_DEBUG_EVENT = 0

--处理BeginDebugger 标志
function BeginDebugger(debugevent)
	if _EXCEPTION_DEBUG_EVENT > 0 then return end
	-- LOAD_DLL_DEBUG_EVENT 1  清除PEB BeginDebugger 标志
	-- LOAD_DLL_DEBUG_EVENT 2  设置PEB BeginDebugger 标志
	-- EXCEPTION_DEBUG_EVENT 1 清除PEB BeginDebugger 标志
	local event = ffi.cast("int *",debugevent)
	if event[0] == win.LOAD_DLL_DEBUG_EVENT then
		if _LOAD_DLL_DEBUG_EVENT == 0 then
			local PEB = win.GetPEB(event[1])
			local hProcess = od._process()
			local ret = win.WriteMemory(hProcess,PEB + 2,"\x00")
			-- od.Addtolist(string.format("Anti LOAD_DLL_DEBUG_EVENT 1"))
		elseif _LOAD_DLL_DEBUG_EVENT == 1 then
			local PEB = win.GetPEB(event[1])
			local hProcess = od._process()
			local ret = win.WriteMemory(hProcess,PEB + 2,"\x01")
			-- od.Addtolist(string.format("Anti LOAD_DLL_DEBUG_EVENT 2"))		
		end
		_LOAD_DLL_DEBUG_EVENT = _LOAD_DLL_DEBUG_EVENT + 1
	end
	if _EXCEPTION_DEBUG_EVENT == 0 and event[0] == win.EXCEPTION_DEBUG_EVENT then
		local PEB = win.GetPEB(event[1])
		local hProcess = od._process()
		local ret = win.WriteMemory(hProcess,PEB + 2,"\x00")
		od.Addtolist("Anti BeginDebugger Ok!",0,1)		
		_EXCEPTION_DEBUG_EVENT = 1
	end	
end

--od 重启后清除一些变量
function PluginReset()
	_LOAD_DLL_DEBUG_EVENT  = 0
	_EXCEPTION_DEBUG_EVENT = 0
end


--调试模式时用无效的句柄调用CloseHandle()会发生异常
--hook ZwClose 添加一个带SEH的调用处理掉异常
function ZwClose()
	local a = 0
	local s = 0
	local ip = od.getAddress("ntdll.ZwClose")
	local disasm
	local ocode = ""
	local mem = win.remoteVirtualAlloc(0x1000)

	while a < 2 do
		disasm = od.Disasm(ip + s)
		a = a + 1
		s = s + disasm.size
		ocode = ocode .. od.astring(disasm.result) .. "\n"	
	end

	--jmp到stub
	local FakeCode = string.format("push 0%08X\n ret\n",mem)
	local bin,_txt = od.assemble(FakeCode,ip)
	od.Writememory(ip,bin)

	--前2条指 和jmp
	ocode = ocode .. string.format("jmp 0x%08X\n",ip + s)

	--带seh的调用，seh中不处理继续运行
	local sehfunc = 
	[[
		call seh
		xor eax,eax
		retn 10
	seh:
		push DWORD fs:[0]
		mov  DWORD fs:[0],esp
		push DWORD [esp + c]
		call stub	
		pop DWORD fs:[0]
		add esp ,4
		retn 4	
	]]
	local PatchCode = sehfunc .. "stub:\n" .. ocode .. "\n"
	bin,_txt = od.assemble(PatchCode,mem)
	od.Writememory(mem,bin)
	od.Addtolist("Anti ZwClose Ok!",0,1)		
end

--ProcessInfoClass 
-- 0x7  debug 端口
-- 0x1e dbgflag
-- 0x1f dbgobject
function ZwQueryInformationProcess()
	local a = 0
	local s = 0
	local ip = od.getAddress("ntdll.ZwQueryInformationProcess")
	local disasm
	local ocode = ""
	local mem = win.remoteVirtualAlloc(0x1000)

	while a < 2 do
		disasm = od.Disasm(ip + s)
		a = a + 1
		s = s + disasm.size
		ocode = ocode .. od.astring(disasm.result) .. "\n"	
	end

	--到patch
	local ord = string.format("push 0%08X\n ret\n",mem)
	local bin,_txt = od.assemble(ord,ip)
	od.Writememory(ip,bin)

	local PatchCode = 
	[[
		cmp DWORD [esp + 8],07
		je dbgport
		cmp DWORD [esp + 8],01f
		je dbgobject
		cmp DWORD [esp + 8],01e
		je dbgflag
		push 0%08X
		ret
		
	dbgport:
		mov eax ,[esp + 0c]
		push 0
		pop DWORD [eax]
		xor eax,eax
		retn 14
		
	dbgobject:
		mov eax ,[esp + 0c]
		push 1
		pop DWORD [eax]
		xor eax,eax
		retn 14
		
	dbgflag:
		mov eax ,[esp + 0c]
		push 0
		pop DWORD [eax]
		mov eax,0C0000353
		retn 14		
	]]
	PatchCode = PatchCode:format(ip + s)
	code = ocode .. "\n" .. PatchCode
	bin,_txt = od.assemble(code,mem)
	od.Writememory(mem,bin)
	od.Addtolist("Anti ZwQueryInformationProcess Ok!",0,1)	
end

--处理ThreadHideFromDebugger
function ZwSetInformationThread()
	local a = 0
	local s = 0
	local ip = od.getAddress("ntdll.ZwSetInformationThread")
	local disasm
	local ocode = ""
	local mem = win.remoteVirtualAlloc(0x1000)

	while a < 2 do
		disasm = od.Disasm(ip + s)
		a = a + 1
		s = s + disasm.size
		ocode = ocode .. od.astring(disasm.result) .. "\n"	
	end

	--到patch
	local ord = string.format("push 0%08X\n ret\n",mem)
	local bin,_txt = od.assemble(ord,ip)
	od.Writememory(ip,bin)

	local PatchCode = 
	[[
		cmp DWORD [esp + 8],0x11
		je Hide		
		push 0%08X
		ret
	Hide:
		xor eax,eax
		retn 10
	]]
	PatchCode = PatchCode:format(ip + s)
	code = ocode .. "\n" .. PatchCode
	bin,_txt = od.assemble(code,mem)
	od.Writememory(mem,bin)
	od.Addtolist("Anti ZwSetInformationThread Ok!",0,1)	
end