ULONG get_debug_offset()
{
	auto pAddress = ddk::util::get_proc_address("PsGetProcessDebugPort");
	if (pAddress)
	{
		return *(ULONG*)((ULONG_PTR)pAddress + 3);
	}
	return 0;
}
void anti_dbg_process(PEPROCESS process)
{
	OBJECT_ATTRIBUTES oa = {};
	ddk::ntos::PDEBUG_OBJECT DebugObject = nullptr;
	InitializeObjectAttributes(&oa, NULL, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
	auto ns = ObCreateObject(KernelMode, *IoFileObjectType, &oa, KernelMode, NULL, sizeof(FILE_OBJECT), 0, 0, (PVOID *)&DebugObject);
	if (NT_SUCCESS(ns))
	{
		ObReferenceObject(DebugObject);
		ObReferenceObject(DebugObject);
		ExInitializeFastMutex(&DebugObject->Mutex);
		InitializeListHead(&DebugObject->EventList);
		KeInitializeEvent(&DebugObject->EventsPresent, NotificationEvent, FALSE);
		DebugObject->KillProcessOnExit = 1;
		DebugObject->DebuggerInactive = 1;
		auto object_header = reinterpret_cast<ddk::ntos::POBJECT_HEADER>((ULONG_PTR)DebugObject - 0x30);
		//由于这是个FileObject所以它还可以有owner，有了owner它就独占了，于是谁也打不开了
		object_header->ExclusiveObject = 1;
		auto pExclusiveInfo = reinterpret_cast<ddk::ntos::POBJECT_HEADER_PROCESS_INFO>((ULONG_PTR)object_header - 0x30);
		pExclusiveInfo->ExclusiveProcess = (ddk::ntos::_EPROCESS *)PsInitialSystemProcess;
		object_header->KernelOnlyAccess = 1;//禁止应用层打开对象
		auto patchoffset = get_debug_offset();
		if (patchoffset)
		{
			auto pDebug = (PVOID *)((PUCHAR)process + patchoffset);
			*pDebug = (PVOID)DebugObject;
		}
		return;
	}
	LOG_DEBUG("CreateDebug %x\r\n", ns);
}