ParentAntiDebug

Documentation

Index

• func CurrentProcName() (string, error)
• func NtQueryProc(handle syscall.Handle, class uint32, info *ProcessInfo, length uint32) error
• func ParentAntiDebug() bool
• func QueryImageName(handle syscall.Handle, flags uint32, nameBuffer []uint16, size *uint32) error
• type ProcessInfo

Functions

func CurrentProcName

func CurrentProcName() (string, error)

CurrentProcName returns the name of the current executable

func NtQueryProc

func NtQueryProc(handle syscall.Handle, class uint32, info *ProcessInfo, length uint32) error

NtQueryProc queries process information

func ParentAntiDebug

func ParentAntiDebug() bool

ParentAntiDebug checks the parent process if it's explorer.exe or cmd.exe

func QueryImageName

func QueryImageName(handle syscall.Handle, flags uint32, nameBuffer []uint16, size *uint32) error

QueryImageName retrieves the full image name of the process

Types

type ProcessInfo

type ProcessInfo struct {
	Res1             uintptr
	PebAddr          uintptr
	Res2             [2]uintptr
	PID              uintptr
	InheritedFromPID uintptr
}