AntiDebugging
AntiDebugging
What is it?
This implements five different debugger detection techniques that run in sequence. If any one of them fires, the process calls exit(1). The goal is to detect a debugger before executing anything sensitive.
How it works
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
main() runs each check in order:
1. IsDebuggerPresent1()
Read PEB directly: __readgsqword(0x60)
Check pPeb->BeingDebugged == 1
│ TRUE → exit(1)
2. NtQInfoProcess()
GetProcAddress(NTDLL.DLL, "NtQueryInformationProcess")
│
├─ ProcessDebugPort query → non-zero = debugger attached
└─ ProcessDebugObjectHandle query → non-zero = debug object exists
│ either TRUE → exit(1)
3. HWBP_Check()
GetThreadContext(GetCurrentThread(), CONTEXT_DEBUG_REGISTERS)
Check Dr0 || Dr1 || Dr2 || Dr3 != 0
│ TRUE → exit(1) (hardware breakpoint is set)
4. BlockSoftware()
CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS)
Walk every process, compare name against:
x64dbg.exe, x32dbg.exe, binaryninja.exe,
VsDebugConsole.exe, ida.exe
│ found → exit(1)
5. TimeCheck1()
dwTime1 = GetTickCount64()
dwTime2 = GetTickCount64()
if (dwTime2 - dwTime1) > 70 → exit(1)
(debugger stepping adds measurable delay)
One thing worth noting: there’s a SendMessageDbg() function in the file that detects debuggers via OutputDebugStringW + GetLastError(), but it’s never called from main().
Each check targets a different layer — the PEB flag is trivial but fast, NtQueryInformationProcess asks the kernel directly (harder to bypass), hardware breakpoint detection catches analyst-set breakpoints even with a patched PEB, the process name check is the coarsest but catches common tools by name, and the timing check catches slowdown from software breakpoints.
Techniques.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
#include <Windows.h>
#include <stdio.h>
#include <TlHelp32.h>
#include "structs.h"
/*
IsdebuggerPresent() API, returns TRUE if a debugger is being attached to the calling process
*/
BOOL IsDebuggerPresent1() {
// Get address PEB (GSx60 is PEB pointer)
PPEB pPeb = (PEB*)(__readgsqword(0x60));
if (pPeb->BeingDebugged == 1)
return TRUE;
return FALSE;
}
/*
NtQueryInformationProcess detects debugging via ProcessDebugPort & ProcessDebugObjectHandle
*/
BOOL NtQInfoProcess() {
NTSTATUS STATUS = NULL;
fnNtQueryInformationProcess pNtQueryInformationProcess = NULL;
DWORD64 dwIsDebuggerPresent = NULL;
DWORD64 hProcessDebugObject = NULL;
// Get Memory Address NtQueryInformationProcess from ntdll.dll
pNtQueryInformationProcess = (fnNtQueryInformationProcess)GetProcAddress(GetModuleHandle(TEXT("NTDLL.DLL")), "NtQueryInformationProcess");
// ProcessDebugPort Method
STATUS = pNtQueryInformationProcess(GetCurrentProcess(), ProcessDebugPort, &dwIsDebuggerPresent, sizeof(DWORD64), NULL);
if (STATUS != 0x0) {
printf("[!] NtQueryInformationProcess Failed: 0x%0.8X \n", STATUS);
return FALSE;
}
if (dwIsDebuggerPresent) {
printf("[+] Debugger Detected!\n");
return TRUE;
}
// ProcessDebugObjectHandle Method
STATUS = pNtQueryInformationProcess(GetCurrentProcess(), ProcessDebugObjectHandle, &hProcessDebugObject, sizeof(DWORD64), NULL);
if (STATUS != 0x0 && STATUS != 0xC0000353) {
printf("[!] NtQueryInformationProcess Failed: 0x%0.8X \n", STATUS);
return FALSE;
}
if (hProcessDebugObject)
return TRUE;
return FALSE;
}
/*
Hardware breakpoint detection, checks if the registers dr0-3 are 0
*/
BOOL HWBP_Check() {
CONTEXT Ctx = { .ContextFlags = CONTEXT_DEBUG_REGISTERS };
// Get current threadcontext
if (!GetThreadContext(GetCurrentThread(), &Ctx)) {
printf("[!] GetThreadContext Failed %d \n", GetLastError());
return FALSE;
}
// Check Hardware Breakpoint by checking registers aren't set to 0
if (Ctx.Dr0 || Ctx.Dr1 || Ctx.Dr2 || Ctx.Dr3) {
printf("[+] Debugger Detected ! \n");
return TRUE;
}
return FALSE;
}
/*
Detect Debuggers Via Name (Array)
*/
WCHAR* g_BlockSoftware[5] = {
L"x64dbg.exe",
L"x32dbg.exe",
L"binaryninja.exe",
L"VsDebugConsole.exe",
L"ida.exe"
};
BOOL BlockSoftware() {
HANDLE hSnapshot = NULL;
PROCESSENTRY32W ProcEntry = { .dwSize = sizeof(PROCESSENTRY32W) };
BOOL bSTATE = FALSE;
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
if (hSnapshot == INVALID_HANDLE_VALUE) {
printf("[!] CreateToolHelp32Snapshot Failed %d \n", GetLastError());
goto _End;
}
if (!Process32FirstW(hSnapshot, &ProcEntry)) {
printf("[!] Process32FirstW Failed %d \n", GetLastError());
goto _End;
}
do {
for (int i = 0; i < 5; i++) {
if (wcscmp(ProcEntry.szExeFile, g_BlockSoftware[i]) == 0) {
wprintf(L"\t[+] Found \"%ls\" Of Pid %d \n", ProcEntry.szExeFile, ProcEntry.th32ProcessID);
bSTATE = TRUE;
break;
}
}
if (bSTATE)
break;
} while (Process32NextW(hSnapshot, &ProcEntry));
_End:
if (!hSnapshot)
CloseHandle(hSnapshot);
return bSTATE;
}
/*
Detect debugging by evaluating time started and current time, if to long its being debugged GetTickCount64()
*/
BOOL TimeCheck1() {
DWORD dwTime1, dwTime2 = 0;
dwTime1 = GetTickCount64();
dwTime2 = GetTickCount64();
if ((dwTime2 - dwTime1) > 70)
return TRUE;
return FALSE;
}
/*
Send message to debugger is thats succeeds debugging is happening
*/
BOOL SendMessageDbg() {
// Make sure value is non 0 before execution
SetLastError(1);
OutputDebugStringW(L"N0xshell");
if (GetLastError())
return TRUE;
return FALSE;
}
int main() {
printf("[+] Press <Enter> To Start Anti Analysis Techniques! \n");
getchar();
// Method: IsDebuggerPresent
printf("[+] Running: IsDebuggerPresent1 \n");
if (IsDebuggerPresent1()) {
printf("[!] Debugger Detected [IsDebuggerPresent1] \n");
exit(1);
}
else
printf("\t[+] IsDebuggerPresent1 Done! \n");
// Method: NtQueryInformationProcess
printf("[+] Running: NtQInfoProcess \n");
if (NtQInfoProcess()) {
printf("[!] Debugger Detected [NtQInfoProcess] \n");
exit(1);
}
else
printf("\t[+] NtQInfoProcess Done! \n");
// Method: HWBP_Check (Thread Register check)
printf("[+] Running: HWBP_Check \n");
if (HWBP_Check()) {
printf("[!] Debugger Detected [HWBP_Check] \n");
exit(1);
}
else
printf("\t[+] HWBP_Check Done \n");
// Method: BlockSoftware Check
printf("[+] Running: BlockSoftware \n");
if (BlockSoftware()) {
printf("[!] Debugger Detected [BlockSoftware] \n");
exit(1);
}
else
printf("\t[+] BlockSoftware Done \n");
// Method: TimeCheck
printf("[+] Running: TimeCheck1 \n");
if (TimeCheck1()) {
printf("[!] Debugger Detected [TimeCheck1] \n");
exit(1);
}
else
printf("\t[+] TimeCheck1 Done \n");
printf("[+] Press <Enter> To Exit! \n");
getchar();
return 0;
}
structs.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
#pragma once
#include <Windows.h>
#ifndef STRUCTS
#define STRUCTS
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, * PUNICODE_STRING;
typedef struct _PEB_LDR_DATA {
ULONG Length;
ULONG Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA, * PPEB_LDR_DATA;
typedef PVOID PACTIVATION_CONTEXT;
typedef struct _LDR_DATA_TABLE_ENTRY {
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
WORD LoadCount;
WORD TlsIndex;
union {
LIST_ENTRY HashLinks;
struct {
PVOID SectionPointer;
ULONG CheckSum;
};
};
union {
ULONG TimeDateStamp;
PVOID LoadedImports;
};
PACTIVATION_CONTEXT EntryPointActivationContext;
PVOID PatchInformation;
LIST_ENTRY ForwarderLinks;
LIST_ENTRY ServiceTagLinks;
LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
typedef struct _PEB
{
UCHAR InheritedAddressSpace;
UCHAR ReadImageFileExecOptions;
UCHAR BeingDebugged;
union
{
UCHAR BitField;
struct
{
UCHAR ImageUsesLargePages : 1;
UCHAR IsProtectedProcess : 1;
UCHAR IsImageDynamicallyRelocated : 1;
UCHAR SkipPatchingUser32Forwarders : 1;
UCHAR IsPackagedProcess : 1;
UCHAR IsAppContainer : 1;
UCHAR IsProtectedProcessLight : 1;
UCHAR IsLongPathAwareProcess : 1;
};
};
UCHAR Padding0[4];
VOID* Mutant;
VOID* ImageBaseAddress;
struct _PEB_LDR_DATA* Ldr;
struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters;
VOID* SubSystemData;
VOID* ProcessHeap;
struct _RTL_CRITICAL_SECTION* FastPebLock;
union _SLIST_HEADER* volatile AtlThunkSListPtr;
VOID* IFEOKey;
union
{
ULONG CrossProcessFlags;
struct
{
ULONG ProcessInJob : 1;
ULONG ProcessInitializing : 1;
ULONG ProcessUsingVEH : 1;
ULONG ProcessUsingVCH : 1;
ULONG ProcessUsingFTH : 1;
ULONG ProcessPreviouslyThrottled : 1;
ULONG ProcessCurrentlyThrottled : 1;
ULONG ProcessImagesHotPatched : 1;
ULONG ReservedBits0 : 24;
};
};
UCHAR Padding1[4];
union
{
VOID* KernelCallbackTable;
VOID* UserSharedInfoPtr;
};
ULONG SystemReserved;
ULONG AtlThunkSListPtr32;
VOID* ApiSetMap;
ULONG TlsExpansionCounter;
UCHAR Padding2[4];
VOID* TlsBitmap;
ULONG TlsBitmapBits[2];
VOID* ReadOnlySharedMemoryBase;
VOID* SharedData;
VOID** ReadOnlyStaticServerData;
VOID* AnsiCodePageData;
VOID* OemCodePageData;
VOID* UnicodeCaseTableData;
ULONG NumberOfProcessors;
ULONG NtGlobalFlag;
union _LARGE_INTEGER CriticalSectionTimeout;
ULONGLONG HeapSegmentReserve;
ULONGLONG HeapSegmentCommit;
ULONGLONG HeapDeCommitTotalFreeThreshold;
ULONGLONG HeapDeCommitFreeBlockThreshold;
ULONG NumberOfHeaps;
ULONG MaximumNumberOfHeaps;
VOID** ProcessHeaps;
VOID* GdiSharedHandleTable;
VOID* ProcessStarterHelper;
ULONG GdiDCAttributeList;
UCHAR Padding3[4];
struct _RTL_CRITICAL_SECTION* LoaderLock;
ULONG OSMajorVersion;
ULONG OSMinorVersion;
USHORT OSBuildNumber;
USHORT OSCSDVersion;
ULONG OSPlatformId;
ULONG ImageSubsystem;
ULONG ImageSubsystemMajorVersion;
ULONG ImageSubsystemMinorVersion;
UCHAR Padding4[4];
ULONGLONG ActiveProcessAffinityMask;
ULONG GdiHandleBuffer[60];
VOID(*PostProcessInitRoutine)();
VOID* TlsExpansionBitmap;
ULONG TlsExpansionBitmapBits[32];
ULONG SessionId;
UCHAR Padding5[4];
union _ULARGE_INTEGER AppCompatFlags;
union _ULARGE_INTEGER AppCompatFlagsUser;
VOID* pShimData;
VOID* AppCompatInfo;
struct _UNICODE_STRING CSDVersion;
struct _ACTIVATION_CONTEXT_DATA* ActivationContextData;
struct _ASSEMBLY_STORAGE_MAP* ProcessAssemblyStorageMap;
struct _ACTIVATION_CONTEXT_DATA* SystemDefaultActivationContextData;
struct _ASSEMBLY_STORAGE_MAP* SystemAssemblyStorageMap;
ULONGLONG MinimumStackCommit;
struct _FLS_CALLBACK_INFO* FlsCallback;
struct _LIST_ENTRY FlsListHead;
VOID* FlsBitmap;
ULONG FlsBitmapBits[4];
ULONG FlsHighIndex;
VOID* WerRegistrationData;
VOID* WerShipAssertPtr;
VOID* pUnused;
VOID* pImageHeaderHash;
union
{
ULONG TracingFlags;
struct
{
ULONG HeapTracingEnabled : 1;
ULONG CritSecTracingEnabled : 1;
ULONG LibLoaderTracingEnabled : 1;
ULONG SpareTracingBits : 29;
};
};
UCHAR Padding6[4];
ULONGLONG CsrServerReadOnlySharedMemoryBase;
ULONGLONG TppWorkerpListLock;
struct _LIST_ENTRY TppWorkerpList;
VOID* WaitOnAddressHashTable[128];
VOID* TelemetryCoverageHeader;
ULONG CloudFileFlags;
ULONG CloudFileDiagFlags;
CHAR PlaceholderCompatibilityMode;
CHAR PlaceholderCompatibilityModeReserved[7];
struct _LEAP_SECOND_DATA* LeapSecondData;
union
{
ULONG LeapSecondFlags;
struct
{
ULONG SixtySecondEnabled : 1;
ULONG Reserved : 31;
};
};
ULONG NtGlobalFlag2;
} PEB, * PPEB;
// https://github.com/winsiderss/systeminformer/blob/master/phnt/include/ntpsapi.h#L110
typedef enum _PROCESSINFOCLASS
{
ProcessBasicInformation, // q: PROCESS_BASIC_INFORMATION, PROCESS_EXTENDED_BASIC_INFORMATION
ProcessQuotaLimits, // qs: QUOTA_LIMITS, QUOTA_LIMITS_EX
ProcessIoCounters, // q: IO_COUNTERS
ProcessVmCounters, // q: VM_COUNTERS, VM_COUNTERS_EX, VM_COUNTERS_EX2
ProcessTimes, // q: KERNEL_USER_TIMES
ProcessBasePriority, // s: KPRIORITY
ProcessRaisePriority, // s: ULONG
ProcessDebugPort, // q: HANDLE
ProcessExceptionPort, // s: PROCESS_EXCEPTION_PORT (requires SeTcbPrivilege)
ProcessAccessToken, // s: PROCESS_ACCESS_TOKEN
ProcessLdtInformation, // qs: PROCESS_LDT_INFORMATION // 10
ProcessLdtSize, // s: PROCESS_LDT_SIZE
ProcessDefaultHardErrorMode, // qs: ULONG
ProcessIoPortHandlers, // (kernel-mode only) // PROCESS_IO_PORT_HANDLER_INFORMATION
ProcessPooledUsageAndLimits, // q: POOLED_USAGE_AND_LIMITS
ProcessWorkingSetWatch, // q: PROCESS_WS_WATCH_INFORMATION[]; s: void
ProcessUserModeIOPL, // qs: ULONG (requires SeTcbPrivilege)
ProcessEnableAlignmentFaultFixup, // s: BOOLEAN
ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS
ProcessWx86Information, // qs: ULONG (requires SeTcbPrivilege) (VdmAllowed)
ProcessHandleCount, // q: ULONG, PROCESS_HANDLE_INFORMATION // 20
ProcessAffinityMask, // (q >WIN7)s: KAFFINITY, qs: GROUP_AFFINITY
ProcessPriorityBoost, // qs: ULONG
ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX
ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION
ProcessForegroundInformation, // s: PROCESS_FOREGROUND_BACKGROUND
ProcessWow64Information, // q: ULONG_PTR
ProcessImageFileName, // q: UNICODE_STRING
ProcessLUIDDeviceMapsEnabled, // q: ULONG
ProcessBreakOnTermination, // qs: ULONG
ProcessDebugObjectHandle, // q: HANDLE // 30
ProcessDebugFlags, // qs: ULONG
ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: size 0 disables, otherwise enables
ProcessIoPriority, // qs: IO_PRIORITY_HINT
ProcessExecuteFlags, // qs: ULONG
ProcessTlsInformation, // PROCESS_TLS_INFORMATION // ProcessResourceManagement
ProcessCookie, // q: ULONG
ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION
ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA
ProcessPagePriority, // qs: PAGE_PRIORITY_INFORMATION
ProcessInstrumentationCallback, // s: PVOID or PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION // 40
ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX
ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[]
ProcessImageFileNameWin32, // q: UNICODE_STRING
ProcessImageFileMapping, // q: HANDLE (input)
ProcessAffinityUpdateMode, // qs: PROCESS_AFFINITY_UPDATE_MODE
ProcessMemoryAllocationMode, // qs: PROCESS_MEMORY_ALLOCATION_MODE
ProcessGroupInformation, // q: USHORT[]
ProcessTokenVirtualizationEnabled, // s: ULONG
ProcessConsoleHostProcess, // qs: ULONG_PTR // ProcessOwnerInformation
ProcessWindowInformation, // q: PROCESS_WINDOW_INFORMATION // 50
ProcessHandleInformation, // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since WIN8
ProcessMitigationPolicy, // s: PROCESS_MITIGATION_POLICY_INFORMATION
ProcessDynamicFunctionTableInformation,
ProcessHandleCheckingMode, // qs: ULONG; s: 0 disables, otherwise enables
ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION
ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION
ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL
ProcessHandleTable, // q: ULONG[] // since WINBLUE
ProcessCheckStackExtentsMode, // qs: ULONG // KPROCESS->CheckStackExtents (CFG)
ProcessCommandLineInformation, // q: UNICODE_STRING // 60
ProcessProtectionInformation, // q: PS_PROTECTION
ProcessMemoryExhaustion, // PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD
ProcessFaultInformation, // PROCESS_FAULT_INFORMATION
ProcessTelemetryIdInformation, // q: PROCESS_TELEMETRY_ID_INFORMATION
ProcessCommitReleaseInformation, // PROCESS_COMMIT_RELEASE_INFORMATION
ProcessDefaultCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5]
ProcessAllowedCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5]
ProcessSubsystemProcess,
ProcessJobMemoryInformation, // q: PROCESS_JOB_MEMORY_INFO
ProcessInPrivate, // s: void // ETW // since THRESHOLD2 // 70
ProcessRaiseUMExceptionOnInvalidHandleClose, // qs: ULONG; s: 0 disables, otherwise enables
ProcessIumChallengeResponse,
ProcessChildProcessInformation, // q: PROCESS_CHILD_PROCESS_INFORMATION
ProcessHighGraphicsPriorityInformation, // qs: BOOLEAN (requires SeTcbPrivilege)
ProcessSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2
ProcessEnergyValues, // q: PROCESS_ENERGY_VALUES, PROCESS_EXTENDED_ENERGY_VALUES
ProcessPowerThrottlingState, // qs: POWER_THROTTLING_PROCESS_STATE
ProcessReserved3Information, // ProcessActivityThrottlePolicy // PROCESS_ACTIVITY_THROTTLE_POLICY
ProcessWin32kSyscallFilterInformation, // q: WIN32K_SYSCALL_FILTER
ProcessDisableSystemAllowedCpuSets, // 80
ProcessWakeInformation, // PROCESS_WAKE_INFORMATION
ProcessEnergyTrackingState, // PROCESS_ENERGY_TRACKING_STATE
ProcessManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3
ProcessCaptureTrustletLiveDump,
ProcessTelemetryCoverage,
ProcessEnclaveInformation,
ProcessEnableReadWriteVmLogging, // PROCESS_READWRITEVM_LOGGING_INFORMATION
ProcessUptimeInformation, // q: PROCESS_UPTIME_INFORMATION
ProcessImageSection, // q: HANDLE
ProcessDebugAuthInformation, // since REDSTONE4 // 90
ProcessSystemResourceManagement, // PROCESS_SYSTEM_RESOURCE_MANAGEMENT
ProcessSequenceNumber, // q: ULONGLONG
ProcessLoaderDetour, // since REDSTONE5
ProcessSecurityDomainInformation, // PROCESS_SECURITY_DOMAIN_INFORMATION
ProcessCombineSecurityDomainsInformation, // PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION
ProcessEnableLogging, // PROCESS_LOGGING_INFORMATION
ProcessLeapSecondInformation, // PROCESS_LEAP_SECOND_INFORMATION
ProcessFiberShadowStackAllocation, // PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION // since 19H1
ProcessFreeFiberShadowStackAllocation, // PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION
ProcessAltSystemCallInformation, // qs: BOOLEAN (kernel-mode only) // INT2E // since 20H1 // 100
ProcessDynamicEHContinuationTargets, // PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION
ProcessDynamicEnforcedCetCompatibleRanges, // PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE_INFORMATION // since 20H2
ProcessCreateStateChange, // since WIN11
ProcessApplyStateChange,
ProcessEnableOptionalXStateFeatures,
ProcessAltPrefetchParam, // since 22H1
ProcessAssignCpuPartitions,
ProcessPriorityClassEx, // s: PROCESS_PRIORITY_CLASS_EX
ProcessMembershipInformation,
ProcessEffectiveIoPriority, // q: IO_PRIORITY_HINT
ProcessEffectivePagePriority, // q: ULONG
MaxProcessInfoClass
} PROCESSINFOCLASS;
typedef NTSTATUS(WINAPI* fnNtQueryInformationProcess)(
HANDLE ProcessHandle,
PROCESSINFOCLASS ProcessInformationClass,
PVOID ProcessInformation,
ULONG ProcessInformationLength,
PULONG ReturnLength
);
#endif // !STRUCTS
This post is licensed under
CC BY 4.0
by the author.