Skip to content

Instantly share code, notes, and snippets.

@GregLando113
Created October 22, 2017 02:21
Show Gist options
  • Star 9 You must be signed in to star a gist
  • Fork 3 You must be signed in to fork a gist
  • Save GregLando113/df962f1f80182a0b8cf66de7f95d32b3 to your computer and use it in GitHub Desktop.
Save GregLando113/df962f1f80182a0b8cf66de7f95d32b3 to your computer and use it in GitHub Desktop.
Steam Anti Anti Debug - Load this into game at launch to be able to breakpoint and catch exceptions for 64-bit games using steam
#pragma once
#define WIN32_LEAN_AND_MEAN
#include <Windows.h>
// At least 12 bytes required for this jump
void* Detour64(void* source, void* destination, DWORD64 length) {
DWORD dwOld;
//mov rax,0xABABABABABABABAB
//jmp rax
ASSERT(length >= 0xC);
BYTE payload[] = { 0x48, 0xB8, 0xAB, 0xAB, 0xAB, 0xAB, 0xAB, 0xAB, 0xAB, 0xAB, 0xFF, 0xE0 };
void* tramp = malloc(length + 12);
VirtualProtect(tramp, length + 12, PAGE_EXECUTE_READWRITE, &dwOld);
VirtualProtect(source, length, PAGE_EXECUTE_READWRITE, &dwOld);
memcpy(tramp, source, length);
BYTE* tramp_jmp = (BYTE*)tramp + length;
*(void**)(payload + 2) = (void*)((BYTE*)source + length);
memcpy(tramp_jmp, payload, 12);
*(void**)(payload + 2) = destination;
memcpy(source, payload, 12);
memset((BYTE*)source + 12, 0x90, length - 12);
VirtualProtect(source, length, dwOld, &dwOld);
return tramp;
}
enum NTTHREAD_INFORMATION_CLASS
{
ThreadBasicInformation,
ThreadTimes,
ThreadPriority,
ThreadBasePriority,
ThreadAffinityMask,
ThreadImpersonationToken,
ThreadDescriptorTableEntry,
ThreadEnableAlignmentFaultFixup,
ThreadEventPair,
ThreadQuerySetWin32StartAddress,
ThreadZeroTlsCell,
ThreadPerformanceCount,
ThreadAmILastThread,
ThreadIdealProcessor,
ThreadPriorityBoost,
ThreadSetTlsArrayAddress,
ThreadIsIoPending,
ThreadHideFromDebugger
};
typedef NTSTATUS NTAPI NtSetInformationThread_t(HANDLE hThread, NTTHREAD_INFORMATION_CLASS cls, LPVOID info, ULONG len);
NtSetInformationThread_t* g_hkNtSetInformationThread_return = nullptr;
NTSTATUS NTAPI hkNtSetInformationThread(HANDLE hThread, NTTHREAD_INFORMATION_CLASS cls, LPVOID info, ULONG len)
{
// Setting ThreadHideFromDebugger is irreversible so we must hook to make sure it never is set
// Will cause exceptions to not be catched by the debugger, and for breakpoints to crash if set
if (cls == ThreadHideFromDebugger)
// make sure the handle is valid
// anti debug may send invalid handles to make sure its not patched to always return success
if (WaitForSingleObject(hThread, 0) != WAIT_FAILED)
{
return 0; // NTSTATUS_SUCCESS
}
return g_hkNtSetInformationThread_return(hThread, cls, info, len);
}
void AntiDebugHook()
{
NtSetInformationThread_t* src = (NtSetInformationThread_t*)GetProcAddress(GetModuleHandleA("ntdll.dll"), "ZwSetInformationThread");
if (src)
{
g_hkNtSetInformationThread_return = (NtSetInformationThread_t*)Detour64(src, hkNtSetInformationThread, 0x20);
}
}
@wackybanana1012
Copy link

how do I load the code/script into the game at launch? (steam)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment