Skip to content

Instantly share code, notes, and snippets.

@dbechrd
Forked from dkrutsko/Antiscan
Created December 3, 2019 13:32
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save dbechrd/8b813c5a6406ec00782f2bf81f66bab2 to your computer and use it in GitHub Desktop.
Save dbechrd/8b813c5a6406ec00782f2bf81f66bab2 to your computer and use it in GitHub Desktop.
Detects whether the memory of your process has been scanned
// Link with psapi.lib
#define NOMINMAX
#define WIN32_LEAN_AND_MEAN
#include <Windows.h>
#include <Psapi.h>
int main (void)
{
// Allocate some non-physically backed memory
auto address = VirtualAlloc (nullptr, 0x1000,
MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
while (true)
{
// Usually performed in some detection thread
PSAPI_WORKING_SET_EX_INFORMATION info = { 0 };
info.VirtualAddress = address;
// Check if our non-physically backed memory is valid
auto result = QueryWorkingSetEx (GetCurrentProcess(),
&info, sizeof (PSAPI_WORKING_SET_EX_INFORMATION));
// Shouldn't happen
if (result == FALSE)
return 1;
// Check if a scan was preformed
if (info.VirtualAttributes.Valid)
return 2; // Scan detected!!
Sleep (50);
}
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment