C C++全栈内核调试与反调试技术：通过父进程ID判断调试状态.pdfVIP

反调试

//查询父进程ID判断是否被调试正常打开的程序的父进程是explorer.exe,通过查询父进程ID是否是

__

explorer来判断是否被调试了。NTSTATUSNTAPINtQueryInformationProcess(inHANDLE

_____

ProcessHandle,inPROCESSINFOCLASSProcessInformationClass,out

__

bcount(ProcessInformationLength)PVOIDProcessInformation,inULONG

___

ProcessInformationLength,outoptPULONGReturnLength);