/* IsProcessDebugged ShellCode (25 bytes) by Touron Guillaume */ // Retrieve PEB->BeingDebugged to check if Process is debugged // If BeingDebugged == 1 (debugged) -> process CRASH !! // If not, continue execution after the shellcode... // No null bytes // contact: touron [dot] guillaume [at] gmail [dot] com #include #include char shellcode_dbg[] = "\x60\x33\xDB\x83\xC3\x18\x64\x8B\x03\x8B\x40\x30" "\x0F\xB6\x40\x02\x8B\xFD\x83\xC7\x04\x29\x07\x61\xC3"; int main() { fprintf(stdout, "Shellcode lenght: %d bytes only!\n", strlen(shellcode_dbg)); void (*myShellcode)(); *(long *)&myShellcode = (long)shellcode_dbg; myShellcode(); return 0; }