AutoHotkey Community

x := RegisterCallback( "AttachDetected" )
m := DllCall( "Kernel32\GetModuleHandle", Str,"ntdll.dll" )
a := DllCall( "Kernel32\GetProcAddress",  UInt,m, Str,"DbgUiRemoteBreakin" )
DllCall( "kernel32\VirtualProtect", UInt,a, UInt,1, UInt,0x40, UIntP,o )
NumPut( 0xe9, a+0, 0, "UChar" ) , NumPut( (x-5-a), a+1, 0, "Int" )
DllCall( "kernel32\VirtualProtect", UInt,a, UInt,1, UInt,o, UIntP,o )
AttachDetected() {
  ExitApp
}

/*
    Crazy Scripting : Dingbat Flipper 45L
    http://www.autohotkey.com/forum/viewtopic.php?t=18794
*/

Gui, +AlwaysOnTop
Gui,Font,s28, Webdings
Loop 36                             
 Ix:=A_Index, Ch.=Chr(158+Ix) "|" Chr(158+Ix) ((Ix<36) ? "|" : "")
Sort,Ch,D| Random
X:=10, Y:=10, R:=1, C:=1, Ix:=1
Loop,Parse,Ch,|
                        {
                           Gui,Add,Button,x%X% y%Y% w46 h46 vB%Ix% gMainProcedure
                           X:=X+50, C:=C+1, Ix:=Ix+1
                           If (C>9)
                              R:=R+1, C:=1, Y:=Y+50, X:=10
                        }
Gui,Font,S8 Bold,Tahoma
Gui,Margin,10,10
Gui,Add,StatusBar
e:=SB_SetParts(75,75,250), CL:=0, FL:=0, A_Time:=SubStr(A_Now,1,8)
Gui,Show,,Dingbat Flipper 45L
SetTimer,GameTimer,1000
Return ;                                                   [ End of Auto-Execute Section ]

F2::ReLoad

MainProcedure: ;                                                        [ Main Procedure ]
  iNo:=Substr(A_GuiControl,2,2)
  If (iNo!=S1 and iNo!=S2 and AR!=1) {
  e:=GuiC(N,"B" iNo,GetF(Ch,iNo)),   S0:=S1, S1:=S2, S2:=iNo,     e:=GuiC(N,"B" S0), AR:=1
  If ( GetF(Ch,S1) == GetF(Ch,S2) ) ;               == is used for case sensitive matching
     e:=GuiC("Disable","B" S1),      e:=GuiC("Disable","B" S2),     S1:=0, S2:=0, FL:=FL+1
  CL:=CL+1, AR:=0,     SB_SetText("`tClicks: " CL,1),   SB_SetText("`tFlips: " FL "/36",2)
  IfEqual,FL,36, Gui,Show,,GAME OVER!       Press <F2> to play again
} Return

GameTimer: ;                                                                [ Game Timer ]
  If (WinActive("Dingbat Flipper 45L") And CL>0) {
  A_Time+=1,S
  FormatTime,MMSS,%A_Time%,mm:ss
  SB_SetText("`t" MMSS,4)
} Return

GetF(Str="",Fld=1)        { ;                                                   GetField()
  Loop,Parse,Str,|
    IfEqual,A_Index,%Fld%, Return,A_LoopField
}

GuiC(P1="",P2="",P3="")   { ;                                                 GuiControl()
  GuiControl,%P1%, %P2%,%P3%
}


GuiClose:
  ExitApp

comment $

    ---------------------------------------------------
         Debugger "On-Attach" detection method
    ---------------------------------------------------
         by Piotr Bania <bania.piotr@gmail.com>
         http://www.piotrbania.com
       All rights reserved!



  Disclaimer
  ----------

   Author takes no responsibility for any actions with provided
   informations or codes. The copyright for any material created by the
   author is reserved. Any duplication of codes or texts provided here
   in electronic or printed publications is not permitted without the
   author's agreement.


  Info
  ----

   This code presents pretty effective and nasty debugger "on attach"
   detection. When debugger (every which uses debug apis) attach to the
   target process NtContinue function is executed, this acts BEFORE
   debugger stops on DebugBreak, so we have the ability to do some
   nasty things while debugger is still loading the process, i think
   you know what possibilities it gives.

   So here it comes, have fun:

$


include    my_macro.inc


      @get_api_addr   "NTDLL.DLL","NtContinue"
      xchg   ebx,eax

      call   a1
      dd   0
a1:      push   PAGE_READWRITE
      push   5
      push   ebx
      @callx   VirtualProtect
      @check   0,"Error: cannot deprotect the region!"

      lea   edi,_NtContinue_b
      mov   ecx,0Fh
      mov   esi,ebx
      rep   movsb

      lea   eax,_NtContinue
      mov   edi,ebx
      call    make_jump
      
      @debug    "attach debugger to me now!",MB_ICONINFORMATION



exit:      mov   byte ptr [flag],1
      push    0
      @callx    ExitProcess

make_jump:
      pushad
      mov   byte ptr [edi],0E9h
      sub   eax,edi
      sub   eax,5
      mov   dword ptr [edi+1],eax
      popad
      ret

flag      db   0

_NtContinue:   pushad
      cmp   byte ptr [flag],0
      jne   we_q
      @debug   "Debugger found!",MB_ICONERROR
we_q:      popad



_NtContinue_b:   db   0Fh dup (0)

comment $      
      77F5B638 > B8 20000000      MOV EAX,20
      77F5B63D   BA 0003FE7F      MOV EDX,7FFE0300
      77F5B642   FFD2             CALL EDX
      77F5B644   C2 0800          RETN 8
$

end start