프로그램 ANTI-DUMP 적용

메모리상에서 이미지 베이스 부터 500 Byte 까지 Null (0) 으로 덮어씌워 PE 헤더를 손상시켜 덤프를 뜰수 없게 합니다.

 

 

Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Private Declare Function VirtualProtectEx Lib "kernel32.dll" (ByVal hProcess As Long, ByRef lpAddress As Any, ByVal dwSize As Long, ByVal flNewProtect As Long, ByRef lpflOldProtect As Long) As Long
Private Declare Function WriteProcessMemory Lib "kernel32.dll" (ByVal hProcess As Long, ByRef lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long
Private Declare Function CloseHandle Lib "kernel32.dll" (ByVal hObject As Long) As Long

Private Function AntiDump()
Dim han As Long, Hexdata(99) As Byte, lOld As Long

han = OpenProcess(&H1F0FFF, 0, GetCurrentProcessId)

VirtualProtectEx han, ByVal &H9E0000, 100, &H40, lOld ' 읽기+쓰기+실행 속성으로 변경
WriteProcessMemory han, ByVal &H9E0000, Hexdata(0), 100, ByVal 0&  ' 메모리를 조작한다.
VirtualProtectEx han, ByVal &H9E0000, 100, lOld, ByVal 0& ' 원래 속성으로 다시 고친다.

' 쓰레드를 재개한다.


' 더 이상 조작할 일이 없으므로 핸들을 닫아준다.


CloseHandle han

End Function