#pragma once
#include <Windows.h>
#include "anti_attach.h"
#include "../../skStr.h"


#define DbgBreakPoint_FUNC_SIZE 0x2
#define DbgUiRemoteBreakin_FUNC_SIZE 0x54
#define NtContinue_FUNC_SIZE 0x18

struct FUNC {
	const char* name;
	FARPROC addr;
	SIZE_T size;
};

FUNC funcList[] = {
	{ skCrypt("DbgBreakPoint").decrypt(), 0, DbgBreakPoint_FUNC_SIZE },
	{ skCrypt("DbgUiRemoteBreakin").decrypt(), 0, DbgUiRemoteBreakin_FUNC_SIZE },
	{ skCrypt("NtContinue").decrypt(), 0, NtContinue_FUNC_SIZE }
};


void AntiAttach() {
	while (true)
	{
		DWORD pid = GetCurrentProcessId();

		WCHAR modName[MAX_PATH] = { 0 };
		HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);

		HMODULE hMod = LoadLibraryA(skCrypt("ntdll.dll").decrypt());
		for (int i = 0; i < _countof(funcList); ++i) {
			funcList[i].addr = GetProcAddress(hMod, funcList[i].name);
		}

		bool result = false;
		auto base_address = GetModuleHandleA(0);
		if (wcsstr((WCHAR*)base_address, skCrypt(L"ntdll").decrypt()) || wcsstr((WCHAR*)base_address, skCrypt(L"NTDLL").decrypt())) {
			exit(1);
		}

		CloseHandle(hProcess);
	}
}
