├── IsDebuggerPresentAPI
    ├── IsDebuggerPresent.h
    ├── IsDebuggerPresentAPI.cpp
    ├── IsDebuggerPresentAPI.vcxproj
    ├── IsDebuggerPresentAPI.vcxproj.filters
    ├── IsDebuggerPresentAPI.vcxproj.user
    └── README.md
├── LICENSE
├── NtGlobalFlag
    ├── NtGlobalFlag.sln
    ├── NtGlobalFlag
    │   ├── AntiDBG.asm
    │   ├── NtGlobalFlag.cpp
    │   ├── NtGlobalFlag.vcxproj
    │   ├── NtGlobalFlag.vcxproj.filters
    │   ├── antidebug.h
    │   └── main.cpp
    └── README.md
├── README.md
└── TLS_callbacks
    ├── TLS_callbacks.sln
    └── TLS_callbacks
        ├── TLS_callback.h
        ├── TLS_callbacks.cpp
        ├── TLS_callbacks.vcxproj
        ├── TLS_callbacks.vcxproj.filters
        └── TLS_callbacks.vcxproj.user


/IsDebuggerPresentAPI/IsDebuggerPresent.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | 
3 | BOOL IsDebuggerPresentAPI();


--------------------------------------------------------------------------------
/IsDebuggerPresentAPI/IsDebuggerPresentAPI.cpp:
--------------------------------------------------------------------------------
 1 | // IsDebuggerPresentAPI.cpp : This file contains the 'main' function. Program execution begins and ends there.
 2 | //
 3 | 
 4 | #include <Windows.h>
 5 | #include <iostream>
 6 | #include "IsDebuggerPresent.h"
 7 | 
 8 | BOOL
 9 | IsDebuggerPresentAPI(
10 | 	VOID
11 | )
12 | /*++
13 | 
14 | Routine Description:
15 | 
16 | 	Calls the IsDebuggerPresent() API. This function is part of the
17 | 	Win32 Debugging API and it returns TRUE if a user mode debugger
18 | 	is present. Internally, it simply returns the value of the
19 | 	PEB->BeingDebugged flag.
20 | 
21 | Arguments:
22 | 
23 | 	None
24 | 
25 | Return Value:
26 | 
27 | 	TRUE - if debugger was detected
28 | 	FALSE - otherwise
29 | --*/
30 | {
31 | 	return IsDebuggerPresent();
32 | }
33 | 
34 | int main() {
35 | 	if (IsDebuggerPresent()) {
36 | 		ExitProcess(0);
37 | 	}
38 | 	else {
39 | 		printf("Do some evil things !");
40 | 	}
41 | }
42 | 
43 | 


--------------------------------------------------------------------------------
/IsDebuggerPresentAPI/IsDebuggerPresentAPI.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>16.0</VCProjectVersion>
 23 |     <Keyword>Win32Proj</Keyword>
 24 |     <ProjectGuid>{9435259f-2729-4d5b-8391-a9b0db31d1c7}</ProjectGuid>
 25 |     <RootNamespace>IsDebuggerPresentAPI</RootNamespace>
 26 |     <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
 27 |   </PropertyGroup>
 28 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 29 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 30 |     <ConfigurationType>Application</ConfigurationType>
 31 |     <UseDebugLibraries>true</UseDebugLibraries>
 32 |     <PlatformToolset>v142</PlatformToolset>
 33 |     <CharacterSet>Unicode</CharacterSet>
 34 |   </PropertyGroup>
 35 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 36 |     <ConfigurationType>Application</ConfigurationType>
 37 |     <UseDebugLibraries>false</UseDebugLibraries>
 38 |     <PlatformToolset>v142</PlatformToolset>
 39 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 40 |     <CharacterSet>Unicode</CharacterSet>
 41 |   </PropertyGroup>
 42 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 43 |     <ConfigurationType>Application</ConfigurationType>
 44 |     <UseDebugLibraries>true</UseDebugLibraries>
 45 |     <PlatformToolset>v142</PlatformToolset>
 46 |     <CharacterSet>Unicode</CharacterSet>
 47 |   </PropertyGroup>
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 49 |     <ConfigurationType>Application</ConfigurationType>
 50 |     <UseDebugLibraries>false</UseDebugLibraries>
 51 |     <PlatformToolset>v142</PlatformToolset>
 52 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 53 |     <CharacterSet>Unicode</CharacterSet>
 54 |   </PropertyGroup>
 55 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 56 |   <ImportGroup Label="ExtensionSettings">
 57 |   </ImportGroup>
 58 |   <ImportGroup Label="Shared">
 59 |   </ImportGroup>
 60 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 61 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 62 |   </ImportGroup>
 63 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 64 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 65 |   </ImportGroup>
 66 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 67 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 68 |   </ImportGroup>
 69 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 70 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 71 |   </ImportGroup>
 72 |   <PropertyGroup Label="UserMacros" />
 73 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 74 |     <LinkIncremental>true</LinkIncremental>
 75 |   </PropertyGroup>
 76 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 77 |     <LinkIncremental>false</LinkIncremental>
 78 |   </PropertyGroup>
 79 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 80 |     <LinkIncremental>true</LinkIncremental>
 81 |   </PropertyGroup>
 82 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 83 |     <LinkIncremental>false</LinkIncremental>
 84 |   </PropertyGroup>
 85 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 86 |     <ClCompile>
 87 |       <WarningLevel>Level3</WarningLevel>
 88 |       <SDLCheck>true</SDLCheck>
 89 |       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 90 |       <ConformanceMode>true</ConformanceMode>
 91 |     </ClCompile>
 92 |     <Link>
 93 |       <SubSystem>Console</SubSystem>
 94 |       <GenerateDebugInformation>true</GenerateDebugInformation>
 95 |     </Link>
 96 |   </ItemDefinitionGroup>
 97 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 98 |     <ClCompile>
 99 |       <WarningLevel>Level3</WarningLevel>
100 |       <FunctionLevelLinking>true</FunctionLevelLinking>
101 |       <IntrinsicFunctions>true</IntrinsicFunctions>
102 |       <SDLCheck>true</SDLCheck>
103 |       <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
104 |       <ConformanceMode>true</ConformanceMode>
105 |     </ClCompile>
106 |     <Link>
107 |       <SubSystem>Console</SubSystem>
108 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
109 |       <OptimizeReferences>true</OptimizeReferences>
110 |       <GenerateDebugInformation>true</GenerateDebugInformation>
111 |     </Link>
112 |   </ItemDefinitionGroup>
113 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
114 |     <ClCompile>
115 |       <WarningLevel>Level3</WarningLevel>
116 |       <SDLCheck>true</SDLCheck>
117 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
118 |       <ConformanceMode>true</ConformanceMode>
119 |     </ClCompile>
120 |     <Link>
121 |       <SubSystem>Console</SubSystem>
122 |       <GenerateDebugInformation>true</GenerateDebugInformation>
123 |     </Link>
124 |   </ItemDefinitionGroup>
125 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
126 |     <ClCompile>
127 |       <WarningLevel>Level3</WarningLevel>
128 |       <FunctionLevelLinking>true</FunctionLevelLinking>
129 |       <IntrinsicFunctions>true</IntrinsicFunctions>
130 |       <SDLCheck>true</SDLCheck>
131 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
132 |       <ConformanceMode>true</ConformanceMode>
133 |     </ClCompile>
134 |     <Link>
135 |       <SubSystem>Console</SubSystem>
136 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
137 |       <OptimizeReferences>true</OptimizeReferences>
138 |       <GenerateDebugInformation>false</GenerateDebugInformation>
139 |     </Link>
140 |   </ItemDefinitionGroup>
141 |   <ItemGroup>
142 |     <ClCompile Include="IsDebuggerPresentAPI.cpp" />
143 |   </ItemGroup>
144 |   <ItemGroup>
145 |     <ClInclude Include="IsDebuggerPresent.h" />
146 |   </ItemGroup>
147 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
148 |   <ImportGroup Label="ExtensionTargets">
149 |   </ImportGroup>
150 | </Project>


--------------------------------------------------------------------------------
/IsDebuggerPresentAPI/IsDebuggerPresentAPI.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="Source Files">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="Header Files">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="Resource Files">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |   </ItemGroup>
17 |   <ItemGroup>
18 |     <ClCompile Include="IsDebuggerPresentAPI.cpp">
19 |       <Filter>Source Files</Filter>
20 |     </ClCompile>
21 |   </ItemGroup>
22 |   <ItemGroup>
23 |     <ClInclude Include="IsDebuggerPresent.h">
24 |       <Filter>Header Files</Filter>
25 |     </ClInclude>
26 |   </ItemGroup>
27 | </Project>


--------------------------------------------------------------------------------
/IsDebuggerPresentAPI/IsDebuggerPresentAPI.vcxproj.user:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 |   <PropertyGroup />
4 | </Project>


--------------------------------------------------------------------------------
/IsDebuggerPresentAPI/README.md:
--------------------------------------------------------------------------------
 1 | ### Complexity Low
 2 | 
 3 | 
 4 | # Description
 5 | 
 6 | One of the most widely used anti-debugging techniques is called IsDebuggerPresent(), this simple API call used so oftenly by malware developers because it’s relatively  easy to use.  
 7 | 
 8 | The function kernel32!IsDebuggerPresent() determines whether the current process is being debugged by a user-mode debugger such as x64dbg. Generally, the function only checks the BeingDebugged flag of the Process Environment Block (PEB), if the BeingDebugged flag is true then malware exits itself without executing any malicious functions.
 9 | 
10 | **Example of Assembly Code**
11 | 
12 | ![1](https://user-images.githubusercontent.com/42712921/183047524-b90d3331-7f3a-4409-b183-d5716971c9df.PNG)
13 | 
14 | 
15 | ![2](https://user-images.githubusercontent.com/42712921/183048001-122e005e-0d4c-4142-a582-337d54d0b5c7.png)
16 | 
17 | 
18 | # Reversing Technique (Tips & Tricks)
19 | 
20 | In order to perform a Reverse Engineering on this example, we write a dummy application to understand the anti-debugging technique itself and tips for malware analysts on how to defeat that.
21 | 
22 | We can examine the compiled dummy application on IDA pro, it can show us the basic usage of IsDebuggerPresent() API, we can read that Assembly code as; if this application is debugging then go to the ExitProcess function else do some evil things. 
23 | 
24 | ![6](https://user-images.githubusercontent.com/42712921/183048940-1fe8a3a4-b9db-45e1-832e-3dc0992c0ed4.PNG)
25 | 
26 | So the question is how to evade that anti-debug check and continue the execution. After setting breakpoint on IsDebuggerPresent() API, we can step through and examine the RAX register on the debugger, we can clearly see that it stores a boolean data which is 1 (True).
27 | 
28 | ![7](https://user-images.githubusercontent.com/42712921/183051053-b03b1adf-a85f-4df1-83bc-5cf0f262e01e.PNG)
29 | 
30 | Remember,  kernel32!IsDebuggerPresent() is looking for the BeingDebugged flag inside the PEB Structure, that flag only has true or false data which is boolean, if we can set this RAX data to 0 we can easily evade this anti-debugging.
31 | 
32 | 
33 | ![9](https://user-images.githubusercontent.com/42712921/183051132-f1b998f3-b4f3-4c3a-aeb9-6e65e33e29ea.PNG)
34 | 
35 | After setting the RAX to 0, we can now execute the code.
36 | 
37 | 
38 | 
39 | https://user-images.githubusercontent.com/42712921/183051452-28811640-6a72-4e75-96de-f7213d7a030e.mp4
40 | 
41 | 
42 | 
43 | 
44 | 
45 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2022 Arda Büyükkaya
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/NtGlobalFlag/NtGlobalFlag.sln:
--------------------------------------------------------------------------------
 1 | 
 2 | Microsoft Visual Studio Solution File, Format Version 12.00
 3 | # Visual Studio Version 17
 4 | VisualStudioVersion = 17.2.32630.192
 5 | MinimumVisualStudioVersion = 10.0.40219.1
 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NtGlobalFlag", "NtGlobalFlag\NtGlobalFlag.vcxproj", "{11C98684-F94A-410D-B83C-97677683135D}"
 7 | EndProject
 8 | Global
 9 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | 		Debug|x64 = Debug|x64
11 | 		Debug|x86 = Debug|x86
12 | 		Release|x64 = Release|x64
13 | 		Release|x86 = Release|x86
14 | 	EndGlobalSection
15 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | 		{11C98684-F94A-410D-B83C-97677683135D}.Debug|x64.ActiveCfg = Debug|x64
17 | 		{11C98684-F94A-410D-B83C-97677683135D}.Debug|x64.Build.0 = Debug|x64
18 | 		{11C98684-F94A-410D-B83C-97677683135D}.Debug|x86.ActiveCfg = Debug|Win32
19 | 		{11C98684-F94A-410D-B83C-97677683135D}.Debug|x86.Build.0 = Debug|Win32
20 | 		{11C98684-F94A-410D-B83C-97677683135D}.Release|x64.ActiveCfg = Release|x64
21 | 		{11C98684-F94A-410D-B83C-97677683135D}.Release|x64.Build.0 = Release|x64
22 | 		{11C98684-F94A-410D-B83C-97677683135D}.Release|x86.ActiveCfg = Release|Win32
23 | 		{11C98684-F94A-410D-B83C-97677683135D}.Release|x86.Build.0 = Release|Win32
24 | 	EndGlobalSection
25 | 	GlobalSection(SolutionProperties) = preSolution
26 | 		HideSolutionNode = FALSE
27 | 	EndGlobalSection
28 | 	GlobalSection(ExtensibilityGlobals) = postSolution
29 | 		SolutionGuid = {5DF7AA72-A666-4AF4-AA70-4848F8C9DE4D}
30 | 	EndGlobalSection
31 | EndGlobal
32 | 


--------------------------------------------------------------------------------
/NtGlobalFlag/NtGlobalFlag/AntiDBG.asm:
--------------------------------------------------------------------------------
 1 | _TEXT SEGMENT
 2 | 
 3 | ; The PUBLIC modifier will make your function visible and callable outside
 4 | 
 5 | PUBLIC NtGlobalFlagx64
 6 | 
 7 | 
 8 | NtGlobalFlagx64 PROC
 9 |     xor rax, rax                ; clear eax
10 |     mov rax, gs:[60h]           ; Reference start of the PEB
11 |     mov rax, [rax + 0BCh]       ; PEB+0xBC points to NtGlobalFlag
12 |     and rax, 70h                ; check three flags
13 |     ret	                        ; return flag value into 'rax' which puts into 'found'
14 | NtGlobalFlagx64 ENDP
15 | 
16 | 
17 | 
18 | 
19 | _TEXT ENDS
20 |  
21 | END


--------------------------------------------------------------------------------
/NtGlobalFlag/NtGlobalFlag/NtGlobalFlag.cpp:
--------------------------------------------------------------------------------
 1 | #include <cinttypes>
 2 | #include <Windows.h>
 3 | #include "antidebug.h"
 4 | 
 5 | #define SHOW_DEBUG_MESSAGES
 6 | 
 7 | void DBG_MSG(WORD dbg_code, const char* message)
 8 | {
 9 | #ifdef SHOW_DEBUG_MESSAGES
10 |     printf("[MSG-0x%X]: %s\n", dbg_code, message);
11 |     MessageBoxA(NULL, message, "GAME OVER!", 0);
12 | #endif
13 | }
14 | 
15 | 
16 | /*
17 |  * Want to inspect the value of something in the PEB? Launch WinDBG,
18 |  * Attach to, or launch a process and run this command:
19 |  * dt ntdll!_PEB @$peb -r
20 |  * Want more info on NtGlobalFlag? See these resources:
21 |  * https://www.aldeid.com/wiki/PEB-Process-Environment-Block/NtGlobalFlag
22 |  * https://www.geoffchappell.com/studies/windows/win32/ntdll/api/rtl/regutil/getntglobalflags.htm
23 |  */
24 | void NtGlobalFlag(void)
25 | {
26 |     BOOL found = FALSE;
27 | 
28 | #ifdef _WIN64
29 |     found = NtGlobalFlagx64();
30 | #else
31 |     _asm
32 |     {
33 |         xor eax, eax;			// clear eax
34 |         mov eax, fs: [0x30] ;	// Reference start of the PEB
35 |         mov eax, [eax + 0x68];	// PEB+0x68 points to NtGlobalFlag
36 |         and eax, 0x00000070;	// check three flags:
37 |                                 //   FLG_HEAP_ENABLE_TAIL_CHECK   (0x10)
38 |                                 //   FLG_HEAP_ENABLE_FREE_CHECK   (0x20)
39 |                                 //   FLG_HEAP_VALIDATE_PARAMETERS (0x40)
40 |         mov found, eax;			// Copy result into 'found'
41 |     }
42 | #endif
43 | 
44 |     if (found)
45 |     {
46 |         DBG_MSG(DBG_NTGLOBALFLAGPEB, "Caught by NtGlobalFlag check!");
47 |         exit(DBG_NTGLOBALFLAGPEB);
48 |     }
49 | }
50 | 
51 | 


--------------------------------------------------------------------------------
/NtGlobalFlag/NtGlobalFlag/NtGlobalFlag.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>16.0</VCProjectVersion>
 23 |     <Keyword>Win32Proj</Keyword>
 24 |     <ProjectGuid>{11c98684-f94a-410d-b83c-97677683135d}</ProjectGuid>
 25 |     <RootNamespace>NtGlobalFlag</RootNamespace>
 26 |     <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
 27 |   </PropertyGroup>
 28 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 29 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 30 |     <ConfigurationType>Application</ConfigurationType>
 31 |     <UseDebugLibraries>true</UseDebugLibraries>
 32 |     <PlatformToolset>v143</PlatformToolset>
 33 |     <CharacterSet>Unicode</CharacterSet>
 34 |   </PropertyGroup>
 35 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 36 |     <ConfigurationType>Application</ConfigurationType>
 37 |     <UseDebugLibraries>false</UseDebugLibraries>
 38 |     <PlatformToolset>v143</PlatformToolset>
 39 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 40 |     <CharacterSet>Unicode</CharacterSet>
 41 |   </PropertyGroup>
 42 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 43 |     <ConfigurationType>Application</ConfigurationType>
 44 |     <UseDebugLibraries>true</UseDebugLibraries>
 45 |     <PlatformToolset>v143</PlatformToolset>
 46 |     <CharacterSet>Unicode</CharacterSet>
 47 |   </PropertyGroup>
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 49 |     <ConfigurationType>Application</ConfigurationType>
 50 |     <UseDebugLibraries>false</UseDebugLibraries>
 51 |     <PlatformToolset>v143</PlatformToolset>
 52 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 53 |     <CharacterSet>Unicode</CharacterSet>
 54 |   </PropertyGroup>
 55 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 56 |   <ImportGroup Label="ExtensionSettings">
 57 |     <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
 58 |   </ImportGroup>
 59 |   <ImportGroup Label="Shared">
 60 |   </ImportGroup>
 61 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 62 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 63 |   </ImportGroup>
 64 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 65 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 66 |   </ImportGroup>
 67 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 68 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 69 |   </ImportGroup>
 70 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 71 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 72 |   </ImportGroup>
 73 |   <PropertyGroup Label="UserMacros" />
 74 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 75 |     <ClCompile>
 76 |       <WarningLevel>Level3</WarningLevel>
 77 |       <SDLCheck>true</SDLCheck>
 78 |       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 79 |       <ConformanceMode>true</ConformanceMode>
 80 |     </ClCompile>
 81 |     <Link>
 82 |       <SubSystem>Console</SubSystem>
 83 |       <GenerateDebugInformation>true</GenerateDebugInformation>
 84 |     </Link>
 85 |   </ItemDefinitionGroup>
 86 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 87 |     <ClCompile>
 88 |       <WarningLevel>Level3</WarningLevel>
 89 |       <FunctionLevelLinking>true</FunctionLevelLinking>
 90 |       <IntrinsicFunctions>true</IntrinsicFunctions>
 91 |       <SDLCheck>true</SDLCheck>
 92 |       <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 93 |       <ConformanceMode>true</ConformanceMode>
 94 |     </ClCompile>
 95 |     <Link>
 96 |       <SubSystem>Console</SubSystem>
 97 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
 98 |       <OptimizeReferences>true</OptimizeReferences>
 99 |       <GenerateDebugInformation>true</GenerateDebugInformation>
100 |     </Link>
101 |   </ItemDefinitionGroup>
102 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
103 |     <ClCompile>
104 |       <WarningLevel>Level3</WarningLevel>
105 |       <SDLCheck>true</SDLCheck>
106 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
107 |       <ConformanceMode>true</ConformanceMode>
108 |     </ClCompile>
109 |     <Link>
110 |       <SubSystem>Console</SubSystem>
111 |       <GenerateDebugInformation>true</GenerateDebugInformation>
112 |     </Link>
113 |   </ItemDefinitionGroup>
114 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
115 |     <ClCompile>
116 |       <WarningLevel>Level3</WarningLevel>
117 |       <FunctionLevelLinking>true</FunctionLevelLinking>
118 |       <IntrinsicFunctions>true</IntrinsicFunctions>
119 |       <SDLCheck>true</SDLCheck>
120 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
121 |       <ConformanceMode>true</ConformanceMode>
122 |     </ClCompile>
123 |     <Link>
124 |       <SubSystem>Console</SubSystem>
125 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
126 |       <OptimizeReferences>true</OptimizeReferences>
127 |       <GenerateDebugInformation>false</GenerateDebugInformation>
128 |     </Link>
129 |   </ItemDefinitionGroup>
130 |   <ItemGroup>
131 |     <ClCompile Include="main.cpp" />
132 |     <ClCompile Include="NtGlobalFlag.cpp" />
133 |   </ItemGroup>
134 |   <ItemGroup>
135 |     <ClInclude Include="antidebug.h" />
136 |   </ItemGroup>
137 |   <ItemGroup>
138 |     <MASM Include="AntiDBG.asm">
139 |       <FileType>Document</FileType>
140 |     </MASM>
141 |   </ItemGroup>
142 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
143 |   <ImportGroup Label="ExtensionTargets">
144 |     <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
145 |   </ImportGroup>
146 | </Project>


--------------------------------------------------------------------------------
/NtGlobalFlag/NtGlobalFlag/NtGlobalFlag.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="Source Files">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="Header Files">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="Resource Files">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |   </ItemGroup>
17 |   <ItemGroup>
18 |     <ClCompile Include="NtGlobalFlag.cpp">
19 |       <Filter>Source Files</Filter>
20 |     </ClCompile>
21 |     <ClCompile Include="main.cpp">
22 |       <Filter>Source Files</Filter>
23 |     </ClCompile>
24 |   </ItemGroup>
25 |   <ItemGroup>
26 |     <ClInclude Include="antidebug.h">
27 |       <Filter>Header Files</Filter>
28 |     </ClInclude>
29 |   </ItemGroup>
30 |   <ItemGroup>
31 |     <MASM Include="AntiDBG.asm">
32 |       <Filter>Header Files</Filter>
33 |     </MASM>
34 |   </ItemGroup>
35 | </Project>


--------------------------------------------------------------------------------
/NtGlobalFlag/NtGlobalFlag/antidebug.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | #include <cinttypes>
 3 | #include <Windows.h>
 4 | #include <Winternl.h>
 5 | #include <stdio.h>
 6 | #include <Tlhelp32.h>
 7 | // Error Codes
 8 | enum DBG_CATCH
 9 | {
10 | 	DBG_NONE = 0x0000,
11 | 
12 | 	// Memory Codes (0x1000 range)
13 | 	DBG_BEINGEBUGGEDPEB = 0x1000,
14 | 	DBG_CHECKREMOTEDEBUGGERPRESENT = 0x1001,
15 | 	DBG_ISDEBUGGERPRESENT = 0x1002,
16 | 	DBG_NTGLOBALFLAGPEB = 0x1003,
17 | 	DBG_NTQUERYINFORMATIONPROCESS = 0x1004,
18 | 	DBG_FINDWINDOW = 0x1005,
19 | 	DBG_OUTPUTDEBUGSTRING = 0x1006,
20 | 	DBG_NTSETINFORMATIONTHREAD = 0x1007,
21 | 	DBG_DEBUGACTIVEPROCESS = 0x1008,
22 | 	DBG_PROCESSFILENAME = 0x1009,
23 | 
24 | 	// CPU Codes (0x2000 range)
25 | 	DBG_HARDWAREDEBUGREGISTERS = 0x2000,
26 | 	DBG_MOVSS = 0x2001,
27 | 
28 | 	// Timing Codes (0x3000 range)
29 | 	DBG_RDTSC = 0x3000,
30 | 	DBG_QUERYPERFORMANCECOUNTER = 0x3001,
31 | 	DBG_GETTICKCOUNT = 0x3002,
32 | 
33 | 	// Exception Codes (0x4000 range)
34 | 	DBG_CLOSEHANDLEEXCEPTION = 0x4000,
35 | 	DBG_SINGLESTEPEXCEPTION = 0x4001,
36 | 	DBG_INT3CC = 0x4002,
37 | 	DBG_PREFIXHOP = 0x4003,
38 | };
39 | 
40 | // Debugging messages
41 | void DBG_MSG(WORD dbg_code, char* message);
42 | 
43 | 
44 | #ifdef _WIN64
45 | extern "C"
46 | {
47 | 	int NtGlobalFlagx64(void);
48 | };
49 | #endif
50 | 
51 | // Memory
52 | 
53 | void NtGlobalFlag(void);
54 | 


--------------------------------------------------------------------------------
/NtGlobalFlag/NtGlobalFlag/main.cpp:
--------------------------------------------------------------------------------
 1 | #include "antidebug.h"
 2 | 
 3 | int main(int argc, char* argv[])
 4 | {
 5 | 
 6 | 	NtGlobalFlag();
 7 | 
 8 | 	MessageBoxA(NULL, "Congratulations! You made it!", "You Win!", 0);
 9 | 
10 | 	return 0;
11 | }


--------------------------------------------------------------------------------
/NtGlobalFlag/README.md:
--------------------------------------------------------------------------------
 1 | ### Complexity Low
 2 | 
 3 | # Description
 4 | 
 5 | NtGlobalFlag is a similar technique like IsDebuggerPresent, because both of them read values from PEB Structure to detect if the Software is debugged or not.  NtGlobalFlag is also located in the PEB Structure, when the process is being debugged the NtGlobalFlag is set to 0x70. 
 6 | 
 7 | Below picture from WinDBG is showing the PEB Structure when the Software is being debugged :   
 8 | 
 9 | ![2](https://user-images.githubusercontent.com/42712921/184474254-a11ad572-9a06-4b98-82a7-9ab74074a5f7.PNG)
10 | 
11 | We developed our Software to show a error message then exit itself, whenever the NtGlobalFlag equal to 0x70 : 
12 | 
13 | ![1](https://user-images.githubusercontent.com/42712921/184474306-7daf0fd9-d19f-4190-b035-0f64a641e1b5.PNG)
14 | 
15 | ## Reversing Technique (Tips & Tricks)
16 | 
17 | In order to evade this Anti Debugging technique, we can use a similar tactic just like on IsDebuggerPresent or we can hide our PEB Structure while debugging on x64DBG, I will show both of them 
18 | 
19 | NULL the RAX :
20 | 
21 | After setting breakpoint at the return (ret) of the Anti debugging function, we can now step over to ret then change the RAX data to 0, this will evade the Anti Debugging technique which is same as like IsDebuggerPresent one
22 | 
23 | 
24 | ![RAX](https://user-images.githubusercontent.com/42712921/184475907-d5a027dd-8493-4bba-952a-04e5825fbef7.PNG)
25 | 
26 | Change the value from RAX register (x64)
27 | 
28 | ![NULL](https://user-images.githubusercontent.com/42712921/184475892-90fb5583-7972-40a9-90d7-1004327ac3b1.PNG)
29 | 
30 | After the execution we can see it beat the Anti Debugging :
31 | 
32 | 
33 | ![wİN](https://user-images.githubusercontent.com/42712921/184475933-c59c7c58-5857-437c-8cd9-04ac11a1b573.PNG)
34 | 
35 | 
36 | We can also able to automate this process by an awesome feature of  x64DBG, it help us to hide our PEB Structure which means, debugged software no longer read data from PEB
37 | ![Animation](https://user-images.githubusercontent.com/42712921/184476023-46a9bec2-8eb5-4f97-b4b1-9b0d4107686b.gif)
38 | 
39 | 
40 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Antidebug
2 | Defeating Anti-Debugging Techniques for Malware Analysis
3 | 


--------------------------------------------------------------------------------
/TLS_callbacks/TLS_callbacks.sln:
--------------------------------------------------------------------------------
 1 | 
 2 | Microsoft Visual Studio Solution File, Format Version 12.00
 3 | # Visual Studio Version 17
 4 | VisualStudioVersion = 17.2.32630.192
 5 | MinimumVisualStudioVersion = 10.0.40219.1
 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TLS_callbacks", "TLS_callbacks\TLS_callbacks.vcxproj", "{7B379FB2-975F-4E69-A87D-3410BE7425F6}"
 7 | EndProject
 8 | Global
 9 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | 		Debug|x64 = Debug|x64
11 | 		Debug|x86 = Debug|x86
12 | 		Release|x64 = Release|x64
13 | 		Release|x86 = Release|x86
14 | 	EndGlobalSection
15 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | 		{7B379FB2-975F-4E69-A87D-3410BE7425F6}.Debug|x64.ActiveCfg = Debug|x64
17 | 		{7B379FB2-975F-4E69-A87D-3410BE7425F6}.Debug|x64.Build.0 = Debug|x64
18 | 		{7B379FB2-975F-4E69-A87D-3410BE7425F6}.Debug|x86.ActiveCfg = Debug|Win32
19 | 		{7B379FB2-975F-4E69-A87D-3410BE7425F6}.Debug|x86.Build.0 = Debug|Win32
20 | 		{7B379FB2-975F-4E69-A87D-3410BE7425F6}.Release|x64.ActiveCfg = Release|x64
21 | 		{7B379FB2-975F-4E69-A87D-3410BE7425F6}.Release|x64.Build.0 = Release|x64
22 | 		{7B379FB2-975F-4E69-A87D-3410BE7425F6}.Release|x86.ActiveCfg = Release|Win32
23 | 		{7B379FB2-975F-4E69-A87D-3410BE7425F6}.Release|x86.Build.0 = Release|Win32
24 | 	EndGlobalSection
25 | 	GlobalSection(SolutionProperties) = preSolution
26 | 		HideSolutionNode = FALSE
27 | 	EndGlobalSection
28 | 	GlobalSection(ExtensibilityGlobals) = postSolution
29 | 		SolutionGuid = {5764D74F-7576-45AE-99A4-4CF5FBEB02A8}
30 | 	EndGlobalSection
31 | EndGlobal
32 | 


--------------------------------------------------------------------------------
/TLS_callbacks/TLS_callbacks/TLS_callback.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | static volatile HANDLE tls_callback_thread_event = 0;
 4 | static volatile HANDLE tls_callback_process_event = 0;
 5 | static volatile UINT32 tls_callback_thread_data = 0;
 6 | static volatile UINT32 tls_callback_process_data = 0;
 7 | 
 8 | VOID WINAPI tls_callback(PVOID hModule, DWORD dwReason, PVOID pContext);
 9 | BOOL TLSCallbackThread();
10 | BOOL TLSCallbackProcess();


--------------------------------------------------------------------------------
/TLS_callbacks/TLS_callbacks/TLS_callbacks.cpp:
--------------------------------------------------------------------------------
 1 | #include "windows.h"
 2 | #include <stdio.h>
 3 | 
 4 | void NTAPI __stdcall TLSCallbacks(PVOID DllHandle, DWORD dwReason, PVOID Reserved);
 5 | //linker spec
 6 | #ifdef _M_IX86
 7 | #pragma comment (linker, "/INCLUDE:__tls_used")
 8 | #pragma comment (linker, "/INCLUDE:__tls_callback")
 9 | #else
10 | #pragma comment (linker, "/INCLUDE:_tls_used")
11 | #pragma comment (linker, "/INCLUDE:_tls_callback")
12 | #endif
13 | EXTERN_C
14 | #ifdef _M_X64
15 | #pragma const_seg (".CRT$XLB")
16 | const
17 | #else
18 | #pragma data_seg (".CRT$XLB")
19 | #endif
20 | //end linker
21 | 
22 | //tls import
23 | PIMAGE_TLS_CALLBACK _tls_callback = TLSCallbacks;
24 | #pragma data_seg ()
25 | #pragma const_seg ()
26 | //end 
27 | // tls declaration
28 | void NTAPI __stdcall TLSCallbacks(PVOID DllHandle, DWORD dwReason, PVOID Reserved)
29 | {
30 | 	MessageBox(nullptr, L"TLS Callback before main", L"Hello Debugger", 0);
31 | 	ExitProcess(0);
32 | }
33 | 
34 | // end declaration
35 | 
36 | int main(int argc, char* argv[])
37 | {
38 | 	printf("Main Function is never executed");
39 | }


--------------------------------------------------------------------------------
/TLS_callbacks/TLS_callbacks/TLS_callbacks.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>16.0</VCProjectVersion>
 23 |     <Keyword>Win32Proj</Keyword>
 24 |     <ProjectGuid>{7b379fb2-975f-4e69-a87d-3410be7425f6}</ProjectGuid>
 25 |     <RootNamespace>TLScallbacks</RootNamespace>
 26 |     <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
 27 |   </PropertyGroup>
 28 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 29 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 30 |     <ConfigurationType>Application</ConfigurationType>
 31 |     <UseDebugLibraries>true</UseDebugLibraries>
 32 |     <PlatformToolset>v143</PlatformToolset>
 33 |     <CharacterSet>Unicode</CharacterSet>
 34 |   </PropertyGroup>
 35 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 36 |     <ConfigurationType>Application</ConfigurationType>
 37 |     <UseDebugLibraries>false</UseDebugLibraries>
 38 |     <PlatformToolset>v143</PlatformToolset>
 39 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 40 |     <CharacterSet>Unicode</CharacterSet>
 41 |   </PropertyGroup>
 42 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 43 |     <ConfigurationType>Application</ConfigurationType>
 44 |     <UseDebugLibraries>true</UseDebugLibraries>
 45 |     <PlatformToolset>v143</PlatformToolset>
 46 |     <CharacterSet>Unicode</CharacterSet>
 47 |   </PropertyGroup>
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 49 |     <ConfigurationType>Application</ConfigurationType>
 50 |     <UseDebugLibraries>false</UseDebugLibraries>
 51 |     <PlatformToolset>v143</PlatformToolset>
 52 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 53 |     <CharacterSet>Unicode</CharacterSet>
 54 |   </PropertyGroup>
 55 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 56 |   <ImportGroup Label="ExtensionSettings">
 57 |   </ImportGroup>
 58 |   <ImportGroup Label="Shared">
 59 |   </ImportGroup>
 60 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 61 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 62 |   </ImportGroup>
 63 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 64 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 65 |   </ImportGroup>
 66 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 67 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 68 |   </ImportGroup>
 69 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 70 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 71 |   </ImportGroup>
 72 |   <PropertyGroup Label="UserMacros" />
 73 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 74 |     <ClCompile>
 75 |       <WarningLevel>Level3</WarningLevel>
 76 |       <SDLCheck>true</SDLCheck>
 77 |       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 78 |       <ConformanceMode>true</ConformanceMode>
 79 |       <LanguageStandard>stdcpp17</LanguageStandard>
 80 |       <PrecompiledHeader>NotUsing</PrecompiledHeader>
 81 |     </ClCompile>
 82 |     <Link>
 83 |       <SubSystem>Console</SubSystem>
 84 |       <GenerateDebugInformation>true</GenerateDebugInformation>
 85 |     </Link>
 86 |   </ItemDefinitionGroup>
 87 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 88 |     <ClCompile>
 89 |       <WarningLevel>Level3</WarningLevel>
 90 |       <FunctionLevelLinking>true</FunctionLevelLinking>
 91 |       <IntrinsicFunctions>true</IntrinsicFunctions>
 92 |       <SDLCheck>true</SDLCheck>
 93 |       <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 94 |       <ConformanceMode>true</ConformanceMode>
 95 |       <LanguageStandard>stdcpp17</LanguageStandard>
 96 |       <PrecompiledHeader>NotUsing</PrecompiledHeader>
 97 |     </ClCompile>
 98 |     <Link>
 99 |       <SubSystem>Console</SubSystem>
100 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
101 |       <OptimizeReferences>true</OptimizeReferences>
102 |       <GenerateDebugInformation>true</GenerateDebugInformation>
103 |     </Link>
104 |   </ItemDefinitionGroup>
105 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
106 |     <ClCompile>
107 |       <WarningLevel>Level3</WarningLevel>
108 |       <SDLCheck>true</SDLCheck>
109 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
110 |       <ConformanceMode>true</ConformanceMode>
111 |       <LanguageStandard>stdcpp17</LanguageStandard>
112 |       <PrecompiledHeader>NotUsing</PrecompiledHeader>
113 |     </ClCompile>
114 |     <Link>
115 |       <SubSystem>Console</SubSystem>
116 |       <GenerateDebugInformation>true</GenerateDebugInformation>
117 |     </Link>
118 |   </ItemDefinitionGroup>
119 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
120 |     <ClCompile>
121 |       <WarningLevel>Level3</WarningLevel>
122 |       <FunctionLevelLinking>true</FunctionLevelLinking>
123 |       <IntrinsicFunctions>true</IntrinsicFunctions>
124 |       <SDLCheck>true</SDLCheck>
125 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
126 |       <ConformanceMode>true</ConformanceMode>
127 |       <LanguageStandard>stdcpp17</LanguageStandard>
128 |       <PrecompiledHeader>NotUsing</PrecompiledHeader>
129 |     </ClCompile>
130 |     <Link>
131 |       <SubSystem>Console</SubSystem>
132 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
133 |       <OptimizeReferences>true</OptimizeReferences>
134 |       <GenerateDebugInformation>true</GenerateDebugInformation>
135 |     </Link>
136 |   </ItemDefinitionGroup>
137 |   <ItemGroup>
138 |     <ClCompile Include="TLS_callbacks.cpp" />
139 |   </ItemGroup>
140 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
141 |   <ImportGroup Label="ExtensionTargets">
142 |   </ImportGroup>
143 | </Project>


--------------------------------------------------------------------------------
/TLS_callbacks/TLS_callbacks/TLS_callbacks.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="Source Files">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="Header Files">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="Resource Files">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |   </ItemGroup>
17 |   <ItemGroup>
18 |     <ClCompile Include="TLS_callbacks.cpp">
19 |       <Filter>Source Files</Filter>
20 |     </ClCompile>
21 |   </ItemGroup>
22 | </Project>


--------------------------------------------------------------------------------
/TLS_callbacks/TLS_callbacks/TLS_callbacks.vcxproj.user:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 |   <PropertyGroup />
4 | </Project>


--------------------------------------------------------------------------------