src/AntiDebugging/AntiDebugging/AntiDump.cs
/// <summary>
/// WARNING! It breaks applications which are obfuscated.
/// </summary>
WARNING. It breaks applications which are obfuscated.
WARNING . It breaks applications which are obfuscated .
[SuppressMessage("ReSharper", "ForCanBeConvertedToForeach")]
        public static void ProtectDump()
        {
            var process = System.Diagnostics.Process.GetCurrentProcess();
            if (process.MainModule != null)
            {
                var baseAddress = process.MainModule.BaseAddress;
                var dwpeheader = System.Runtime.InteropServices.Marshal.ReadInt32((IntPtr)(baseAddress.ToInt32() + 0x3C));
                var wnumberofsections = System.Runtime.InteropServices.Marshal.ReadInt16((IntPtr)(baseAddress.ToInt32() + dwpeheader + 0x6));
                EraseSection(baseAddress, 30);
                for (var i = 0; i < Peheaderdwords.Length; i++)
                {
                    EraseSection((IntPtr)(baseAddress.ToInt32() + dwpeheader + Peheaderdwords[i]), 4);
                }
                for (var i = 0; i < Peheaderwords.Length; i++)
                {
                    EraseSection((IntPtr)(baseAddress.ToInt32() + dwpeheader + Peheaderwords[i]), 2);
                }
                for (var i = 0; i < Peheaderbytes.Length; i++)
                {
                    EraseSection((IntPtr)(baseAddress.ToInt32() + dwpeheader + Peheaderbytes[i]), 1);
                }
                var x = 0;
                var y = 0;
                while (x <= wnumberofsections)
                {
                    if (y == 0)
                    {
                        EraseSection((IntPtr)((baseAddress.ToInt32() + dwpeheader + 0xFA + (0x28 * x)) + 0x20), 2);
                    }
                    EraseSection((IntPtr)((baseAddress.ToInt32() + dwpeheader + 0xFA + (0x28 * x)) + Sectiontabledwords[y]), 4);
                    y++;
                    if (y == Sectiontabledwords.Length)
                    {
                        x++;
                        y = 0;
                    }
                }
            }
        }
[ SuppressMessage ( " " , " " ) ] public static void ProtectDump ( ) { var process = System . Diagnostics . Process . GetCurrentProcess ( ) ; if ( process . MainModule != null ) { var baseAddress = process . MainModule . BaseAddress ; var dwpeheader = System . Runtime . InteropServices . Marshal . ReadInt32 ( ( IntPtr ) ( baseAddress . ToInt32 ( ) + 0x3C ) ) ; var wnumberofsections = System . Runtime . InteropServices . Marshal . ReadInt16 ( ( IntPtr ) ( baseAddress . ToInt32 ( ) + dwpeheader + 0x6 ) ) ; EraseSection ( baseAddress , 30 ) ; for ( var i = 0 ; i < Peheaderdwords . Length ; i ++ ) { EraseSection ( ( IntPtr ) ( baseAddress . ToInt32 ( ) + dwpeheader + Peheaderdwords [ i ] ) , 4 ) ; } for ( var i = 0 ; i < Peheaderwords . Length ; i ++ ) { EraseSection ( ( IntPtr ) ( baseAddress . ToInt32 ( ) + dwpeheader + Peheaderwords [ i ] ) , 2 ) ; } for ( var i = 0 ; i < Peheaderbytes . Length ; i ++ ) { EraseSection ( ( IntPtr ) ( baseAddress . ToInt32 ( ) + dwpeheader + Peheaderbytes [ i ] ) , 1 ) ; } var x = 0 ; var y = 0 ; while ( x <= wnumberofsections ) { if ( y == 0 ) { EraseSection ( ( IntPtr ) ( ( baseAddress . ToInt32 ( ) + dwpeheader + 0xFA + ( 0x28 * x ) ) + 0x20 ) , 2 ) ; } EraseSection ( ( IntPtr ) ( ( baseAddress . ToInt32 ( ) + dwpeheader + 0xFA + ( 0x28 * x ) ) + Sectiontabledwords [ y ] ) , 4 ) ; y ++ ; if ( y == Sectiontabledwords . Length ) { x ++ ; y = 0 ; } } } }
WARNING!
WARNING!