#define PAGE_SIZE 0x1000
#define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)
#define STATUS_PROCEDURE_NOT_FOUND 0xC000007A
#define STATUS_INVALID_PAGE_PROTECTION 0xC0000045
#define STATUS_SECTION_PROTECTION 0xC000004E
#define STATUS_SUCCESS 0x00000000
typedefNTSYSCALLAPINTSTATUS(NTAPI*pNtProtectVirtualMemory)(_In_HANDLEProcessHandle,_Inout_PVOID*BaseAddress,_Inout_PSIZE_TRegionSize,_In_ULONGNewProtect,_Out_PULONGOldProtect);NTSTATUSEraseHeader(){// Retrieve our module's base addressautobase=CONTAINING_RECORD(NtCurrentPeb()->Ldr->InLoadOrderModuleList.Flink,LDR_DATA_TABLE_ENTRY,InLoadOrderLinks);// Retrieve ntdll's base addressautontdll=CONTAINING_RECORD(NtCurrentPeb()->Ldr->InLoadOrderModuleList.Flink->Flink,LDR_DATA_TABLE_ENTRY,InLoadOrderLinks);// Check if NtProtectVirtualMemory actually existsif(!GetProcAddress(reinterpret_cast<HMODULE>(ntdll),"NtProtectVirtualMemory")){SetLastError(ERROR_PROC_NOT_FOUND);returnSTATUS_PROCEDURE_NOT_FOUND;}// Retrieve its addressstaticauto_vprotect=reinterpret_cast<pNtProtectVirtualMemory>(GetProcAddress(reinterpret_cast<HMODULE>(ntdll),"NtProtectVirtualMemory"));// Change the protection of the 1st page of our PE (likely our PE header in memory)// to PAGE_READWRITE, so we can zero it out.ULONGoldProtect=0;SIZE_Tsize=PAGE_SIZE;autostatus=_vprotect(NtCurrentProcess(),reinterpret_cast<PVOID*>(base),&size,PAGE_READWRITE,&oldProtect);if(!NT_SUCCESS(status)){returnstatus;}// Zero out the whole page__try{RtlSecureZeroMemory(base,PAGE_SIZE);}// If somehow RtlSecureZeroMemory fails, restore protections__except(EXCEPTION_EXECUTE_HANDLER){ULONGdummy;_vprotect(NtCurrentProcess(),reinterpret_cast<PVOID*>(base),&size,oldProtect,&dummy);returnSTATUS_ACCESS_VIOLATION;}// Restore protections anywaystatus=_vprotect(NtCurrentProcess(),reinterpret_cast<PVOID*>(base),&size,oldProtect,&oldProtect);returnstatus;}