سؤال حول كتابة Plugin لتجاوز دالة IsDebuggerPresent

PHP كود :
__kernel_entry NTSTATUS NtQueryInformationProcess(
  IN HANDLE           ProcessHandle,
  IN PROCESSINFOCLASS ProcessInformationClass,
  OUT PVOID           ProcessInformation,
  IN ULONG            ProcessInformationLength,
  OUT PULONG          ReturnLength
); 

PHP كود :
type
  //-----------------------------------------
 PEB = record
    Reserved1: array [0 .. 1] of Byte;
    BeingDebugged: Byte;
    Reserved2: Byte;
    Reserved3: array [0 .. 1] of Pointer;
    Ldr: Pointer;
    Reserved4: array [0 .. 102] of Byte;
    Reserved5: array [0 .. 51] of Pointer;
    PostProcessInitRoutine: Pointer;
    Reserved6: array [0 .. 127] of Byte;
    Reserved7: Pointer;
    SessionId: ULONG;
  end;
  //-----------------------------------------
    PROCESS_BASIC_INFORMATION = record
    Reserved1: Pointer;
    PebBaseAddress: Pointer;
    Reserved2: array [0 .. 1] of Pointer;
    UniqueProcessId: cardinal;
    Reserved3: Pointer;
  end;
  //-----------------------------------------
function NtQueryInformationProcess(ProcessHandle: THANDLE; ProcessInformationClass: DWORD; ProcessInformation: Pointer;
ProcessInformationLength: ULONG; ReturnLength: PULONG): LongInt; stdcall; external 'ntdll.dll';

procedure TForm1.Button1Click(Sender: TObject);
  var
    TargetHandle : THandle;
    ProcessBasicInfo : PROCESS_BASIC_INFORMATION;
    length:cardinal;
    buf : PAnsiChar;
    EB : PEB;
    buffer : byte;
begin
    TargetHandle := findwindow(nil,'Target');
    memo1.Lines.add('handle : $' +IntToHex(TargetHandle,8));
    NtQueryInformationProcess(TargetHandle,0,@ProcessBasicInfo,sizeof(ProcessBasicInfo),@length);
    memo1.lines.Add('Pointer to PEB  : $' + Format('%p', [ProcessBasicInfo.PebBaseAddress]));
    ReadProcessMemory(TargetHandle, @ProcessBasicInfo.PebBaseAddress, @EB, sizeof(PEB), length);
    Memo1.Lines.Add('Being Debugged : ' + IntToStr(EB.BeingDebugged));
    end;
end. 

كود :
library AADebug;

uses
  SysUtils, plugin, Windows, Classes;

{$R *.res}

type
  PEB = record
    Reserved1: array [0 .. 1] of Byte;
    BeingDebugged: Byte;
  end;

  PROCESS_BASIC_INFORMATION = record
    Reserved1: Pointer;
    PebBaseAddress: Pointer;
  end;

resourcestring
  PLUGIN_NAME = 'Anti IsDebuggerPresent';

var
  g_hwndOlly: HWND;  // OllyDbg Window Handle
  ProcessBasicInfo : PROCESS_BASIC_INFORMATION;
  Length: Cardinal;
  EB : PEB;
  targethandle : Integer;

function ODBG_Plugininit(ollydbgversion: Integer; hWndOlly: HWND; features: PULONG): Integer; cdecl;
begin
  g_hwndOlly := hWndOlly;
  Addtolist(0, 0, PAnsiChar(PLUGIN_NAME));
  Result := 0;
end;

function ODBG_Plugindata(name: PChar): Integer; cdecl;
begin
  StrLCopy(name, PChar(PLUGIN_NAME), 32);
  Result := PLUGIN_VERSION;
end;

function NtQueryInformationProcess(ProcessHandle: THANDLE;
                                   ProcessInformationClass: DWORD;
                                   ProcessInformation: Pointer;
                                   ProcessInformationLength: ULONG;
                                   ReturnLength: PULONG): LongInt;
                                   stdcall; external 'ntdll.dll';


procedure Getinfo;
begin
  targethandle := PluginGetValue(VAL_HPROCESS);
  MessageBox(g_hwndOlly, PChar(IntToHex(targethandle,8)), PChar('info'), MB_ICONINFORMATION);
  NtQueryInformationProcess(targethandle, 0, @ProcessBasicInfo, sizeof(PEB), @length);
end;

procedure ODBG_Pluginaction(origin: Integer; action: Integer; pItem: Pointer); cdecl;
begin
  if (origin = PM_MAIN) then
  begin
    Getinfo;
  end;
end;

exports
  ODBG_Plugininit    name '_ODBG_Plugininit',
  ODBG_Plugindata    name '_ODBG_Plugindata',
  ODBG_Pluginaction  name '_ODBG_Pluginaction';
begin

end.

كود :

function GetProcessIsBeingDebugged(ProcessHandle: THandle; var IsBeingDebugged: Boolean): Boolean;
var
  DebugPort: PVOID;
  TargetProcessHandle: THandle;
  SourceProcessHandle: THandle;
  DuplicateResult: BOOL;
  DesiredAccess: ACCESS_MASK;
begin
  Result := False;
  try
    if (@NtQueryInformationProcess <> nil) then
    begin
      DuplicateResult := False;
      TargetProcessHandle := 0;
      DuplicateResult := DuplicateHandle(GetCurrentProcess(), ProcessHandle, GetCurrentProcess(), @TargetProcessHandle, 0, False, DUPLICATE_SAME_ACCESS);
      if DuplicateResult then
      begin
        try
          if NtQueryInformationProcess(
            TargetProcessHandle,
            7,
            @DebugPort,
            SizeOf(PVOID),
            nil
            ) = 0 then
            Result := True;
          if DebugPort <> nil then
            IsBeingDebugged := True;
        finally
          if TargetProcessHandle <> 0 then
            CloseHandle(TargetProcessHandle);
        end;
      end;
    end;
  except
  end;
end;