我正在Microsoft的Visual Studio 2022上编写一个简单的C++项目，该项目使用NtQueryInformationProcess来检查进程是否正在调试但不工作。
下面是我的代码：

#include "Header.h"
#include <iostream>
#include <winternl.h>
#include<Windows.h>

// Method use Debug flags in the PEB. This worked and return a = 1
int PEB_Flag() {
    int a;
    __asm {
        mov eax, dword ptr fs : [18h]
        mov eax, dword ptr ds : [eax + 30h]
        movzx eax, byte ptr ds : [eax + 2h]
        mov[a], eax
    }
    return a;
}

typedef enum _PROCESSINFOCLASS {
    ProcessBasicInformation = 0,
    ProcessDebugPort = 7,
    ProcessWow64Information = 26,
    ProcessImageFileName = 27,
    ProcessBreakOnTermination = 29
} PROCESSINFOCLASS;

typedef NTSTATUS(NTAPI* TNtQueryInformationProcess)(
    IN HANDLE           ProcessHandle,
    IN PROCESSINFOCLASS ProcessInformationClass,
    OUT PVOID           ProcessInformation,
    IN ULONG            ProcessInformationLength,
    OUT PULONG          ReturnLength
    );
int main() {
    HANDLE ProcessHandler = OpenProcess(PROCESS_ALL_ACCESS, TRUE, GetCurrentProcessId());

    HMODULE hNtdll = LoadLibraryA("ntdll.dll");
    //HINSTANCE hNtDll = GetModuleHandleW(L"ntdll.dll");
    std::cout << "hNtdll: " << std::hex << hNtdll << std::endl;

    auto pfnNtQueryInformationProcess = (TNtQueryInformationProcess)GetProcAddress(
        hNtdll, "NtQueryInformationProcess");
    DWORD dwProcessDebugPort, dwReturned;
    NTSTATUS status = pfnNtQueryInformationProcess(
        //GetCurrentProcess(),
        ProcessHandler,
        ProcessDebugPort,
        &dwProcessDebugPort,
        sizeof(DWORD),
        &dwReturned);


    a = int(status);
    std::cout << "Is debugged: " << a << std::endl;

    std::cout << "OK ?";
    std::cin >> a; // I set a breakpoint here
}

我构建它，在调试模式和realease模式下运行它，它会打印“Is debugged：0”，这是错误的，因为此进程正在调试中。我知道我的代码有问题，因为我尝试了方法检查调试器标志，它打印“1”。