各種反调试技术原理与实例VC版.docVIP

反调试技术 2 发现OD的处理 2 1. 窗口类名、窗口名 3 2. 检测调试器进程 4 3. 父进程是否是Explorer 5 4. RDTSC/ GetTickCount时间敏感程序段 6 5. StartupInfo结构 7 6. BeingDebugged 8 7. PEB.NtGlobalFlag , Heap.HeapFlags, Heap.ForceFlags 9 8. DebugPort: CheckRemoteDebuggerPresent()/NtQueryInformationProcess() 12 9. SetUnhandledExceptionFilter/ Debugger Interrupts 14 10. Trap Flag单步标志异常 16 11. SeDebugPrivilege 进程权限 17 12. DebugObject: NtQueryObject() 18 13. OllyDbg：Guard Pages 21 14. Software Breakpoint Detection 23 15. Hardware Breakpoints Detection 25 16. PatchingDetection CodeChecksumCalculation补丁检测，代码检验和 26 17. block input封锁键盘、鼠标输入 27 18.