反调试(国外英语资料).doc

反调试(国外英语资料) 1. program window handle detection Rationale: use FindWindow function to find the same window class name and title of the window, if found, it shows that OD is running //******************************************** / / through the search window class name to detect OllyDBG //******************************************** Function, AntiLoader (): Boolean; Const OllyName=OLLYDBG; Var Hwnd:Thandle; Begin Hwnd:=FindWindow (OllyName, nil); If Hwnd0 then Result:=True Else Result:=False; End; Procedure TForm1.FormCreate (Sender: TObject); Begin If AntiLoader then MessageBox (Handle, find debugger , prompt , MB_OK+MB_ICONINFORMATION) Else MessageBox (Handle, did not find debugger , prompt , MB_OK+MB_ICONINFORMATION) End; 2. thread environment block detection Principle: the use of RING3 under the debugger to executable program debugging, the debugger will be debugging executable as a sub thread tracking. The structure of PEB offset 0x02 is then debugging executable program of the BeingDebugged value is 1, if the executable program is not debugging, the value is 0 so, can use this value to detect whether the program is RING3 under the debugger to debug //*************************************** The use of PEB / structure detection OllyDBG //*************************************** Function (AntiLoader): Boolean; / / debugger detection; Var YInt, NInt:Integer; Begin ASM MOV, eax, fs:[$30] / / get PEB offset 2H BeingDebugged value Movzx, eax, byte, ptr[eax+$2] Or, Al, Al JZ @No JNZ @Yes @No: Mov NInt, 1 @Yes: Mov YInt, 1 End; If YInt=1 then Result:=True; If NInt=1 then Result:=False; End; Procedure TForm1.FormCreate (Sender: TObject); Begin If AntiLoader then MessageBox (Handle, found debugger! , prompt, MB_OK+MB_ICONINFORMATION) Else MessageBox (Handle, no debugger was found, prompt, MB_OK+MB_ICONINFORMATION); End; 3. using API function IsDebuggerPresent detection Principle: the operating system will be debugged object set to run in the special environment, and the AP