在 C:\Windows\System32 目录下有一个 WUDFPlatform.dll , 这个 dll 中有三个导出函数 —— WudfIsAnyDebuggerPresent,WudfIsKernelDebuggerPresent,WudfIsUserDebuggerPresent:
代码示例:
// Test_Console_1.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//
#include <iostream>
#include <Windows.h>
using namespace std;
typedef INT(NTAPI* pWudfIsAnyDebuggerPresent)();
typedef INT(NTAPI* pWudfIsKernelDebuggerPresent)();
typedef INT(NTAPI* pWudfIsUserDebuggerPresent)();
int main()
{
HMODULE h_wudf = LoadLibrary(L"WUDFPlatform.dll");
if (h_wudf == NULL) {
cout << "WUDFPlatform.dll LoadLibrary failed." << endl;
goto main_end;
}
// WudfIsAnyDebuggerPresent
pWudfIsAnyDebuggerPresent WudfIsAnyDebuggerPresent = (pWudfIsAnyDebuggerPresent)GetProcAddress(h_wudf, "WudfIsAnyDebuggerPresent");
if (WudfIsAnyDebuggerPresent == NULL) {
cout << "WudfIsAnyDebuggerPresent GetProcAddress failed." << endl;
goto main_end;
}
if (WudfIsAnyDebuggerPresent() != 0) {
cout << "WudfIsAnyDebuggerPresent 发现调试器" << endl;
}
// WudfIsKernelDebuggerPresent
pWudfIsKernelDebuggerPresent WudfIsKernelDebuggerPresent = (pWudfIsKernelDebuggerPresent)GetProcAddress(h_wudf, "WudfIsKernelDebuggerPresent");
if (WudfIsKernelDebuggerPresent == NULL) {
cout << "WudfIsKernelDebuggerPresent GetProcAddress failed." << endl;
goto main_end;
}
if (WudfIsKernelDebuggerPresent() != 0) {
cout << "WudfIsKernelDebuggerPresent 发现调试器" << endl;
}
// pWudfIsUserDebuggerPresent
pWudfIsUserDebuggerPresent WudfIsUserDebuggerPresent = (pWudfIsUserDebuggerPresent)GetProcAddress(h_wudf, "WudfIsUserDebuggerPresent");
if (WudfIsUserDebuggerPresent == NULL) {
cout << "WudfIsUserDebuggerPresent GetProcAddress failed." << endl;
goto main_end;
}
if (WudfIsUserDebuggerPresent() != 0) {
cout << "WudfIsUserDebuggerPresent 发现调试器" << endl;
}
main_end:
getchar();
return 0;
}
效果图:
(1)正常情况下运行
(2)使用 VS 调试运行
(3) 放在双机调试的虚拟机里运行