反调试（未完工）

wangzery

于 2017-02-22 11:41:36 发布

阅读量245

点赞数

分类专栏：逆向文章标签：逆向-反调试

本文链接：https://blog.csdn.net/WangZery/article/details/56482079

版权

逆向专栏收录该内容

0 篇文章 0 订阅

订阅专栏

bool FD_CheckRemoteDebuggerPresent()
{
DWORD pFuncAddr ;
HMODULE hDllHandle = GetModuleHandle(“kernel32.dll”);
if (INVALID_HANDLE_VALUE==hDllHandle)
return;
(DWORD&) pFuncAddr = GetProcAddress(hDllHandle, “CheckRemoteDebuggerPresent”);
if (pFuncAddr != NULL)
{
__asm
{
push eax;
push esp;
//hProcess
push 0xffffffff;
call pFuncAddr;
//error？
test eax,eax;
//error!
je rf_label;
//no error
pop eax;
test eax,eax
je rf_label;
}
return true;
rf_label:
return false;
}
}

bool FD_NtQueryInfoProc_DbgPort()
{
DWORD pFuncAddr ;
HMODULE hDllHandle = GetModuleHandle(“ntdll.dll”);
if (INVALID_HANDLE_VALUE==hDllHandle)
return;
(DWORD&) pFuncAddr = GetProcAddress(hDllHandle, “ZWQueryInformationProcess”);
if (pFuncAddr != NULL)
{
__asm{
push 0
push 4 ;ProcessInformationLength
push eax;ProcessInformation
push esp
push 7;ProcessDebugPort
push 0xffffffff ;ProcessHandle
call NtQueryInformationProcess
test eax,eax;
//error!
je rf_label;
//no error
pop eax;
test eax,eax
je rf_label;
}
return true;//正在被调试
rf_label:
return false;
}
}