[zt]一些检测调试器的方法

IsDebuggerPresent

.386
      .model flat, stdcall
      option casemap :none   ; case sensitive

      include /masm32/include/windows.inc
      include /masm32/include/user32.inc
      include /masm32/include/kernel32.inc

      includelib /masm32/lib/user32.lib
      includelib /masm32/lib/kernel32.lib

    .data
       DbgNotFoundTitle db "Debugger status:",0h
       DbgFoundTitle db "Debugger status:",0h
       DbgNotFoundText db "Debugger not found!",0h
       DbgFoundText db "Debugger found!",0h
    .code

start:

; MASM32 antiRing3Debugger example
; coded by ap0x
; Reversing Labs: http://ap0x.headcoders.net

; This example can detect all ring3 debuggers by accessing PEB!BeingDebuged.
; You can see this code in kernel32.dll!IsDebuggerPresent function.

ASSUME FS:NOTHING
MOV EAX,DWORD PTR FS:[18h]
MOV EAX,DWORD PTR DS:[EAX+30h]
MOVZX EAX,BYTE PTR DS:[EAX+2h]

CMP EAX,1
JE @DebuggerDetected

PUSH 40h
PUSH offset DbgNotFoundTitle
PUSH offset DbgNotFoundText
PUSH 0
CALL MessageBox

JMP @exit
  @DebuggerDetected:

PUSH 30h
PUSH offset DbgFoundTitle
PUSH offset DbgFoundText
PUSH 0
CALL MessageBox

  @exit:

PUSH 0
CALL ExitProcess

end start