Anti Debug 二

最新推荐文章于 2024-06-26 09:45:47 发布

pengdawei521

最新推荐文章于 2024-06-26 09:45:47 发布

阅读量416

点赞数

分类专栏： AntiVirus &amp; Reverse 文章标签：汇编 api c

本文链接：https://blog.csdn.net/pengdawei521/article/details/1803714

版权

AntiVirus & Reverse 专栏收录该内容

30 篇文章 0 订阅

订阅专栏

利用GetTickCount API的Anti Debug的例子, 反汇编代码：

004088C8 |. FF55 EC       CALL DWORD PTR SS:[EBP-14]               ; GetTickCount
004088CB |. 8945 F8       MOV DWORD PTR SS:[EBP-8],EAX；得到第一个GetTickCount值
004088CE |. 68 96000000   PUSH 96
004088D3 |. FF55 E8       CALL DWORD PTR SS:[EBP-18]               ; Slepp
004088D6 |. FF55 EC       CALL DWORD PTR SS:[EBP-14]               ; GetTickCount
004088D9 |. 8945 F4       MOV DWORD PTR SS:[EBP-C],EAX；得到第二个GetTickCount值
004088DC |. 68 96000000   PUSH 96
004088E1 |. FF55 E8       CALL DWORD PTR SS:[EBP-18]               ; Sleep
004088E4 |. FF55 EC       CALL DWORD PTR SS:[EBP-14]               ; GetTickCount
004088E7 |. 8945 F0       MOV DWORD PTR SS:[EBP-10],EAX；得到第三个GetTickCount值
004088EA |. 8B45 F4       MOV EAX,DWORD PTR SS:[EBP-C]
004088ED |. 2B45 F8       SUB EAX,DWORD PTR SS:[EBP-8]
004088F0 |. 83F8 64       CMP EAX,64     ；第二个GetTickCount与第一的差不能大小于等于0x64
004088F3 |. 7D 11         JGE SHORT IMG012_J.00408906
004088F5 |. 8B45 F0       MOV EAX,DWORD PTR SS:[EBP-10]
004088F8 |. 2B45 F8       SUB EAX,DWORD PTR SS:[EBP-8]
004088FB |. 3D FA000000   CMP EAX,0FA   ；第三个GetTickCount与第一的差不能大小于等于0xFA
00408900 |. 7D 04         JGE SHORT IMG012_J.00408906
...
00408906 ...

DWORD dwTickCount1 = 0, dwTickCount2 = 0, dwTickCount3 = 0;
dwTickCount1 = GetTickCount();
Sleep(0x96);
GetTickCount2 = GetTickCount();
Sleep(0x96);
GetTickCount3 = GetTickCount();
if ((GetTickCount2 - GetTickCount1 >= 0x64) || (GetTickCount3 - GetTickCount1 >= 0xFA))
{
//Format (c:, d:, e:, f:);
exit(1);//或者打转转
}