反调试防护-API1

IsDebuggerPresent()

CheckRemoteDebuggerPresent()

其内部实际调用NtQueryInformationProcess()

bool _stdcall ThreadCall()
{
	
	while (true)
	{
		BOOL  pbDebuggerPresent = FALSE;
		CheckRemoteDebuggerPresent(GetCurrentProcess(), &pbDebuggerPresent);
		if (pbDebuggerPresent !=0)
		{
			printf("debug\n");
			system("pause");
			exit(-1);
		}
		if (IsDebuggerPresent()!=0)
		{
			printf("debug\n");
			system("pause");
			exit(-1);
		}
	}
}

int main()
{
	CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)ThreadCall, NULL, 0, NULL);
	system("pause");
	return 0;
}

---

FS/GS寄存器

debug标志：

X86：FS：0x30

FS指向TEB，FS：30指向PEB，PEB+2指向debug标志。

X64:  GS：0x60

GS指向TEB，GS：60指向PEB，PEB+2指向debug标志。

---

NtGlobalFlag标志：

在PEB里面

---

—raedfsdword()：

bool _stdcall ThreadCall()
{
	
	while (true)
	{
		//	DWORD dwPeb = __readfsdword(0x30);
		//	UCHAR BeingDebugged = *(UCHAR *)(dwPeb + 2);
		
		//	ULONGLONG ullPeb = __readgsqword(0x60);
		//	UCHAR BeingDebugged = *(UCHAR *)(ullPeb + 2);

		//	DWORD dwPeb = __readfsdword(0x30);
		//	DWORD NtGlobalFlag = *(DWORD *)(dwPeb + 0x68);
		//  if (NtGlobalFlag == 0x70) printf("debug");

		//	ULONGLONG dwPeb = __readgsqword(0x60);
		//	DWORD NtGlobalFlag = *(DWORD *)(dwPeb + 0xbc);
		//  if (NtGlobalFlag == 0x70) printf("debug");
	}
}

int main()
{
	CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)ThreadCall, NULL, 0, NULL);
	system("pause");
	return 0;
}

---

Heap标志：

bool _stdcall ThreadCall()
{
	
	while (true)
	{
		/*DWORD dwPeb = __readfsdword(0x30);
		DWORD ProcessHeap = *(DWORD*)(dwPeb + 0x18);
		DWORD dwFlags = *(DWORD*)(ProcessHeap + 0x40);
		DWORD dwForceFlags = *(DWORD*)(ProcessHeap + 0x44);
		if (dwFlags != 0x2 || dwForceFlags != 0)
		{
			printf("debug\n");
			system("pause");
			exit(0);
		}*/
		UINT64 dwPeb = __readgsqword(0x60);
		UINT64 ProcessHeap = *(PUINT64)(dwPeb + 0x30);
		DWORD dwFlags = *(DWORD*)(ProcessHeap + 0x70);
		DWORD dwForceFlags = *(DWORD*)(ProcessHeap + 0x74);
		if (dwFlags != 0x2 || dwForceFlags != 0)
		{
			printf("debug\n");
			system("pause");
			exit(0);
		}
	}
}

int main()
{
	CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)ThreadCall, NULL, 0, NULL);
	system("pause");
	return 0;
}

---

上面有些都是依靠api，如果对方挂钩了，api就失效，只有手动实现标志位检查

ZwQueryInformationProcess手动实现

拿PEB：

bool _stdcall ThreadCall()
{
	MyZwQueryInformationProcess Func = (MyZwQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "ZwQueryInformationProcess");
	PROCESS_BASIC_INFORMATION pbi = { 0 };
	while (true)
	{
		Func(GetCurrentProcess(), ProcessBasicInformation, &pbi, sizeof(pbi), NULL);
		CHAR flag = *((PCHAR)(pbi.PebBaseAddress) + 2);
		if (flag == TRUE)
		{
			printf("debug\n");
			system("pause");
			exit(0);
		}
	}
}

int main()
{
	CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)ThreadCall, NULL, 0, NULL);
	system("pause");
	return 0;
}

调试端口：

bool _stdcall ThreadCall()
{
	MyZwQueryInformationProcess Func = (MyZwQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "ZwQueryInformationProcess");
	DWORD isDebugPort = 0;
	while (true)
	{
		Func(GetCurrentProcess(), ProcessDebugPort, &isDebugPort, sizeof(isDebugPort), NULL);
		if (isDebugPort == TRUE)
		{
			printf("debug\n");
			system("pause");
			exit(0);
		}
	}
}

int main()
{
	CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)ThreadCall, NULL, 0, NULL);
	system("pause");
	return 0;
}

隐藏端口：

    DWORD isProcessDebugFlags = 0;
	func(GetCurrentProcess(), (PROCESSINFOCLASS)0x1F, &isProcessDebugFlags,             sizeof(isProcessDebugFlags), NULL);
	if (isProcessDebugFlags == 0)
	{
		printf("debug\n");
		system("pause");
		exit(0);
	}



DWORD isProcessDebugObjectHandle = 0;
	func(GetCurrentProcess(), (PROCESSINFOCLASS)0x1E, &isProcessDebugObjectHandle, sizeof(isProcessDebugObjectHandle), NULL);
	if (isProcessDebugObjectHandle != 0)
	{
		printf("debug\n");
		system("pause");
		exit(0);
	}