| ²é¿´: 233 | »Ø¸´: 0 | |||
| µ±Ç°Ö÷ÌâÒѾ´æµµ¡£ | |||
sdlj8051½ð³æ (ÖøÃûдÊÖ)
|
[½»Á÷]
[תÌù]Óõ¥²½¸ú×ÙAnti-Debugger
|
||
|
ÔÚµ÷ÊÔÆ÷ÖУ¬×¾ÁÓµÄdebuggerÊÇÓÃ0xcc À´¸ú×Ù´úÂ룬µ«od¾ÍÊÇÓñê־λ½øÐе¥²½¸ú×Ù,¼òµ¥µÄ˵¾ÍÊǰÑTFÖÃ룬Èç¹ûÎÒÃÇÓÐ×Ô¼ºµÄµ¥²½¸ú×Ù´úÂ룬odÈç¹ûͬʱҲ¸ú×ÙÁË£¬¾Í»á¡°ÎÞÊÓ¡±ÎÒÃÇ×Ô¼ºµÄ´úÂë....´ïµ½antiµÄÄ¿µÄ ´úÂëÈçÏÂ: ;===============================cut============================== ;Author:Comic.Liu .386 .model flat,stdcall option casemap :none include windows.inc include user32.inc includelib user32.lib include kernel32.inc includelib kernel32.lib .const .data szT db 'Title',0 szM db 'You Are Passed',0 .code SEH proc pExcept WORD,pFrame WORD,pContext WORD,pDispatch WORDpushad assume esi:ptr EXEPTION_RECORD,edi:ptr CONTEXT mov esi,[pExcept] mov edi,[pContext] mov ebx,[edi].regEip inc ebx cmp byte ptr[ebx],0 org $-1 popfd jz fin or [edi].regFlag,100h jmp fin1 fin: inc [edi].regEip fin1: popad mov eax,ExceptionContinueExecution ret SEH endp start: assume fs:nothing push offset SEH push fs:[0] mov fs:[0],esp pushfd pushfd or dword ptr[esp],100h popfd ;½øÈëÕâÒ»¶Î´úÂë¾ÍÇÌÇÌÁË nop ret ;=======End============ ;²»¹ý¿ÉÒÔÓÃODÀïµÄF4Ö±½ÓÌø¹ýÉÏÃæÄÇÒ»¶Î,µ½ÏÂÃæ popfd invoke MessageBox,NULL,offset szM,offset szT,NULL pop fs:[0] add esp,4 invoke ExitProcess,0 end start ;==========================finish=========================== ³ÌÐòÔÚnop´¦ÒÔSingle Stepʼþ½øÈëseh ÔÚsehÀïÃæ£¬ÐÞ¸ÄeipÌø¹ý´úÂë:ret Èç¹ûod¸ú×Ù,¾Í½Ø¶ÏÁËsingle step,seh¾Í²»»áÔËÐÐÁË£¬È»ºó¾Í³ö´í [ Last edited by sdlj8051 on 2006-10-6 at 11:26 ] |
» ²ÂÄãϲ»¶
Ò»Ö¾Ô¸»¦9£¬326ÇóÉúÎïѧµ÷¼Á
ÒѾÓÐ7È˻ظ´
»¯¹¤Ñ§Ë¶294·Ö£¬Çóµ¼Ê¦ÊÕÁô
ÒѾÓÐ24È˻ظ´
085600²ÄÁÏÓ뻯¹¤329·ÖÇóµ÷¼Á
ÒѾÓÐ10È˻ظ´
284Çóµ÷¼Á
ÒѾÓÐ10È˻ظ´
¸´ÊÔµ÷¼Á
ÒѾÓÐ18È˻ظ´
310Çóµ÷¼Á
ÒѾÓÐ16È˻ظ´
274Çóµ÷¼Á
ÒѾÓÐ7È˻ظ´
245Çóµ÷¼Á
ÒѾÓÐ7È˻ظ´
Óб¬ÁÏ£¬Ò»¸öÇàÄê½ÌʦÂô·¿µÃ400Íò£¬È»ºó»»ÁËÒ»¸öËÄÇàñ×Ó
ÒѾÓÐ11È˻ظ´
290Çóµ÷¼Á
ÒѾÓÐ15È˻ظ´














WORD,pFrame
»Ø¸´´ËÂ¥