OK
sanx/:16
test..
感觉到是问题出在哪，毕竟代码不长，暂时没搞定，底子差呀，想听听理论（原理）
看来没人愿意去逆，放个源代码吧
#include <windows.h>
#include <stdio.h>
#include "peb.h"
#pragma comment(linker, "/subsystem:windows /entry:main")
//#pragma comment(linker,"/FIXED:NO")
#pragma comment(linker, "/SECTION:.text,REW" ) //设PE节：.text,可读可执行
#pragma comment(linker, "/MERGE:.data=.text") //合并到.text
#pragma comment(linker, "/MERGE:.rdata=.text")//合并到.text
void anti_attach();
BYTE isdebugger=0x94;
void anti_attach()
{
PPEB peb;
InitPeb(peb);
while(true)
{
if (peb->BeingDebugged != isdebugger)
TerminateProcess(GetCurrentProcess(),NULL);
Sleep(10);
}
}
int main()
{
PPEB peb;
InitPeb(peb);
peb->BeingDebugged = isdebugger;
CloseHandle(CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)anti_attach,NULL,NULL,NULL));
MessageBox(NULL,"CAN YOU ATTACH ME?","HMMM....",NULL);
TerminateProcess(GetCurrentProcess(),NULL);
return 0;
}
0X94是什么意思````
原帖由 fonge 于 2007-5-17 19:22 发表 https://www.chinapyg.com/images/common/back.gif
0X94是什么意思````
换成其他试试，换成0试试，换成1试试，再禁用HIDEOD试试
多试试就知道了:lol: :lol:
原帖由 海风月影 于 2007-5-18 18:46 发表 https://www.chinapyg.com/images/common/back.gif
换成其他试试，换成0试试，换成1试试，再禁用HIDEOD试试
多试试就知道了:lol: :lol:
感谢海风月影兄分享源码 /:09
学习一下。。。。。。
原帖由 海风月影 于 2007-5-17 15:07 发表 https://www.chinapyg.com/images/common/back.gif
看来没人愿意去逆，放个源代码吧
#include
#include
#include "peb.h"
#pragma comment(linker, "/subsystem:windows /entry:main")
//#pragma comment(linker,"/FIXED:NO")
#pragma comment(lin ...
PPEB是个WINDOWS预定义的结构体吗？额外建个线程去防护，不错。
不是预定义的，是自己写的
typedef void (*PPEBLOCKROUTINE)(PVOID PebLock);
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _RTL_DRIVE_LETTER_CURDIR {
USHORT Flags;
USHORT Length;
ULONG TimeStamp;
UNICODE_STRING DosPath;
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
typedef struct _PEB_LDR_DATA
{
ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
typedef struct _LDR_MODULE {
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID BaseAddress;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
SHORT LoadCount;
SHORT TlsIndex;
LIST_ENTRY HashTableEntry;
ULONG TimeDateStamp;
} LDR_MODULE, *PLDR_MODULE;
typedef struct _RTL_USER_PROCESS_PARAMETERS {
ULONG MaximumLength;
ULONG Length;
ULONG Flags;
ULONG DebugFlags;
PVOID ConsoleHandle;
ULONG ConsoleFlags;
HANDLE StdInputHandle;
HANDLE StdOutputHandle;
HANDLE StdErrorHandle;
UNICODE_STRING CurrentDirectoryPath;
HANDLE CurrentDirectoryHandle;
UNICODE_STRING DllPath;
UNICODE_STRING ImagePathName;
UNICODE_STRING CommandLine;
PVOID Environment;
ULONG StartingPositionLeft;
ULONG StartingPositionTop;
ULONG Width;
ULONG Height;
ULONG CharWidth;
ULONG CharHeight;
ULONG ConsoleTextAttributes;
ULONG WindowFlags;
ULONG ShowWindowFlags;
UNICODE_STRING WindowTitle;
UNICODE_STRING DesktopName;
UNICODE_STRING ShellInfo;
UNICODE_STRING RuntimeData;
RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory;
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
typedef struct _PEB_FREE_BLOCK {
struct _PEB_FREE_BLOCK *Next;
ULONG Size;
} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
typedef struct _PEB {
BOOLEAN InheritedAddressSpace;
BOOLEAN ReadImageFileExecOptions;
BOOLEAN BeingDebugged;
BOOLEAN Spare;
HANDLE Mutant;
PVOID ImageBaseAddress;
PPEB_LDR_DATA LoaderData;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
PVOID SubSystemData;
PVOID ProcessHeap;
PVOID FastPebLock;
PPEBLOCKROUTINE FastPebLockRoutine;
PPEBLOCKROUTINE FastPebUnlockRoutine;
ULONG EnvironmentUpdateCount;
PVOID *KernelCallbackTable;
PVOID EventLogSection;
PVOID EventLog;
PPEB_FREE_BLOCK FreeList;
ULONG TlsExpansionCounter;
PVOID TlsBitmap;
ULONG TlsBitmapBits;
PVOID ReadOnlySharedMemoryBase;
PVOID ReadOnlySharedMemoryHeap;
PVOID *ReadOnlyStaticServerData;
PVOID AnsiCodePageData;
PVOID OemCodePageData;
PVOID UnicodeCaseTableData;
ULONG NumberOfProcessors;
ULONG NtGlobalFlag;
BYTE Spare2;
LARGE_INTEGER CriticalSectionTimeout;
ULONG HeapSegmentReserve;
ULONG HeapSegmentCommit;
ULONG HeapDeCommitTotalFreeThreshold;
ULONG HeapDeCommitFreeBlockThreshold;
ULONG NumberOfHeaps;
ULONG MaximumNumberOfHeaps;
PVOID **ProcessHeaps;
PVOID GdiSharedHandleTable;
PVOID ProcessStarterHelper;
PVOID GdiDCAttributeList;
PVOID LoaderLock;
ULONG OSMajorVersion;
ULONG OSMinorVersion;
ULONG OSBuildNumber;
ULONG OSPlatformId;
ULONG ImageSubSystem;
ULONG ImageSubSystemMajorVersion;
ULONG ImageSubSystemMinorVersion;
ULONG GdiHandleBuffer;
ULONG PostProcessInitRoutine;
ULONG TlsExpansionBitmap;
BYTE TlsExpansionBitmapBits;
ULONG SessionId;
} PEB, *PPEB;
看不懂，/:L 貌似我比较笨了