ClsAntiDebug

  • 0 Respuestas
  • 2489 Vistas

0 Usuarios y 1 Visitante están viendo este tema.

Desconectado [L]ord [R]NA

  • *
  • Underc0der
  • Mensajes: 89
  • Actividad:
    0%
  • Reputación 0
  • H-Sec
  • Twitter: lordrna
    • Ver Perfil

ClsAntiDebug

  • en: Junio 02, 2011, 12:14:34 pm
ClsAntidebug.h
Código: (cpp) You are not allowed to view links. Register or Login
#ifndef __ClsAntiDebug__
#define __ClsAntiDebug__
#include <windows.h>
#include <tlhelp32.h>
 
class ClsAntiDebug
{
private:
bool Debugged;
public:
ClsAntiDebug();
void __declspec() PEBDebug();
void __declspec() NTGlobalDebug();
void __declspec() DebuggerActive();
void __declspec() TimeStamp(int time, void *func);
void Protect(void *func);
bool IsDebugged();
};
#endif

ClsAntiDebug.cpp
Código: (cpp) You are not allowed to view links. Register or Login
#include "AntiDebug.h"
 
ClsAntiDebug::ClsAntiDebug()
{
this->Debugged=false;
}
 
bool ClsAntiDebug::IsDebugged()
{
return this->Debugged;
}
 
void __declspec() ClsAntiDebug::PEBDebug()
{
__asm
{
_PEBLoop:
push 500
call dword ptr ds:[Sleep]
xor edx, edx
mov dl,0x30
mov esi, fs:[edx]
movzx eax, byte ptr[esi+2]
dec eax
jne _PEBLoop
inc eax
}
this->Debugged = true;
}
 
void __declspec() ClsAntiDebug::NTGlobalDebug()
{
__asm
{
_NTLoop:
push 500
call dword ptr ds:[Sleep]
xor edx, edx
mov dl,0x30
mov esi, fs:[edx]
movzx eax, byte ptr[esi+0x68]
and eax,eax
je _NTLoop
xor eax,eax
inc eax
}
this->Debugged = true;
}
 
void __declspec() ClsAntiDebug::DebuggerActive()
{
HANDLE hProcSnap;
PROCESSENTRY32 pProcess;
LPTSTR Exename;
int strlength;
int deb[3]={18416231/*IDA Pro*/,997340682/*W32DASM*/,1853255255/*OllyDbg*/};
int i;
do
{
hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
pProcess.dwSize = sizeof(PROCESSENTRY32);
Process32First(hProcSnap,&pProcess);
do
{
strlength = strlen(pProcess.szExeFile);
__asm
{
lea eax,[pProcess.szExeFile]
mov ecx,dword ptr[strlength]
xor edx,edx
xor edi, edi
push edi
gethash:
pop edi
xor dl, byte ptr[eax+edi]
rol edx,8
inc edi
push edi
xor edi,ecx
jne gethash
mov [strlength],edx/*We don't need strlength, so we recycle to get
     The Hash on Int Variable*/
pop edi
}
for(i=0;i<3;i++)if (strlength==deb[i])
{
this->Debugged = true;
__asm{jmp ___end}
}
}while(Process32Next(hProcSnap,&pProcess));
Sleep(500);
}while(1);
__asm
{___end:}
}
void __declspec() ClsAntiDebug::Protect(void *func)
{
 
do
{
switch(GetTickCount()%4)
{
case 0:this->PEBDebug();break;
case 1:this->NTGlobalDebug();break;
case 2:this->DebuggerActive();break;
};
if (this->Debugged)
{
__asm
{
call [func]
}
}
Sleep(500);
}while(1);
}
 
void __declspec() ClsAntiDebug::TimeStamp(int time,void *func)
{
__asm
{
rdtsc
mov ebx,eax
call [func]
rdtsc
sub eax, ebx
cmp eax, [time]
jna ___rtend
}
this->Debugged = true;
__asm{___rtend: }
}


Modo de Uso:
Código: (cpp) You are not allowed to view links. Register or Login
#pragma comment(linker,"/ENTRY:main")
 
#include "AntiDebug.h"
void CALLBACK HolaMundo()
{
MessageBox(0,"Funcion","de Emergencia",0);
}
 
int __declspec() main()
{
 
ClsAntiDebug *Debugger=new(ClsAntiDebug);
Debugger->TimeStamp(200,HolaMundo);
if (Debugger->IsDebugged())MessageBox(0,"Hola","Mundo",0);
Debugger->Protect(HolaMundo);
return 0;
}