?? pebmain.~pas
字號:
unit PEBMain;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, ComCtrls;
type
TForm1 = class(TForm)
StatusBar1: TStatusBar;
procedure FormCreate(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
//***************************************
//使用PEB結構檢測OllyDBG
//***************************************
function AntiLoader():Boolean; //檢測調試器;
var
YInt,NInt:Integer;
begin
asm
mov eax,fs:[$30]
//獲取PEB偏移2h處BeingDebugged的值
movzx eax,byte ptr[eax+$2]
or al,al
jz @No
jnz @Yes
@No:
mov NInt,1
@Yes:
Mov YInt,1
end;
if YInt=1 then
Result:=True;
if NInt=1 then
Result:=False;
end;
procedure TForm1.FormCreate(Sender: TObject);
begin
if AntiLoader then
MessageBox(Handle,'發現調試器!','提示',MB_OK+MB_ICONINFORMATION)
else
MessageBox(Handle,'未發現調試器!','提示',MB_OK+MB_ICONINFORMATION);
end;
end.
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -