unit PEBMain;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, ComCtrls;

type
  TForm1 = class(TForm)
    StatusBar1: TStatusBar;
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

//***************************************
//使用PEB結構檢測OllyDBG
//***************************************
function AntiLoader():Boolean; //檢測調試器;
var
  YInt,NInt:Integer;
begin
  asm
    mov eax,fs:[$30]
    //獲取PEB偏移2h處BeingDebugged的值
    movzx eax,byte ptr[eax+$2]
    or al,al
    jz @No
    jnz @Yes
    @No:
      mov NInt,1
    @Yes:
      Mov YInt,1
  end;
  if YInt=1 then
    Result:=True;
  if NInt=1 then
    Result:=False;
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
  if AntiLoader then
    MessageBox(Handle,'發現調試器!','提示',MB_OK+MB_ICONINFORMATION)
  else
    MessageBox(Handle,'未發現調試器!','提示',MB_OK+MB_ICONINFORMATION);
end;

end.