Anti-Debugging Technology (Delphi version)

1. program Window Handle Detection
Principle: Use the FindWindow function to find a window with the same window class name and caption, if found, it means that OD is running
//********************************************
Detect ollydbg by looking up the window class name
//********************************************
function Antiloader (): Boolean;
Const
Ollyname= ' ollydbg ';
Var
Hwnd:thandle;
Begin
Hwnd:=findwindow (Ollyname,nil);
If Hwnd<>0 Then
Result:=true
Else
Result:=false;
End
Procedure Tform1.formcreate (Sender:tobject);
Begin
If Antiloader Then
MessageBox (Handle, ' Find debugger! ', ' hints ', mb_ok+mb_iconinformation)
Else
MessageBox (Handle, ' Debugger not found! ', ' hint ', mb_ok+mb_iconinformation)
End

2. Using thread environment block detection
Principle: When debugging an executable program with a debugger at the ring3 level, the debugger will track the debugger as a sub-thread. At this point the PEB structure of the debugger that is being debugged is offset by a value of 1 beingdebugged at 0x02, if the executables are not debugged, The value is 0, so you can use this value to detect if the program is being debugged by the debugger at the ring3 level
//***************************************
Using the PEB structure to detect ollydbg
//***************************************
function Antiloader (): Boolean; Detection debugger;
Var
Yint,nint:integer;
Begin
Asm
MOV eax,fs:[$30]
Gets the value of beingdebugged at PEB offset 2h
MOVZX Eax,byte Ptr[eax+$2]
or Al,al
JZ @No
JNZ @Yes
@No:
MOV nint,1
@Yes:
Mov yint,1
End
If Yint=1 Then
Result:=true;
If Nint=1 Then
Result:=false;
End
Procedure Tform1.formcreate (Sender:tobject);
Begin
If Antiloader Then
MessageBox (Handle, ' Discover debugger! ', ' hint ', mb_ok+mb_iconinformation)
Else
MessageBox (Handle, ' No debugger found! ', ' hint ', mb_ok+mb_iconinformation);
End
3. Isdebuggerpresent Detection with API function
Principle: The operating system sets the Debug object to run in a special environment, and the function of the API function isdebuggerpresent in Kernel32.dll is used to determine if the process is in the debug environment, so that this API function can be used to see if the process is executing in the debugger
//****************************************
Using Isdebuggerpresent function to detect ollydbg
//****************************************
function Antiloader (): Boolean;
Var
IsDebuggerPresent:function:Boolean;
Addr:thandle;
Begin
ADDR: = LoadLibrary (' kernel32.dll ');
Isdebuggerpresent: = GetProcAddress (Addr, ' isdebuggerpresent ');
If Isdebuggerpresent Then
Result:=true
Else
Result:=false;
End
Procedure Tform1.formcreate (Sender:tobject);
Begin
If Antiloader Then
MessageBox (Handle, ' Discover debugger! ', ' hint ', mb_ok+mb_iconinformation)
Else
MessageBox (Handle, ' no hint found! ', ' hint ', mb_ok+mb_iconinformation);
End
4. Check the program's parent process
Principle: The GUI executable under the Windows operating system is the parent process of Explorer.exe (the Cui executable's parent process is CMD.exe, the system service's parent process is Service.exe, The parent process of a program that is being debugged by the debugger OD is the debugger's executor Ollydbg.exe, not the other, when it is actually used to select the parent process to implement anti-tracking according to its own program type. Therefore, you can detect OD by checking whether the parent process is explorer.exe.
//***************************************************
Check the parent process to detect ollydbg
//***************************************************
function Antiloader (): Boolean;
Const
Parentname= '/explorer. EXE ';
Var
Hsnap,hprocess:thandle;
Szbuffer:array[0..max_path] of Char;
Filename:array[0..max_path] of Char;
process32:processentry32;
Loopflag:bool;
Begin
Get a list snapshot of all processes
Hsnap:=createtoolhelp32snapshot (th32cs_snapprocess, 0);
If Hsnap=invalid_handle_value Then
Begin
Result:=false;
Exit;
End
Process32.dwsize:=sizeof (PROCESSENTRY32);
Find process
Loopflag:=process32first (HSNAP,PROCESS32);
If Loopflag=false Then
Begin
CloseHandle (HSNAP);
Result:=false;
Exit;
End
While Integer (Loopflag) <>0 do
Begin
If Process32.th32processid=getcurrentprocessid () then
Begin
Hprocess:=openprocess (PROCESS_ALL_ACCESS,FALSE,PROCESS32.TH32PARENTPROCESSID);
If Hprocess<>0 Then
Begin
If Getmodulefilenameex (hprocess,0,filename,max_path) <>0 Then
Begin
Get the system catalog
GetWindowsDirectory (Szbuffer,max_path);
Merge system catalogs and/explorer. Exe
StrCat (Szbuffer,parentname);
Compare whether the current debugger's process is a parent process after converting to uppercase
If uppercase (String (FileName)) <>uppercase (String (szbuffer)) Then
Result:=true
Else
Result:=false;
End
End
Else
Result:=false;
End
Loopflag:=process32next (HSNAP,PROCESS32);
End
CloseHandle (HSNAP);
End
Procedure Tform1.formcreate (Sender:tobject);
Begin
If Antiloader Then
MessageBox (Handle, ' Discover debugger! ', ' hint ', mb_ok+mb_iconinformation)
Else
MessageBox (Handle, ' No debugger found! ', ' hint ', mb_ok+mb_iconinformation)
End
5. Check the STARTUPINFO structure
Principle: The Explorer.exe in the Windows operating system creates a process that sets the value in the STARTUPINFO structure to 0, Instead of Explorer.exe the value in the structure when creating the process, the value in the structure is not 0, so you can use this to determine if the OD is in the debugger.
/************************************************
Detects ollydbg by detecting startupinfo structures
//************************************************
function Antiloader (): Boolean;
Var
Info:startupinfo;
Begin
Getstartupinfo (Info);
if (info.dwx<>0) or (info.dwy<>0) or (info.dwxcountchars<>0) or (info.dwycountchars<>0) or
(info.dwfillattribute<>0) or (info.dwxsize<>0) or (info.dwysize<>0) then
Result:=true
Else
Result:=false;
End
Procedure Tmainfrm.formcreate (Sender:tobject);
Begin
If Antiloader Then
MessageBox (Handle, ' Discover debugger! ', ' hint ', MB_OK)
Else
MessageBox (Handle, ' No debugger found! ', ' hint ', MB_OK);

http://blog.csdn.net/jiangxinyu/article/details/5348468

Anti-Debugging Technology (Delphi version)