- 注册时间
- 2011-3-6
- 最后登录
- 1970-1-1
该用户从未签到
|
使用异常
Closehandle
如果给CloseHandle()函数一个无效句柄作为输入参数,在无调试器时,将会返回一个错误代码,而有调试器存在时,
将会触发一个EXCEPTION_INVALID_HANDLE (0xc0000008)的异常。
- bool getdebebugbyCloseHandle()//返回true说明有OD
- {
- __try
- {
- CloseHandle((HANDLE)0x00001234);
- return false;
- }
- __except(1)
- {
- return true;
- }
- }
复制代码
仅在进程初始化创建主线程时执行的代码- //必须先于程序执行 TLS EPO 窗口回调等等
- void getdebugbyOEP()
- {
- IMAGE_DOS_HEADER*dos_head=(IMAGE_DOS_HEADER*)GetModuleHandle(NULL);
- PIMAGE_NT_HEADERS32 nt_head=(PIMAGE_NT_HEADERS32)((DWORD)dos_head+(DWORD)dos_head->e_lfanew);
- BYTE*OEP=(BYTE*)(nt_head->OptionalHeader.AddressOfEntryPoint+(DWORD)dos_head);
- for(unsigned long index=0;index<200;index++)
- {
- if(OEP[index]==0xcc)
- {
- ExitProcess(0);
- }
- }
- }
复制代码 GetWindowLongA 获取窗口样式
OD的窗口样式出卖了它
代码:- // checkod.cpp : 定义控制台应用程序的入口点。
- //
- #include <stdio.h>
- #include <Windows.h>
- void CALLBACK HandleWinEvent(HWINEVENTHOOK hook, DWORD event, HWND hwnd,
- LONG idObject, LONG idChild,
- DWORD dwEventThread, DWORD dwmsEventTime)
- {
- char name[MAX_PATH];
- GetWindowTextA(hwnd,name,MAX_PATH);
- LONG mStyle = GetWindowLongA(hwnd,GWL_STYLE);
- LONG ExtStyle=GetWindowLongA(hwnd,GWL_EXSTYLE);
- if(mStyle==0x57c70000&&ExtStyle==0x140)
- {
- printf("find od 1 %08x %s\r\n",dwEventThread,name);
- }
- if (mStyle==0x56CF0000&&ExtStyle==0x140)
- {
- printf("Find od 2 %08x %s\r\n",dwEventThread,name);
- }
- }
- int main(int argc, char argv[])
- {
- CoInitialize(NULL);
- HWINEVENTHOOK hHook = SetWinEventHook( EVENT_MIN , EVENT_MAX , NULL, HandleWinEvent, 0, 0, WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNPROCESS);
- if (hHook)
- {
- printf("set hook ok\r\n");
- }
- else
- {
- printf("some hack in this os\r\n");
- exit(-1);
- }
- MSG msg;
- while(GetMessage(&msg,NULL,0,0))
- {
-
- TranslateMessage(&msg);
- DispatchMessage(&msg);
- }
- return 0;
- }
复制代码
窗口名的检测
搜集了常见OD的窗口名特征- #include <stdio.h>
- #include <windows.h>
- #include <string.h>
- BOOL bFind = FALSE;
- BOOL CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam)
- {
- if (hwnd == INVALID_HANDLE_VALUE)
- {
- return FALSE;
- }
- char szbuf[MAX_PATH] = {0};
- int ilens = 0;
- ilens = GetWindowTextA(hwnd, szbuf, sizeof(szbuf)/sizeof(char));
- if(ilens != 0)
- {
- PCHAR pstr = NULL;
- pstr = strstr(szbuf, "LCG");
- if(pstr == NULL)
- pstr = strstr(szbuf,"- 主线程");
- if(pstr == NULL)
- pstr = strstr(szbuf,"模块 -");
- if(pstr == NULL)
- pstr = strstr(szbuf,"main thread");
- if(pstr == NULL)
- pstr = strstr(szbuf,",module");
- if(pstr == NULL)
- pstr = strstr(szbuf,",- Module;");
- if(pstr == NULL)
- pstr = strstr(szbuf,"- Thread");
- if(pstr == NULL)
- pstr = strstr(szbuf,"G.P.U");
- if(pstr == NULL)
- pstr = strstr(szbuf,"+ 主线程");
- if(pstr == NULL)
- pstr = strstr(szbuf,"主线程,");
- if(pstr == NULL)
- pstr = strstr(szbuf,",模块");
- if(pstr == NULL)
- pstr = strstr(szbuf,"模块 +");
- if(pstr == NULL)
- pstr = strstr(szbuf,"PYG");
- if(pstr == NULL)
- pstr = strstr(szbuf,"FCK");
- if(pstr == NULL)
- pstr = strstr(szbuf,"?块");
- if(pstr == NULL)
- pstr = strstr(szbuf,"主线程");
- if(pstr == NULL)
- pstr = strstr(szbuf,"BH");
- if(pstr == NULL)
- pstr = strstr(szbuf,"吾爱");
- if(pstr == NULL)
- pstr = strstr(szbuf,"破解");
- if(pstr == NULL)
- {
- pstr = strstr(szbuf,"[");
- if(pstr != NULL)
- pstr = strstr(szbuf,"]");
- if(pstr != NULL)
- goto END;
- }
- END:
- if(pstr != NULL)
- {
- bFind = TRUE;
- printf("Find Od!\r\n");
- return FALSE;
- }
-
- }
- return TRUE;
- }
- VOID EnumOD()
- {
- EnumWindows(EnumWindowsProc, NULL);
- }
- int main(int argc, char* argv[])
- {
- EnumOD();
- if (bFind != TRUE)
- {
- printf("Find nothind!\n");
- }
- getchar();
- return 0;
- }
复制代码 |
|