teb.cpp

此为本书的配套光盘.本书结合实例

/*--------------------------------------------------------------
   TEB.cpp -- 检测用户模式调试器（如OllyDbg）
                           (c) www.pediy.com code by 段钢, 2003.11
  --------------------------------------------------------------*/
#include <windows.h>
BOOL IsDebug();
int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,PSTR szCmdLine, int iCmdShow)
{	
 
	if( IsDebug() )
		MessageBox(NULL,TEXT ("u are debugging me !"),TEXT ("OK"),MB_ICONEXCLAMATION);
	else
       	MessageBox(NULL,TEXT ("not debugged!"),TEXT ("OK"),MB_ICONEXCLAMATION);
	return 0;
}

//////////////////////////////////////////////////////////////////////

BOOL IsDebug()
{ 

	_asm {

	    mov     eax,fs:[30h]        
        movzx   eax,byte ptr [eax+2h]
        or      al,al
		jz      nofound
	 }
	return TRUE;

nofound: 
	return FALSE;
}