antisofticemain.~pas

各种反分析软件的手法,包括(反Dede,反单步跟踪,反SoftICE,Ollydbg,反静态分析,以及程序自身的CRC32效验等,对于初学者有很大的帮助.

unit AntiSoftICEMain;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, WinSvc, ComCtrls;

type
  TForm1 = class(TForm)
    StatusBar1: TStatusBar;
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

//********************************************
//判断NTICE是否运行来检测SoftICE
//********************************************
function AntiSoftICE():Boolean;
var
  SVStatus:TServiceStatus;
  OpenSVM,ICESV:SC_HANDLE;
begin
  //打开服务控制管理器
  OpenSVM:=OpenSCManager(nil,SERVICES_ACTIVE_DATABASE,SC_MANAGER_ALL_ACCESS);
  if OpenSVM=0 then
    Result:=False;
  //打开NIICE服务
  ICESV:=OpenService(OpenSVM,'NTice',SERVICE_ALL_ACCESS);
  if QueryServiceStatus(ICESV,SVStatus) then
    begin
      CloseServiceHandle(ICESV);
      Result:=False;
    end;
  //判断当前NTICE服务是否在运行  
  if SVStatus.dwCurrentState=SERVICE_RUNNING then
    begin
      CloseServiceHandle(ICESV);
      Result:=True;
    end;
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
  if AntiSoftICE then
    MessageBox(Handle,'发现SoftICE调试器!','提示',MB_OK+MB_ICONINFORMATION)
  else
    MessageBox(Handle,'没有发现SoftICE调试器!','提示',MB_OK+MB_ICONINFORMATION);
end;

end.