startupinfomain.~pas

各种反分析软件的手法,包括(反Dede,反单步跟踪,反SoftICE,Ollydbg,反静态分析,以及程序自身的CRC32效验等,对于初学者有很大的帮助.

unit STARTUPINFOMain;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls, ComCtrls;

type
  TMainFrm = class(TForm)
    StatusBar1: TStatusBar;
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  MainFrm: TMainFrm;

implementation

{$R *.dfm}

//************************************************
//通过检测STARTUPINFO结构来检测OllyDbg
//************************************************
function AntiLoader():Boolean;
var
  Info:STARTUPINFO;
begin
  GetStartupInfo(Info);
  if (Info.dwX<>0) or (Info.dwY<>0) or (Info.dwXCountChars<>0) or (Info.dwYCountChars<>0) or
     (Info.dwFillAttribute<>0) or (Info.dwXSize<>0) or (Info.dwYSize<>0) then
    Result:=True
  else
    Result:=False;
end;

procedure TMainFrm.FormCreate(Sender: TObject);
begin
  if AntiLoader then
    MessageBox(Handle,'发现调试器!','提示',MB_OK)
  else
    MessageBox(Handle,'未发现调试器!','提示',MB_OK);
end;

end.