parentmain.~pas

Anti-Loader... ...Anti-Loader示例 ├──PEB................利用TEB检测 ├──FindWindow.........查找句柄检测 ├──

unit ParentMain;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, TlHelp32, psApi, ComCtrls;

type
  TForm1 = class(TForm)
    StatusBar1: TStatusBar;
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

//***************************************************
//检查父进程来检测OllyDBG
//***************************************************
function AntiLoader():Boolean;
const
  ParentName='\EXPLORER.EXE';
var
  hSnap,hProcess:THandle;
  szBuffer:array[0..MAX_PATH] of char;
  FileName:array[0..MAX_PATH] of char;
  Process32:PROCESSENTRY32;
  LoopFlag:BOOL;
begin
  ////得到所有进程的列表快照
  hSnap:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  if hSnap=INVALID_HANDLE_VALUE then
  begin
    Result:=False;
    Exit;
  end;
  Process32.dwSize:=sizeof(PROCESSENTRY32);
  //查找进程
  LoopFlag:=Process32First(hSnap,Process32);
  if LoopFlag=False then
  begin
    CloseHandle(hSnap);
    Result:=False;
    Exit;
  end;
  while Integer(LoopFlag)<>0 do
    begin
      if Process32.th32ProcessID=GetCurrentProcessId() then
        begin
          hProcess:=OpenProcess(PROCESS_ALL_ACCESS,FALSE,Process32.th32ParentProcessID);
          if hProcess<>0 then
            begin
              if GetModuleFileNameEx(hProcess,0,FileName,MAX_PATH)<>0 then
                begin
                  //取得系统目录
                  GetWindowsDirectory(szBuffer,MAX_PATH);
                  //合并系统目录和\EXPLORER.EXE
                  StrCat(szBuffer,ParentName);
                  //转换成大写以后比较当前调试程序的进程是否为父进程
                  if UpperCase(String(FileName))<>UpperCase(String(szBuffer)) then
                    Result:=True
                  else
                    Result:=False;
                end;
            end
          else
            Result:=False;
        end;
      LoopFlag:=Process32Next(hSnap,Process32);
    end;
  CloseHandle(hSnap);
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
  if AntiLoader then
    MessageBox(Handle,'发现调试器!','提示',MB_OK+MB_ICONINFORMATION)
  else
    MessageBox(Handle,'未发现调试器!','提示',MB_OK+MB_ICONINFORMATION)
end;

end.