pebmain.pas

来自「Anti-Loader... ...Anti-Loader示例 ├──PEB」· PAS 代码 · 共 60 行

unit PEBMain;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, ComCtrls;

type
  TForm1 = class(TForm)
    StatusBar1: TStatusBar;
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

//***************************************
//使用PEB结构检测OllyDBG
//***************************************
function AntiLoader():Boolean; //检测调试器;
var
  YInt,NInt:Integer;
begin
  asm
    mov eax,fs:[$30]
    //获取PEB偏移2h处BeingDebugged的值
    movzx eax,byte ptr[eax+$2]
    or al,al
    jz @No
    jnz @Yes
    @No:
      mov NInt,1
    @Yes:
      Mov YInt,1
  end;
  if YInt=1 then
    Result:=True;
  if NInt=1 then
    Result:=False;
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
  if AntiLoader then
    MessageBox(Handle,'发现调试器!','提示',MB_OK+MB_ICONINFORMATION)
  else
    MessageBox(Handle,'未发现调试器!','提示',MB_OK+MB_ICONINFORMATION);
end;

end.