首页
社区
课程
招聘
[原创]检测调试器(过StrongOD)
发表于: 2011-8-17 14:29 11592

[原创]检测调试器(过StrongOD)

2011-8-17 14:29
11592
放码O(∩_∩)O~~~
方法一:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
//GetCursorPos,WindowFromPoint
POINT point;
if (GetCursorPos(&point))
{
    char buf[256];
    HWND hwnd = WindowFromPoint(point);
    HWND hwnd_tmp = hwnd;
    while (hwnd_tmp)
    {
            hwnd_tmp = GetParent(hwnd_tmp);
            if (hwnd_tmp)   hwnd = hwnd_tmp;
    }
 
    if (GetWindowText(hwnd, buf, 256))
    {
        for (unsigned int i=0 ;i<strlen(buf); i++)
            buf[i] = tolower(buf[i]);
 
        if (strstr(buf, "ollydbg") || strstr(buf, "windbg") || strstr(buf, "ollyice"))
            goto FIND;
    }
}

方法二:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
//GetDesktopWindow,GetWindow
HWND decwnd = GetDesktopWindow();
if (enumwindows(decwnd))
    goto FIND;
return 0;
BOOLEAN enumwindows( HWND hwnd_ )
{
    HWND hwnd = GetWindow(hwnd_, GW_CHILD);
    if (hwnd)
    {
        char buf[256];
        if (GetWindowText(hwnd, buf, 256))
        {
            //MessageBox(NULL, buf, "god", MB_OK);
            for (unsigned int i=0 ;i<strlen(buf); i++)
                buf[i] = tolower(buf[i]);
 
            if (strstr(buf, "ollydbg") || strstr(buf, "windbg") || strstr(buf, "ollyice"))
                return TRUE;
        }
        if (enumwindows(hwnd))
            return TRUE;
    }//if
 
    hwnd = GetWindow(hwnd_, GW_HWNDNEXT);
    if (hwnd)
    {
        char buf[256];
        if (GetWindowText(hwnd, buf, 256))
        {
            //MessageBox(NULL, buf, "god", MB_OK);
            for (unsigned int i=0 ;i<strlen(buf); i++)
                buf[i] = tolower(buf[i]);
 
            if (strstr(buf, "ollydbg") || strstr(buf, "windbg") || strstr(buf, "ollyice"))
                return TRUE;
        }
        if (enumwindows(hwnd))
            return TRUE;
    }
return FALSE;
}

很简单,大家一看都明白!其实就是sky++的方法,过StrongOD v0.4.3!

[注意]看雪招聘,专注安全领域的专业人才平台!

收藏
免费
支持
分享
最新回复 (11)
雪    币: 1898
活跃值: (1890)
能力值: ( LV5,RANK:60 )
在线值:
发帖
回帖
粉丝
2
膜拜之。坐等海风大牛出现。
2011-8-17 14:46
0
雪    币: 331
活跃值: (57)
能力值: ( LV7,RANK:100 )
在线值:
发帖
回帖
粉丝
3
对于方法二,估计有点难!
顺便吧,StrongOD hook的API帖出来
>SSDT State
NtClose
Actual Address 0xF0389268
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtCreateProcess
Actual Address 0xF03892C8
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtDuplicateObject
Actual Address 0xF03891E8
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtOpenProcess
Actual Address 0xF0388E18
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtOpenThread
Actual Address 0xF0388F28
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtQueryInformationProcess
Actual Address 0xF0389068
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtQueryObject
Actual Address 0xF0388D78
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtQuerySystemInformation
Actual Address 0xF0388988
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtSetInformationThread
Actual Address 0xF0389018
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtYieldExecution
Actual Address 0xF0388E08
Hooked by: C:\OllyDBG\plugin\whlsod.sys

>Shadow
NtUserBuildHwndList
Actual Address 0xF0389558
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtUserFindWindowEx
Actual Address 0xF0389718
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtUserGetForegroundWindow
Actual Address 0xF03897A8
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtUserPostMessage
Actual Address 0xF0389518
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtUserQueryWindow
Actual Address 0xF0389478
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtUserSetParent
Actual Address 0xF0389838
Hooked by: C:\OllyDBG\plugin\whlsod.sys

>Hooks
[1044]Ollydbg.exe-->kernel32.dll-->ContinueDebugEvent, Type: IAT modification 0x0050D2B8

[StrongOD.dll]
[1044]Ollydbg.exe-->kernel32.dll-->CreateProcessA, Type: IAT modification 0x0050D2C4

[StrongOD.dll]
[1044]Ollydbg.exe-->kernel32.dll-->DebugActiveProcess, Type: IAT modification 0x0050D2C8

[StrongOD.dll]
[1044]Ollydbg.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0050D344

[StrongOD.dll]
[1044]Ollydbg.exe-->kernel32.dll-->MultiByteToWideChar, Type: IAT modification 0x0050D3C8

[StrongOD.dll]
[1044]Ollydbg.exe-->kernel32.dll-->WaitForDebugEvent, Type: IAT modification 0x0050D440

[StrongOD.dll]
[1044]Ollydbg.exe-->ntdll.dll-->NtCreateProcess, Type: Inline - RelativeJump 0x7C92D754

[StrongOD.dll]
[1044]Ollydbg.exe-->ntdll.dll-->NtCreateProcessEx, Type: Inline - RelativeJump 0x7C92D769

[StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->CreateMDIWindowA, Type: IAT modification 0x0050D7F4

[StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->DialogBoxParamA, Type: IAT modification 0x0050D81C [StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->EnumChildWindows, Type: IAT modification 0x0050D83C

[StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->GetClassLongA, Type: IAT modification 0x0050D858 [StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->GetWindowLongA, Type: IAT modification 0x0050D8B0 [StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->GetWindowTextA, Type: Inline - RelativeJump 0x77D3212B

[unknown_code_page]
[1044]Ollydbg.exe-->user32.dll-->RegisterClassA, Type: IAT modification 0x0050D920 [StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->SetWindowTextA, Type: IAT modification 0x0050D96C [StrongOD.dll]

还有1个CreateProcess Notfiy
2011-8-17 14:52
0
雪    币: 2269
活跃值: (1683)
能力值: ( LV8,RANK:130 )
在线值:
发帖
回帖
粉丝
4
这些都是小把戏了,一般调试强壳自己都改掉了。
2011-8-17 14:54
0
雪    币: 11352
活跃值: (3285)
能力值: ( LV5,RANK:71 )
在线值:
发帖
回帖
粉丝
5
看不出有什么用!?
2011-8-17 14:55
0
雪    币: 27
活跃值: (122)
能力值: ( LV8,RANK:120 )
在线值:
发帖
回帖
粉丝
6
招聘被拒没关系,再来过啊..
2011-8-17 15:19
0
雪    币: 878
活跃值: (496)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
7
GetWindowText?
来个SetWindowText就搞定了
2011-8-17 15:42
0
雪    币: 331
活跃值: (57)
能力值: ( LV7,RANK:100 )
在线值:
发帖
回帖
粉丝
8
关键是已经能够找到窗口的句柄了,这样就有很多方法去判断窗口,GetWindowText只是最简单的一种
2011-8-17 16:12
0
雪    币: 11352
活跃值: (3285)
能力值: ( LV5,RANK:71 )
在线值:
发帖
回帖
粉丝
9
展护卫,我貌似知道楼主为什么招聘被拒了
2011-8-17 16:14
0
雪    币: 16
活跃值: (15)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
10
我个人觉得靠检测窗口名字来检测调式器 非常不靠铺啊....
2011-8-18 09:11
0
雪    币: 276
活跃值: (34)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
11
这样就能过StrongOD v0.4.3?
2011-8-18 09:16
0
雪    币: 331
活跃值: (57)
能力值: ( LV7,RANK:100 )
在线值:
发帖
回帖
粉丝
12
仅仅作为方法之一,别忘了StrongOD是隐藏窗口的~~试试变知
2011-8-18 09:45
0
游客
登录 | 注册 方可回帖
返回

账号登录
验证码登录

忘记密码?
没有账号?立即免费注册