首页
社区
课程
招聘
[原创]检测调试器(过StrongOD)
发表于: 2011-8-17 14:29 11474

[原创]检测调试器(过StrongOD)

2011-8-17 14:29
11474
放码O(∩_∩)O~~~
方法一:
//GetCursorPos,WindowFromPoint
POINT point;
if (GetCursorPos(&point))
{
	char buf[256];
	HWND hwnd = WindowFromPoint(point);
	HWND hwnd_tmp = hwnd;
	while (hwnd_tmp)
	{
			hwnd_tmp = GetParent(hwnd_tmp);
			if (hwnd_tmp)	hwnd = hwnd_tmp;
	}

	if (GetWindowText(hwnd, buf, 256))
	{
		for (unsigned int i=0 ;i<strlen(buf); i++)
			buf[i] = tolower(buf[i]);

		if (strstr(buf, "ollydbg") || strstr(buf, "windbg") || strstr(buf, "ollyice"))
			goto FIND;
	} 
}

方法二:
//GetDesktopWindow,GetWindow
HWND decwnd = GetDesktopWindow();
if (enumwindows(decwnd))
	goto FIND;
return 0;
BOOLEAN enumwindows( HWND hwnd_ )
{
	HWND hwnd = GetWindow(hwnd_, GW_CHILD);
	if (hwnd)
	{
		char buf[256];
		if (GetWindowText(hwnd, buf, 256))
		{
			//MessageBox(NULL, buf, "god", MB_OK);
			for (unsigned int i=0 ;i<strlen(buf); i++)
				buf[i] = tolower(buf[i]);

			if (strstr(buf, "ollydbg") || strstr(buf, "windbg") || strstr(buf, "ollyice"))
				return TRUE;
		}
		if (enumwindows(hwnd))
			return TRUE;
	}//if

	hwnd = GetWindow(hwnd_, GW_HWNDNEXT);
	if (hwnd)
	{
		char buf[256];
		if (GetWindowText(hwnd, buf, 256))
		{
			//MessageBox(NULL, buf, "god", MB_OK);
			for (unsigned int i=0 ;i<strlen(buf); i++)
				buf[i] = tolower(buf[i]);

			if (strstr(buf, "ollydbg") || strstr(buf, "windbg") || strstr(buf, "ollyice"))
				return TRUE;
		}
		if (enumwindows(hwnd))
			return TRUE;
	}
return FALSE;
}

很简单,大家一看都明白!其实就是sky++的方法,过StrongOD v0.4.3!

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
免费 0
支持
分享
最新回复 (11)
雪    币: 1895
活跃值: (1632)
能力值: ( LV5,RANK:60 )
在线值:
发帖
回帖
粉丝
2
膜拜之。坐等海风大牛出现。
2011-8-17 14:46
0
雪    币: 331
活跃值: (57)
能力值: ( LV7,RANK:100 )
在线值:
发帖
回帖
粉丝
3
对于方法二,估计有点难!
顺便吧,StrongOD hook的API帖出来
>SSDT State
NtClose
Actual Address 0xF0389268
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtCreateProcess
Actual Address 0xF03892C8
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtDuplicateObject
Actual Address 0xF03891E8
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtOpenProcess
Actual Address 0xF0388E18
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtOpenThread
Actual Address 0xF0388F28
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtQueryInformationProcess
Actual Address 0xF0389068
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtQueryObject
Actual Address 0xF0388D78
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtQuerySystemInformation
Actual Address 0xF0388988
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtSetInformationThread
Actual Address 0xF0389018
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtYieldExecution
Actual Address 0xF0388E08
Hooked by: C:\OllyDBG\plugin\whlsod.sys

>Shadow
NtUserBuildHwndList
Actual Address 0xF0389558
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtUserFindWindowEx
Actual Address 0xF0389718
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtUserGetForegroundWindow
Actual Address 0xF03897A8
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtUserPostMessage
Actual Address 0xF0389518
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtUserQueryWindow
Actual Address 0xF0389478
Hooked by: C:\OllyDBG\plugin\whlsod.sys

NtUserSetParent
Actual Address 0xF0389838
Hooked by: C:\OllyDBG\plugin\whlsod.sys

>Hooks
[1044]Ollydbg.exe-->kernel32.dll-->ContinueDebugEvent, Type: IAT modification 0x0050D2B8

[StrongOD.dll]
[1044]Ollydbg.exe-->kernel32.dll-->CreateProcessA, Type: IAT modification 0x0050D2C4

[StrongOD.dll]
[1044]Ollydbg.exe-->kernel32.dll-->DebugActiveProcess, Type: IAT modification 0x0050D2C8

[StrongOD.dll]
[1044]Ollydbg.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0050D344

[StrongOD.dll]
[1044]Ollydbg.exe-->kernel32.dll-->MultiByteToWideChar, Type: IAT modification 0x0050D3C8

[StrongOD.dll]
[1044]Ollydbg.exe-->kernel32.dll-->WaitForDebugEvent, Type: IAT modification 0x0050D440

[StrongOD.dll]
[1044]Ollydbg.exe-->ntdll.dll-->NtCreateProcess, Type: Inline - RelativeJump 0x7C92D754

[StrongOD.dll]
[1044]Ollydbg.exe-->ntdll.dll-->NtCreateProcessEx, Type: Inline - RelativeJump 0x7C92D769

[StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->CreateMDIWindowA, Type: IAT modification 0x0050D7F4

[StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->DialogBoxParamA, Type: IAT modification 0x0050D81C [StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->EnumChildWindows, Type: IAT modification 0x0050D83C

[StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->GetClassLongA, Type: IAT modification 0x0050D858 [StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->GetWindowLongA, Type: IAT modification 0x0050D8B0 [StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->GetWindowTextA, Type: Inline - RelativeJump 0x77D3212B

[unknown_code_page]
[1044]Ollydbg.exe-->user32.dll-->RegisterClassA, Type: IAT modification 0x0050D920 [StrongOD.dll]
[1044]Ollydbg.exe-->user32.dll-->SetWindowTextA, Type: IAT modification 0x0050D96C [StrongOD.dll]

还有1个CreateProcess Notfiy
2011-8-17 14:52
0
雪    币: 1489
活跃值: (1003)
能力值: ( LV8,RANK:130 )
在线值:
发帖
回帖
粉丝
4
这些都是小把戏了,一般调试强壳自己都改掉了。
2011-8-17 14:54
0
雪    币: 10939
活跃值: (2895)
能力值: ( LV5,RANK:71 )
在线值:
发帖
回帖
粉丝
5
看不出有什么用!?
2011-8-17 14:55
0
雪    币: 27
活跃值: (127)
能力值: ( LV8,RANK:120 )
在线值:
发帖
回帖
粉丝
6
招聘被拒没关系,再来过啊..
2011-8-17 15:19
0
雪    币: 878
活跃值: (496)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
7
GetWindowText?
来个SetWindowText就搞定了
2011-8-17 15:42
0
雪    币: 331
活跃值: (57)
能力值: ( LV7,RANK:100 )
在线值:
发帖
回帖
粉丝
8
关键是已经能够找到窗口的句柄了,这样就有很多方法去判断窗口,GetWindowText只是最简单的一种
2011-8-17 16:12
0
雪    币: 10939
活跃值: (2895)
能力值: ( LV5,RANK:71 )
在线值:
发帖
回帖
粉丝
9
展护卫,我貌似知道楼主为什么招聘被拒了
2011-8-17 16:14
0
雪    币: 16
活跃值: (15)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
10
我个人觉得靠检测窗口名字来检测调式器 非常不靠铺啊....
2011-8-18 09:11
0
雪    币: 276
活跃值: (34)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
11
这样就能过StrongOD v0.4.3?
2011-8-18 09:16
0
雪    币: 331
活跃值: (57)
能力值: ( LV7,RANK:100 )
在线值:
发帖
回帖
粉丝
12
仅仅作为方法之一,别忘了StrongOD是隐藏窗口的~~试试变知
2011-8-18 09:45
0
游客
登录 | 注册 方可回帖
返回
//