HWND hwnd;
if (hwnd=FindWindow(L"OllyDbg",NULL))
{
MessageBox(0,L"发现OD",0,0);
}
else
{
MessageBox(0,L"无OD",0,0);
}
BOOL CALLBACK EnumWindowsProc(HWND hwnd,LPARAM lParam)
{
TCHAR ch[100];
TCHAR str[]=L"Ollydbg";
if (IsWindowVisible(hwnd))
{
GetWindowText(hwnd,ch,100);
if (StrStrI(ch,str))
{
MessageBox(0,L"发现OD",0,0);
return FALSE;
}
}
return TRUE;
}
void OnEnumProcess()
{
HANDLE handle;
PROCESSENTRY32 tp32={0};
TCHAR str[]=L"ollydbg.exe";
bool bFindOD=false;
tp32.dwSize=sizeof(PROCESSENTRY32);//必须设置 我费了半天功夫 然后去MSDN一查 才清楚
handle=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if (INVALID_HANDLE_VALUE!=handle)
{
if(!Process32FirstW(handle,&tp32))
{
CloseHandle(handle);
return ;
}
// Process32FirstW(handle,&tp32);
do
{
if (0==lstrcmp(str,tp32.szExeFile))
{
MessageBox(0,L"发现OD",0,0);
bFindOD=true;
break;
}
} while (Process32Next(handle,&tp32));
}
if (!bFindOD)
{
MessageBox(0,L"没有发现OD",0,0);
}
CloseHandle(handle);
}
void OnExplorer()
{
HANDLE handle;
PROCESSENTRY32 tp32;
TCHAR str[]=L"Explorer.exe";
DWORD ExplorerID;
DWORD OwnID;
DWORD OwnParentID;
OwnID=GetCurrentProcessId();
GetWindowThreadProcessId(FindWindow(L"Progman",NULL),&ExplorerID);
tp32.dwSize=sizeof(PROCESSENTRY32);
handle=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL);
if (INVALID_HANDLE_VALUE!=handle)
{
Process32First(handle,&tp32);
do
{
if (OwnID==tp32.th32ProcessID)
{
OwnParentID=tp32.th32ParentProcessID;
}
} while (Process32Next(handle,&tp32));
}
if (ExplorerID==OwnParentID)
{
MessageBox(0,L"正常运行",0,0);
}
else
{
MessageBox(0,L"发现调试器",0,0);
}
CloseHandle(handle);
}
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
