最初由 firstrose 发布
od无法正常识别SetUnhandledExceptionFilter
有个plugin的。去工具版找找。
太感谢了,真好用,呵呵
/////////////////////////////////////////////////////
自己跟了一下:
-------------------->>>>>
NTSYSAPI
NTSTATUS
NTAPI
NtQueryInformationProcess (
IN HANDLE ProcessHandle, // 进程句柄
IN PROCESSINFOCLASS InformationClass, // 信息类型
OUT PVOID ProcessInformation, // 缓冲指针
IN ULONG ProcessInformationLength, // 以字节为单位的缓冲大小
OUT PULONG ReturnLength OPTIONAL // 写入缓冲的字节数
//////////////////////////////////////////////////////////////////
typedef enum _PROCESSINFOCLASS
ProcessDebugPort equ 7---------------------------->>>>>
(The debug port is a value that's useless to ring 3 code.
However, you can infer that a nonzero debug port means
that the process is being run under the control of a ring 3 debugger
such as the Visual C++ IDE or Turbo Debugger. )
0012F690 FFFFFFFF |hProcess = FFFFFFFF
0012F694 00000007 |InfoClass = 7--------------------->>>>>>>>
0012F698 0012FBA0 |Buffer = 0012FBA0
0012F69C 00000004 |Bufsize = 4
0012F6A0 00000000 \pReqsize = NULL
77E73101 FF15 AC10E477 CALL DWORD PTR DS:[<&ntdll.NtQueryInformationProcess>] 返回值在0012FBA0 FF FF FF FF 长度4，非0。
77E73107 85C0 TEST EAX,EAX
77E73109 7C 09 JL SHORT kernel32.77E73114
77E7310B 3975 E0 CMP DWORD PTR SS:[EBP-20],ESI 《------》EBP-20=0012FBA0, ESI=0 判断有无DEBUGGER
77E7310E 0F85 C5060000 JNZ kernel32.77E737D9 插件中把这行NOP了 把[EBP-20]该成0也可以
77E73114 A1 B473EB77 MOV EAX,DWORD PTR DS:[77EB73B4]<<<<<---------Noname3.0040100A
77E73119 3BC6 CMP EAX,ESI
//////////////////////////////////////////////////////////////////////////////////
0040104C > > 68 0A104000 PUSH Noname3.0040100A ; /pTopLevelFilter = Noname3.0040100A
00401051 . E8 2A000000 CALL Noname3._SetUnhandledExceptionFilter@4 ; \SetUnhandledExceptionFilter
----------->>>>>>>>
77E5E5A1 > 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]
77E5E5A5 A1 B473EB77 MOV EAX,DWORD PTR DS:[77EB73B4]<<<<<---------Noname3.0040100A
77E5E5AA 890D B473EB77 MOV DWORD PTR DS:[77EB73B4],ECX<<<<<---------Noname3.0040100A
77E5E5B0 C2 0400 RETN 4
////////////////////////////////////////////////////////////////////
