使用预取队列进行反调试不适用于我的cpu-Java 学习之路

Why does this code enable me to detect a debugger?

上面的链接告诉我使用预取队列进行反调试的方法，然后我尝试使用下面的代码进行测试，但是我失败了 . 任何人都可以帮我指出我的代码是错误的 . 我的cpu是Intel（R）Core（TM）i7-2630QM 2.00GHz . 非常感谢

ML ：D：\ Programs \ masm32 \ Bin \ ML.EXE / c / coff / Cp / nologo / I "D:\Programs\masm32\Include" "AntiDebug.asm"

Link ：D：\ Programs \ masm32 \ Bin \ LINK.EXE /SECTION:.text,RWE / SUBSYSTEM：WINDOWS / RELEASE /VERSION:4.0 / LIBPATH："D:\Programs\masm32\Lib" / OUT："AntiDebug.exe" "AntiDebug.obj"

无论我是否正在调试它总是执行调试标签，它永远不会执行'jmp normal' .

.386
.model flat, stdcall  ;32 bit memory model
option casemap :none  ;case sensitive

include windows.inc
include kernel32.inc
include user32.inc

includelib kernel32.lib
includelib user32.lib

.data
szDebug     db  'Hey, you are debugging!!!',0
szError     db  'Error',0
szNormal    db  'You are running it without debugging',0
szPrompt    db  'Prompt',0

.code
start:
    call IsDebug
debug:
    invoke MessageBox, NULL, addr szDebug, addr szError, MB_OK
    invoke ExitProcess, -1
normal:
    invoke MessageBox, NULL, addr szNormal, addr szPrompt, MB_OK
    invoke ExitProcess, 0
IsDebug:
    mov al, 0c3h
    mov edi, offset IsDebug
    mov cx, 20h
    rep stosb
    jmp normal
end start

1 回答

我不知道你的isdebug proc做了什么 .

这是我的代码，它在我的电脑上工作正常 .

.386
.model flat, stdcall  ;32 bit memory model
option casemap :none  ;case sensitive

include c:\masm32\include\windows.inc
include c:\masm32\include\kernel32.inc
include c:\masm32\include\user32.inc

includelib C:\masm32\lib\kernel32.lib
includelib C:\masm32\lib\user32.lib

.data
szDebug     db  'Hey, you are debugging!!!',0
szError     db  'Error',0
szNormal    db  'You are running it without debugging',0
szPrompt    db  'Prompt',0

.code
start:
    call IsDebug
debug:
    invoke MessageBox, NULL, addr szDebug, addr szError, MB_OK
    invoke ExitProcess, -1
normal:
    invoke MessageBox, NULL, addr szNormal, addr szPrompt, MB_OK
    invoke ExitProcess, 0
IsDebug:
    invoke IsDebuggerPresent
    test eax,eax
    je normal
    ret
end start

回复于 2024-04-28T11:23:30+08:00

使用预取队列进行反调试不适用于我的cpu

1 回答

相关问题