Anti-debug using prefetch queue doesn't work w

2019-03-22 05:20发布

Why does this code enable me to detect a debugger?

The link above told me the way to use prefetch queue to anti-debug, then I tried to use the code below to test, but I failed. Can anyone help me point out if my code is wrong. My cpu is Intel(R) Core(TM) i7-2630QM 2.00GHz. Thanks a lot

ML: D:\Programs\masm32\Bin\ML.EXE /c /coff /Cp /nologo /I"D:\Programs\masm32\Include" "AntiDebug.asm"

Link: D:\Programs\masm32\Bin\LINK.EXE /SECTION:.text,RWE /SUBSYSTEM:WINDOWS /RELEASE /VERSION:4.0 /LIBPATH:"D:\Programs\masm32\Lib" /OUT:"AntiDebug.exe" "AntiDebug.obj"

It always executes the debug label no matter I am debugging or not, and it will never execute 'jmp normal'.

.386
.model flat, stdcall  ;32 bit memory model
option casemap :none  ;case sensitive

include windows.inc
include kernel32.inc
include user32.inc

includelib kernel32.lib
includelib user32.lib

.data
szDebug     db  'Hey, you are debugging!!!',0
szError     db  'Error',0
szNormal    db  'You are running it without debugging',0
szPrompt    db  'Prompt',0

.code
start:
    call IsDebug
debug:
    invoke MessageBox, NULL, addr szDebug, addr szError, MB_OK
    invoke ExitProcess, -1
normal:
    invoke MessageBox, NULL, addr szNormal, addr szPrompt, MB_OK
    invoke ExitProcess, 0
IsDebug:
    mov al, 0c3h
    mov edi, offset IsDebug
    mov cx, 20h
    rep stosb
    jmp normal
end start

1条回答
来,给爷笑一个
2楼-- · 2019-03-22 06:09

i don't know what does your isdebug proc doing.

here is my code and it work fine in my computer.

.386
.model flat, stdcall  ;32 bit memory model
option casemap :none  ;case sensitive

include c:\masm32\include\windows.inc
include c:\masm32\include\kernel32.inc
include c:\masm32\include\user32.inc

includelib C:\masm32\lib\kernel32.lib
includelib C:\masm32\lib\user32.lib

.data
szDebug     db  'Hey, you are debugging!!!',0
szError     db  'Error',0
szNormal    db  'You are running it without debugging',0
szPrompt    db  'Prompt',0

.code
start:
    call IsDebug
debug:
    invoke MessageBox, NULL, addr szDebug, addr szError, MB_OK
    invoke ExitProcess, -1
normal:
    invoke MessageBox, NULL, addr szNormal, addr szPrompt, MB_OK
    invoke ExitProcess, 0
IsDebug:
    invoke IsDebuggerPresent
    test eax,eax
    je normal
    ret
end start
查看更多
登录 后发表回答