;INFO: Debugger standardne nespracovava obsluhy vynimiek (pokial to nema nastavene) ; Tento Anti-Debug tento fakt vyuziva a spolieha sa na to, ze SEH_handler (catch sekvencia) sa nemusi vykonat vzdy automaticky ; Aplikacia spustena bez debuggera vykona SEH_HANDLER automaticky ;Nastavenie: ; Zapnut: "Options->Options | Exceptions | Integer division by 0" - pripadne aj dalsie druhy vynimiek (ak je chyba sposobena cez inu vynimku) ; ; ;Pre lepsie pochopenie obdobny kod v C++: ; dbg_found = 1; ; try { ; int i = 5 / 0; //sposobenie chyby. ; } catch (..){ ; dbg_found = 0; ; } ; if (dbg_found==1) { ; ShowMessage("FOUND..",..) ; } else { ; ShowMessage("OK..",..) ; } format PE GUI 4.0 at 0x400000 include 'win32a.inc' section '.text' code readable executable ; We clear our information about breakpoint mov dword [DBG_FOUND], 1 ; SEH Handler "installation" push SEH_HANDLER push dword [fs:0] mov [fs:0], ESP ; chyba c.1: - na tejto chybe debugger zastane a nedovoli ju prejst xor eax, eax idiv eax ;this cause exception (0 div 0 = error :-) , handler "SEH_HANDLER" is executed!) ; chyba c.2: - zebugger zastane, ale po stlaceni F8 touto debugger "prelezie" ;int 02dh ; Tato chyba vyzaduje zaskrtnut aj "INT 3 breaks" druh chyby ;tieto tri nopy by sa nemali nikdy vykonat. pri chybe c.2 a pri postupnom krokovani sa vsak vykonaju nop nop nop SEH_UNWIND: pop dword [fs:0] add esp, 4 CONTINUE_H: cmp [DBG_FOUND], 1 je MSG_FOUND MSG_OK: invoke MessageBoxA, 0, message_ok ,message_caption, MB_OK+MB_ICONINFORMATION jmp EXIT MSG_FOUND: invoke MessageBoxA, 0, message_found,message_caption, MB_OK+MB_ICONINFORMATION EXIT: ret ;------------------------------------------------ SEH_HANDLER: mov dword [DBG_FOUND],0 mov edx, [esp+0Ch] ; CONTEXT mov dword [edx+0B8h], SEH_UNWIND ; CONTEXT.EIP mov eax,0 ; OK ret ;------------------------------------------------ section '.bss' readable writeable DBG_FOUND dd ? section '.data' readable message_caption db 'MSG',0 message_ok db 'OK',0 message_found db 'Debugger found!',0 section '.idata' import data readable writeable library \ kernel32,'KERNEL32.DLL',\ user32 ,'USER32.DLL' import kernel32,\ VirtualProtect ,'VirtualProtect' import user32,\ MessageBoxA ,'MessageBoxA' ;section '.reloc' fixups data readable discardable