10-16-2011، 08:31 PM
کد:
'---------------------------------------------------------------------------------------
' Module : mAntiDebug
' DateTime : 4/09/2009 03:25
' Author : SqUeEzEr
' Mail : scott_van_dinter@hotmail.com
' Purpose : Check if you're being debugged
' Usage : At your own risk
' Requirements: None
' Distribution: You can freely use this code in your own
' applications, but you may not reproduce
' or publish this code on any web site,
' online service, or distribute as source
' on any media without express permission.
'
'---------------------------------------------------------------------------------------
Option Explicit
Private Declare Function NtCurrentTeb Lib "ntdll" () As Long
Private Declare Function NtWriteVirtualMemory Lib "ntdll.dll" (ByVal ProcessHandle As Long, ByVal BaseAddress As Long, ByVal pBuffer As Long, ByVal NumberOfBytesToWrite As Long, ByRef NumberOfBytesWritten As Long) As Long
Public Function IsBeingDebugged() As Boolean
Dim pPeb As Long
Dim bIBD As Boolean
Dim l As Long
Dim pHeap As Long
NtWriteVirtualMemory -1, VarPtr(pPeb), NtCurrentTeb + &H30, 4, 0
NtWriteVirtualMemory -1, VarPtr(pHeap), pPeb + &H20, 4, 0
NtWriteVirtualMemory -1, VarPtr(bIBD), pPeb + 2, 1, 0
NtWriteVirtualMemory -1, VarPtr(l), pHeap + &H10, 4, 0
If l <> 0 Then IsBeingDebugged = True
If bIBD = True then IsBeingDebugged = True
End Function