[Amin_Mansouri]

کد:

/*
* Thx Silvio Cesare Doc Anti-debug and special thx zert for other info :)
*/


#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <termios.h>

#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <sys/syscall.h>
#include <asm/unistd.h>

#include "printf.h"


int
check_gdb_getenv(void) {

    extern char *__progname;

    if (!getenv("_")) {
        eprintf("Not Support for _ in this Shell\n");
        return 0;
    }
    
    if (strstr(getenv("_"), __progname) == 0) {
        eprintf("Detected Posible Debug with %s\n", getenv("_"));
        return 1;
    }

return 0;
}

int
check_gdb_fd(void) {

    if (close(3) == 0) {
        eprintf("GDB Detected!\n");
        return 1;
    }

return 0;
}

int
check_ptrace(pid_t pid) {

#if defined(__Linux__)  
    if (pid) {
        if (ptrace(PTRACE_ATTACH, pid, 0, 0) < 0) {
            eprintf("ptrace(): Detected! -> %s\n",strerror(errno));
            return 1;
        }
    }
    else
        if (ptrace(PTRACE_TRACEME, pid, 0, 0) < 0) {
            eprintf("ptrace(): Detected! -> %s\n",strerror(errno));
            return 1;
        }
#endif
    
return 0;
}

int
check_breakpoint(void *addr, int offset) {

    if ((*(volatile unsigned *)((unsigned)addr + offset) & 0xff) == 0xcc) {
        eprintf("Warning: breakpoint(%p + %d): Breakpoint Detected!\n", addr, offset);
        exit(2);
    }

return 0;
}

unsigned int
func_size(void *addr) {

    unsigned int byte = 1;
    unsigned int _break = 1;

    //     0x55 == push %ebp
    //     0xc3 == ret
    
    do {    
        /*    
        if ((*(volatile unsigned *)((unsigned)addr+byte) & 0xff) == 0xc3) {
            _break=1;
        }
        */
        if ((*(volatile unsigned *)((unsigned)addr+byte) & 0xff) == 0x55) {
            if (_break) {
            break;
            }
        }
    } while (byte++);

return byte;
}

pid_t getsid(pid_t );
pid_t getpgid(pid_t );

int
check_sid(void) {
/*
    printf("getsid: %d\n", getsid(0));
    printf("getppid: %d\n", getppid());
    printf("getpgid: %d\n", getpgid(0));

    if (getsid(0) != getppid()) {
        return 1;
    }
*/
return 0;

}