Wednesday, June 16, 2004

Computer Programming #1 - IsDebuggerPresent

This is the main code to execute to check if a debugger using Microsoft's API is working. I'll check for gdb code and post it here if I have time.

unsigned long IsDebuggerPresent()

{
unsigned long ret;
__asm {
mov eax, fs:[0x18]
mov eax, [eax + 0x30]
movzx ret, [eax + 0x02]
}
return ret;
}


In fact, not too much has been done: I've disassembled kernel32.dll, checked the code for the already available IsDebuggerPresent and put it in a function :P I'll check for the flags in fs:[0x18] or even other fs segment variable. They seem interesting. Will post it here :)

0 Comments:

Post a Comment

<< Home