Debugger STOP command PowerBASIC Peer Support Community (original) (raw)
Code:
' Detect Live DebugObjects.bas
' Get number of live DebugObjects on system (global debugger count) ' Tested and was able to detect Ollydbg , X32dbg and WinDbg ' However these debuggers must open this program and runs it before it ' gets detected.
#COMPILE EXE
#INCLUDE "win32api.inc" #INCLUDE "Detect_LiveDbg.inc"
'================================== FUNCTION PBMAIN () AS LONG
' Check for Live debuggers
LOCAL FlgLdbg AS LONG
Chk_LiveDebuggers(FlgLdbg)
? " No. of live debugger objects : " + STR$(FlgLdbg)
END FUNCTION
Code:
' Detect_LiveDbg.inc
' Ability to get the number of live DebugObjects on system (global debugger count) ' Tested and was able to detect Ollydbg , X32dbg and WinDbg
' However these debuggers must open this test program and runs it before the
' debugger can get detected.
%ObjectTypeInformation = 2
%DEBUG_ALL_ACCESS = &h001F000F
TYPE LSA_OBJECT_ATTRIBUTES Length AS LONG RootDirectory AS LONG ObjectName AS LONG Attributes AS LONG SecurityDescriptor AS LONG SecurityQualityOfService AS LONG END TYPE
TYPE UNICODE_STRING WORD Length AS WORD ' USHORT Length MaximumLength AS WORD ' USHORT MaximumLength Buffer AS WSTRINGZ PTR ' PWSTR Buffer END TYPE
TYPE PUBLIC_OBJECT_TYPE_INFORMATION DWORD TypeName AS UNICODE_STRING TotalNumberOfHandles AS DWORD TotalNumberOfObjects AS DWORD Reserved(60) AS DWORD '// must be big enough or NtQueryObject returns C0000005 END TYPE
DECLARE FUNCTION NtClose LIB "ntdll.dll" ALIAS "NtClose" (BYVAL hndl AS DWORD) AS LONG DECLARE FUNCTION NtQueryObject LIB "ntdll.dll" ALIAS "NtQueryObject" _ (BYVAL hndl AS DWORD, BYVAL funcnum AS DWORD, BYVAL lpData AS DWORD, _ BYVAL datalen AS DWORD, BYVAL num_bytes_for_function AS DWORD) AS DWORD DECLARE FUNCTION NtCreateDebugObject LIB "ntdll.dll" ALIAS "NtCreateDebugObject" ( _ BYREF DebugHandle AS LONG, BYVAL DesiredAccess AS LONG, _ BYREF ObjectAttributes AS LSA_OBJECT_ATTRIBUTES, _ BYVAL KillProcOnExit AS LONG) AS LONG
'==================== SUB Chk_LiveDebuggers( BYREF FlgLdbg AS LONG) LOCAL dwDbgObjCnt AS DWORD dwDbgObjCnt = LiveDebugObjectCount()
SELECT CASE dwDbgObjCnt
CASE 1 '
' "No active debug objects"
FlgLdbg = 0
CASE -1
' "Unexpected error, CreateDebugObject failed"
FlgLdbg = 0
CASE 0
' "Should never happen unless of anti-anti-debug tool"
' set to 1 as conservative assuming such a tool exist
FlgLdbg = 1
CASE ELSE
' "There are currently " & FORMAT$(dwDbgObjCnt-1) & " active debug objects"
FlgLdbg = dwDbgObjCnt-1
END SELECT
END SUB
'================================ FUNCTION LiveDebugObjectCount() AS LONG LOCAL hdebugObject AS DWORD LOCAL objattr AS LSA_OBJECT_ATTRIBUTES LOCAL objinfo AS PUBLIC_OBJECT_TYPE_INFORMATION
objattr.Length = SIZEOF(LSA_OBJECT_ATTRIBUTES) IF NtCreateDebugObject(BYREF hdebugObject, _ %DEBUG_ALL_ACCESS, objattr, 0) >= 0 THEN IF NtQueryObject(BYVAL hdebugObject, %ObjectTypeInformation,_ VARPTR(objinfo), SIZEOF(objinfo), 0) => 0 THEN FUNCTION = objinfo.TotalNumberOfObjects END IF NtClose (BYVAL hdebugObject) ELSE FUNCTION = -1 END IF
END FUNCTION