Anti硬断的梗（2）
原理：利用了4个硬断位置设置了4个有用的断点举例代码如下：（可以4个位置的关系与处理都可以再复杂很多很多倍。）
代码:
#include "stdafx.h"
#include <windows.h>
#include <stdio.h>
#pragma pack(1)
typedef struct _DEBUG_DR6_
{
union{
ULONG32 _DR6;
struct {
unsigned B0 : 1;
unsigned B1 : 1;
unsigned B2 : 1;
unsigned B3 : 1;
unsigned Reverted : 9;
unsigned BD : 1;
unsigned BS : 1;
unsigned Reverted2 : 17;
}st;
}u;
}DEBUG_DR6, *PDEBUG_DR6;
typedef struct _DEBUG_DR7_
{
union{
ULONG32 _DR7;
struct {
unsigned L0 : 1; //0
unsigned G0 : 1; //1
unsigned L1 : 1; //2
unsigned G1 : 1; //3
unsigned L2 : 1; //4
unsigned G2 : 1; //5
unsigned L3 : 1; //6
unsigned G3 : 1; //7
unsigned LE : 1; //8
unsigned GE : 1; //9
unsigned reserved : 3; //001//10-11-12
unsigned GD : 1; //13...
unsigned reserved2 : 2; //00
unsigned RW0 : 2;
unsigned LEN0 : 2;
unsigned RW1 : 2;
unsigned LEN1 : 2;
unsigned RW2 : 2;
unsigned LEN2 : 2;
unsigned RW3 : 2;
unsigned LEN3 : 2;
}st;
}u;
}DEBUG_DR7, *PDEBUG_DR7;
#pragma pack()
PVOID pHookAddress = { NULL };//只有4个位置！
PVOID pJmpAddress = { NULL };
int MyFilter(EXCEPTION_POINTERS * pException)
{
static ULONG32 s_Count = 0;
DEBUG_DR6 dr6;
PCONTEXT pContext;
pContext = pException->ContextRecord;
dr6.u._DR6 = pException->ContextRecord->Dr6;
printf("%x eip = %p except %x\r\n",s_Count++, pContext->Eip,pException->ExceptionRecord->ExceptionCode);
if (dr6.u.st.B0)
{
if (pContext->Eip == (DWORD)pHookAddress)
{
pContext->Eip = (DWORD)pJmpAddress;
}
return EXCEPTION_CONTINUE_EXECUTION;
}
if (dr6.u.st.B1)
{
if (pContext->Eip == (DWORD)pHookAddress)
{
pContext->Eip = (DWORD)pJmpAddress;
}
return EXCEPTION_CONTINUE_EXECUTION;
}
if (dr6.u.st.B2)
{
if (pContext->Eip == (DWORD)pHookAddress)
{
pContext->Eip = (DWORD)pJmpAddress;
}
return EXCEPTION_CONTINUE_EXECUTION;
}
if (dr6.u.st.B3)
{
if (pContext->Eip == (DWORD)pHookAddress)
{
pContext->Eip = (DWORD)pJmpAddress;
}
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}
void Fuck_Call()
{
MessageBoxA(NULL, "异常\r\n", "提示", MB_OK);
ExitProcess(-1);
}
void Fuck_OK()
{
Sleep(1);
}
void Fuck_Call_3()
{
MessageBoxA(NULL, "异常3\r\n", "提示3", MB_OK);
ExitProcess(-1);
}
void Fuck_Call_1()
{
MessageBoxA(NULL, "异常1\r\n", "提示1", MB_OK);
ExitProcess(-1);
}
void Fuck_Call_2()
{
MessageBoxA(NULL, "异常2\r\n", "提示2", MB_OK);
ExitProcess(-1);
}
void setHwbp()
{
CONTEXT ctx = { 0 };
ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
if (GetThreadContext(GetCurrentThread(), &ctx))
{
ctx.Dr0 = (DWORD)pHookAddress;
ctx.Dr1 = (DWORD)pHookAddress;
ctx.Dr2 = (DWORD)pHookAddress;
ctx.Dr3 = (DWORD)pHookAddress;
ctx.Dr7 = 0x455;
ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
SetThreadContext(GetCurrentThread(), &ctx);
//printf("set hwbp ok\r\n");
}
}
void NormalLoop()
{
setHwbp();
while (1)
{
__try
{
Fuck_Call();
Fuck_Call_3();
Fuck_Call_2();
Fuck_Call_1();
}
__except (MyFilter(GetExceptionInformation()))
{
}
Sleep(1000);
}
}
int _tmain(int argc, _TCHAR* argv[])
{
pJmpAddress = (PVOID)Fuck_OK;
pHookAddress = (PVOID)Fuck_Call;
pJmpAddress = (PVOID)Fuck_OK;
pHookAddress = (PVOID)Fuck_Call_3;
pJmpAddress = (PVOID)Fuck_OK;
pHookAddress = (PVOID)Fuck_Call_2;
pJmpAddress = (PVOID)Fuck_OK;
pHookAddress = (PVOID)Fuck_Call_1;
NormalLoop();
return 0;
}
转贴不用说明的啊？ 转贴你也好歹留个出处
页:
[1]