ANTI -附加OD 很早的了

bool InstallAntiAttach()
{
     HMODULE ntdll;                   // ntdll handle
     void* pDbgUiRemoteBreakin;       // function handle
     DWORD dwOldProtect;              // just for fun
     DWORD dwCodeSize;                // Size of code to copy

     // Get ntdll.dll handle
     ntdll = GetModuleHandle("ntdll.dll");
     if(ntdll)
     {
         // Get target function addr
         pDbgUiRemoteBreakin = GetProcAddress(ntdll, "DbgUiRemoteBreakin");
         if(pDbgUiRemoteBreakin)
         {
             __asm
             {
                 // Get code size
                 lea eax, __CodeToCopyStart
                 lea ecx, __CodeToCopyEnd
                 sub ecx, eax
                 mov dwCodeSize, ecx
             }
             // Make sure that we have write rights ...
             if(VirtualProtect(pDbgUiRemoteBreakin, dwCodeSize, PAGE_EXECUTE_READWRITE, &dwOldProtect))
             {
                 __asm
                 {
                     // Copy code between __CodeToCopyStart and __CodeToCopyEnd
                     mov edi, pDbgUiRemoteBreakin
                     lea esi, __CodeToCopyStart
                     mov ecx, dwCodeSize
                     rep movsb
                     // Skip code
                     jmp __CodeEnd

__CodeToCopyStart:
                     lea eax, __CodeToCopyEnd
                     jmp eax
__CodeToCopyEnd:
                 }

                 // ***CODE*HERE***
                 __asm
                 {
                     // Clear registers
                     xor eax, eax
                     pushfd
                     mov [esp], eax
                     popfd
                     xor ebx, ebx
                     xor ecx, ecx
                     xor edx, edx
                     xor esi, esi
                     xor edi, edi
                     xor esp, esp
                     xor ebp, ebp
                     // Jump to address 0
               jmp eax
                       }
                 // ***************

__CodeEnd:;
                 return true;
             }
         }
     }
     return false;
}

 

海风月影大侠博客中转载的