如何用Windbg调试禁止使用调试器的程序

1. 运行目标程序，用Windbg关联上该进程，或者直接从Windbg中运行该程序

2. 切换到0号线程：

    ~0s

3. 修改进程是否附加调试器的标志：

0:000> dd fs:18:30
0018:00000030  7ffd9000 00000000 00000000 00000000
0018:00000040  fbed29f8 00000000 00000000 00000000
0018:00000050  00000000 00000000 00000000 00000000
0018:00000060  00000000 00000000 00000000 00000000
0018:00000070  00000000 00000000 00000000 00000000
0018:00000080  00000000 00000000 00000000 00000000
0018:00000090  00000000 00000000 00000000 00000000
0018:000000a0  00000000 00000000 00000000 00000000
0:000> db 7ffd9000
7ffd9000  00 00 01 08 ff ff ff ff-00 00 37 00 00 5d a6 77 

7ffd9010  d0 11 23 00 00 00 00 00-00 00 23 00 a0 54 a6
7ffd9020  00 00 00 00 00 00 00 00-00 00 00 00 60 40 3e 76 
7ffd9030  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 
7ffd9040  30 53 a6 77 ff ff 3f 00-00 00 00 00 00 00 6f 7f 
7ffd9050  00 00 00 00 88 05 6f 7f-00 00 fa 7f 00 00 fa 7f 
7ffd9060  24 00 fd 7f 02 00 00 00-00 04 00 00 00 00 00 00 
7ffd9070  00 80 9b 07 6d e8 ff ff-00 00 10 00 00 20 00 00 
0:000> eb 7ffd9002 0
0:000> db 7ffd9000
7ffd9000  00 00 00 08 ff ff ff ff-00 00 37 00 00 5d a6 77 
7ffd9010  d0 11 23 00 00 00 00 00-00 00 23 00 a0 54 a6 77 
7ffd9020  00 00 00 00 00 00 00 00-00 00 00 00 60 40 3e 76 
7ffd9030  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 
7ffd9040  30 53 a6 77 ff ff 3f 00-00 00 00 00 00 00 6f 7f 
7ffd9050  00 00 00 00 88 05 6f 7f-00 00 fa 7f 00 00 fa 7f 
7ffd9060  24 00 fd 7f 02 00 00 00-00 04 00 00 00 00 00 00 
7ffd9070  00 80 9b 07 6d e8 ff ff-00 00 10 00 00 20 00 00 

0:000> g