windows 反调试相关/peb 结构体

转载 已于 2023-06-06 18:12:58 修改
· 217 阅读 · 0 ·
版权
原文链接：https://github.com/HackOvert/AntiDBG
文章标签：

#windows #anti-debug

于 2023-06-06 16:04:00 首次发布
该代码示例展示了多种检测Windows程序是否正在被调试的方法，包括检查PEB结构中的BeingDebugged标志，调用IsDebuggerPresent函数，检查远程调试器，查找特定调试器进程名称等。此外，还涉及到了时间戳对比、CPU计数器检查等反调试策略。

摘要生成于 C知道 ，由 DeepSeek-R1 满血版支持， 前往体验 >

参考：GitHub - HackOvert/AntiDBG: A bunch of Windows anti-debugging tricks for x86 and x64.

#include "AntiDBG.h"
#include <iostream>
#define SHOW_DEBUG_MESSAGES

// =======================================================================
// Debugging helper
// =======================================================================
void DBG_MSG(WORD dbg_code, const char* message)
{
#ifdef SHOW_DEBUG_MESSAGES
    printf("[MSG-0x%X]: %s\n", dbg_code, message);
    MessageBoxA(NULL, message, "GAME OVER!", 0);
#endif
}

// =======================================================================
// Memory Checks
// These checks focus on Windows structures containing information which 
// can reveal the presence of a debugger. 
// =======================================================================

/*
 * Want to inspect the PEB structure? Launch gauntlet in WinDBG and run
 * this command: dt ntdll!_PEB
 * Example output:
 * 0:000> dt ntdll!_PEB
 * +0x000 InheritedAddressSpace : UChar
 * +0x001 ReadImageFileExecOptions : UChar
 * +0x002 BeingDebugged    : UChar        <-- This is what we're checking
 * ...snip...
 */
void adbg_BeingDebuggedPEB(void)
{
    BOOL found = FALSE;

#ifdef _WIN64
    found = adbg_BeingDebuggedPEBx64();
#else
    _asm
    {
        xor eax, eax;			// clear eax
        mov eax, fs: [0x30] ;	// Reference start of the PEB
        mov eax, [eax + 0x02];	// PEB+2 points to BeingDebugged
        and eax, 0xFF;			// only reference one byte
        mov found, eax;			// Copy BeingDebugged into 'found'
    }
#endif

    if (found)
    {
        DBG_MSG(DBG_BEINGEBUGGEDPEB, "Caught by BeingDebugged PEB check!");
        exit(DBG_BEINGEBUGGEDPEB);
    }
}


void adbg_CheckRemoteDebuggerPresent(void)
{
    HANDLE hProcess = INVALID_HANDLE_VALUE;
    BOOL found = FALSE;

    hProcess = GetCurrentProcess();
    CheckRemoteDebuggerPresent(hProcess, &found);

    if (found)
    {
        DBG_MSG(DBG_CHECKREMOTEDEBUGGERPRESENT, "Caught by CheckRemoteDebuggerPresent!");
        exit(DBG_CHECKREMOTEDEBUGGERPRESENT);
    }
}

void adbg_CheckWindowName(void)
{
    BOOL found = FALSE;
    HANDLE hWindow = NULL;
    const wchar_t* WindowNameOlly = L"OllyDbg - [CPU]";
    const wchar_t* WindowNameImmunity = L"Immunity Debugger - [CPU]";

    // Check for OllyDBG class name
    hWindow = FindWindow(NULL, WindowNameOlly);
    if (hWindow)
    {
        found = TRUE;
    }

    // Check for Immunity class name
    hWindow = FindWindow(NULL, WindowNameImmunity);
    if (hWindow)
    {
        found = TRUE;
    }

    if (found)
    {
        DBG_MSG(DBG_FINDWINDOW, "Caught by FindWindow (WindowName)!");
        exit(DBG_FINDWINDOW);
    }
}

void adbg_ProcessFileName(void)
{
    // detect debugger by process file (for example: ollydbg.exe)
    const wchar_t *debuggersFilename[6] = {
        L"cheatengine-x86_64.exe", 
        L"ollydbg.exe", 
        L"ida.exe", 
        L"ida64.exe", 
        L"radare2.exe", 
        L"x64dbg.exe"
    };

    wchar_t* processName;
    PROCESSENTRY32W processInformation{ sizeof(PROCESSENTRY32W) };
    HANDLE processList;

    processList = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
    processInformation = { sizeof(PROCESSENTRY32W) };
    if (!(Process32FirstW(processList, &processInformation)))
        printf("[Warning] It is impossible to check process list.");
    else
    {
        do
        {
            for (const wchar_t *debugger : debuggersFilename)
            {
                processName = processInformation.szExeFile;
                if (_wcsicmp(debugger, processName) == 0) {
                    DBG_MSG(DBG_PROCESSFILENAME, "Caught by ProcessFileName!");
                    exit(DBG_PROCESSFILENAME);
                }
            }
        } while (Process32NextW(processList, &processInformation));
    }
    CloseHandle(processList);
}

void adbg_CheckWindowClassName(void)
{
    BOOL found = FALSE;
    HANDLE hWindow = NULL;
    const wchar_t* WindowClassNameOlly = L"OLLYDBG";		// OllyDbg
    const wchar_t* WindowClassNameImmunity = L"ID";			// Immunity Debugger

    // Check for OllyDBG class name
    hWindow = FindWindow(WindowClassNameOlly, NULL);
    if (hWindow)
    {
        found = TRUE;
    }

    // Check for Immunity class name
    hWindow = FindWindow(WindowClassNameImmunity, NULL);
    if (hWindow)
    {
        found = TRUE;
    }

    if (found)
    {
        DBG_MSG(DBG_FINDWINDOW, "Caught by FindWindow (ClassName)!");
        exit(DBG_FINDWINDOW);
    }
}

void adbg_IsDebuggerPresent(void)
{
    BOOL found = FALSE;
    found = IsDebuggerPresent();

    if (found)
    {
        DBG_MSG(DBG_ISDEBUGGERPRESENT, "Caught by IsDebuggerPresent!");
        exit(DBG_ISDEBUGGERPRESENT);
    }
}

/*
 * Want to inspect the value of something in the PEB? Launch WinDBG,
 * Attach to, or launch a process and run this command: 
 * dt ntdll!_PEB @$peb -r
 * Want more info on NtGlobalFlag? See these resources:
 * https://www.aldeid.com/wiki/PEB-Process-Environment-Block/NtGlobalFlag
 * https://www.geoffchappell.com/studies/windows/win32/ntdll/api/rtl/regutil/getntglobalflags.htm
 */
void adbg_NtGlobalFlagPEB(void)
{
    BOOL found = FALSE;

#ifdef _WIN64
    found = adbg_NtGlobalFlagPEBx64();
#else
    _asm
    {
        xor eax, eax;			// clear eax
        mov eax, fs: [0x30] ;	// Reference start of the PEB
        mov eax, [eax + 0x68];	// PEB+0x68 points to NtGlobalFlag
        and eax, 0x00000070;	// check three flags:
                                //   FLG_HEAP_ENABLE_TAIL_CHECK   (0x10)
                                //   FLG_HEAP_ENABLE_FREE_CHECK   (0x20)
                                //   FLG_HEAP_VALIDATE_PARAMETERS (0x40)
        mov found, eax;			// Copy result into 'found'
    }
#endif

    if (found)
    {
        DBG_MSG(DBG_NTGLOBALFLAGPEB, "Caught by NtGlobalFlag PEB check!");
        exit(DBG_NTGLOBALFLAGPEB);
    }
}


void adbg_NtQueryInformationProcess(void)
{
    HANDLE hProcess = INVALID_HANDLE_VALUE;
    PROCESS_BASIC_INFORMATION pProcBasicInfo = {0};
    ULONG returnLength = 0;
    
    // Get a handle to ntdll.dll so we can import NtQueryInformationProcess
    HMODULE hNtdll = LoadLibraryW(L"ntdll.dll");
    if (hNtdll == INVALID_HANDLE_VALUE || hNtdll == NULL)
    {
        return;
    }

    // Dynamically acquire the addres of NtQueryInformationProcess
    _NtQueryInformationProcess  NtQueryInformationProcess = NULL;
    NtQueryInformationProcess = (_NtQueryInformationProcess)GetProcAddress(hNtdll, "NtQueryInformationProcess");

    if (NtQueryInformationProcess == NULL)
    {
        return;
    }
    
    hProcess = GetCurrentProcess();
    
    // Note: There are many options for the 2nd parameter NtQueryInformationProcess
    // (ProcessInformationClass) many of them are opaque. While we use ProcessBasicInformation (0), 
    // we could also use:
    //      ProcessDebugPort (7)
    //      ProcessDebugObjectHandle (30)
    //      ProcessDebugFlags (31)
    // There are likely others. You can find many other options for ProcessInformationClass over at PINVOKE:
    //      https://www.pinvoke.net/default.aspx/ntdll/PROCESSINFOCLASS.html
    // Keep in mind that NtQueryInformationProcess will return different things depending on the ProcessInformationClass used.
    // Many online articles using NtQueryInformationProcess for anti-debugging will use DWORD types for NtQueryInformationProcess 
    // paramters. This is fine for 32-builds with some ProcessInformationClass values, but it will cause some to fail on 64-bit builds.
    // In the event of a failure NtQueryInformationProcess will likely return STATUS_INFO_LENGTH_MISMATCH (0xC0000004). 

    // Query ProcessDebugPort
    NTSTATUS status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pProcBasicInfo, sizeof(pProcBasicInfo), &returnLength);
    if (NT_SUCCESS(status)) {
        PPEB pPeb = pProcBasicInfo.PebBaseAddress;
        if (pPeb)
        {
            if (pPeb->BeingDebugged)
            {
                DBG_MSG(DBG_NTQUERYINFORMATIONPROCESS, "Caught by NtQueryInformationProcess (ProcessDebugPort)!");
                exit(DBG_NTQUERYINFORMATIONPROCESS);
            }
        }
    }
}


void adbg_NtSetInformationThread(void)
{
    THREAD_INFORMATION_CLASS ThreadHideFromDebugger = (THREAD_INFORMATION_CLASS)0x11;

    // Get a handle to ntdll.dll so we can import NtSetInformationThread
    HMODULE hNtdll = LoadLibraryW(L"ntdll.dll");
    if (hNtdll == INVALID_HANDLE_VALUE || hNtdll == NULL)
    {
        return;
    }

    // Dynamically acquire the addres of NtSetInformationThread and NtQueryInformationThread
    _NtSetInformationThread NtSetInformationThread = NULL;
    NtSetInformationThread = (_NtSetInformationThread)GetProcAddress(hNtdll, "NtSetInformationThread");

    if (NtSetInformationThread == NULL)
    {
        return;
    }

    // There is nothing to check here after this call.
    NtSetInformationThread(GetCurrentThread(), ThreadHideFromDebugger, 0, 0);
}


void adbg_DebugActiveProcess(const char* cpid)
{
    BOOL found = FALSE;
    STARTUPINFOA si = { 0 };
    PROCESS_INFORMATION pi = { 0 };
    si.cb = sizeof(si);
    TCHAR szPath[MAX_PATH];
    DWORD exitCode = 0;

    CreateMutex(NULL, FALSE, L"antidbg");
    if (GetLastError() != ERROR_SUCCESS)
    {
        // If we get here we are in the child process
        if (DebugActiveProcess((DWORD)atoi(cpid)))
        {
            // No debugger found.
            return;
        }
        else
        {
            // Debugger found, exit child with a unique code we can check for.
            exit(555);
        }
    }

    // parent process
    DWORD pid = GetCurrentProcessId();
    GetModuleFileName(NULL, szPath, MAX_PATH);

    char cmdline[MAX_PATH + 1 + sizeof(int)];
    snprintf(cmdline, sizeof(cmdline), "%ws %d", szPath, pid);

    // Start the child process. 
    BOOL success = CreateProcessA(
        NULL,		// path (NULL means use cmdline instead)
        cmdline,	// Command line
        NULL,		// Process handle not inheritable
        NULL,		// Thread handle not inheritable
        FALSE,		// Set handle inheritance to FALSE
        0,			// No creation flags
        NULL,		// Use parent's environment block
        NULL,		// Use parent's starting directory 
        &si,		// Pointer to STARTUPINFO structure
        &pi);		// Pointer to PROCESS_INFORMATION structure

    // Wait until child process exits and get the code
    WaitForSingleObject(pi.hProcess, INFINITE);

    // Check for our unique exit code
    GetExitCodeProcess(pi.hProcess, &exitCode);
    if (exitCode == 555)
    {
        found = TRUE;
    }

    // Close process and thread handles. 
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);

    if (found)
    {
        DBG_MSG(DBG_DEBUGACTIVEPROCESS, "Caught by DebugActiveProcess!");
        exit(DBG_DEBUGACTIVEPROCESS);
    }
}


// =======================================================================
// Timing Checks
// These checks focus on comparison of time stamps between a portion
// of code which is likely to be analyzed under a debugger. The goal
// is to determine with high probability that a debugger is allowing
// single step control, or that a breakpoint had been hit between
// the time check locations.
// =======================================================================

void adbg_RDTSC(void)
{
    BOOL found = FALSE;

#ifdef _WIN64
    uint64_t timeA = 0;
    uint64_t timeB = 0;
    TimeKeeper timeKeeper = { 0 };
    adbg_RDTSCx64(&timeKeeper);
    
    timeA = timeKeeper.timeUpperA;
    timeA = (timeA << 32) | timeKeeper.timeLowerA;

    timeB = timeKeeper.timeUpperB;
    timeB = (timeB << 32) | timeKeeper.timeLowerB;

    // 0x100000 is purely empirical and is based on the CPU clock speed
    // This value should be change depending on the length and complexity of 
    // code between each RDTSC operation.

    if (timeB - timeA > 0x100000)
    {
        found = TRUE;
    }

#else
    int timeUpperA = 0;
    int timeLowerA = 0;
    int timeUpperB = 0;
    int timeLowerB = 0;
    int timeA = 0;
    int timeB = 0;

    _asm
    {
        // rdtsc stores result across EDX:EAX
        rdtsc;
        mov [timeUpperA], edx;
        mov [timeLowerA], eax;

        // Junk code to entice stepping through or a breakpoint
        xor eax, eax;
        mov eax, 5;
        shr eax, 2;
        sub eax, ebx;
        cmp eax, ecx;

        rdtsc;
        mov [timeUpperB], edx;
        mov [timeLowerB], eax;
    }

    timeA = timeUpperA;
    timeA = (timeA << 32) | timeLowerA;

    timeB = timeUpperB;
    timeB = (timeB << 32) | timeLowerB;

    // 0x100000 is purely empirical and is based on the CPU clock speed
    // This value should be change depending on the length and complexity of 
    // code between each RDTSC operation.

    if (timeB - timeA > 0x10000)
    {
        found = TRUE;
    }

#endif

    if (found)
    {
        DBG_MSG(DBG_RDTSC, "Caught by RDTSC!");
        exit(DBG_RDTSC);
    }
}


void adbg_QueryPerformanceCounter(void)
{
    BOOL found = FALSE;
    LARGE_INTEGER t1;
    LARGE_INTEGER t2;

    QueryPerformanceCounter(&t1);

#ifdef _WIN64
    adbg_QueryPerformanceCounterx64();
#else
    // Junk or legit code.
    _asm
    {
        xor eax, eax;
        push eax;
        push ecx;
        pop eax;
        pop ecx;
        sub ecx, eax;
        shl ecx, 4;
    }
#endif

    QueryPerformanceCounter(&t2);

    // 30 is an empirical value
    if ((t2.QuadPart - t1.QuadPart) > 30)
    {
        found = TRUE;
    }

    if (found)
    {
        DBG_MSG(DBG_QUERYPERFORMANCECOUNTER, "Caught by QueryPerformanceCounter!");
        exit(DBG_QUERYPERFORMANCECOUNTER);
    }
}


void adbg_GetTickCount(void)
{
    BOOL found = FALSE;
    DWORD t1;
    DWORD t2;

    t1 = GetTickCount();

#ifdef _WIN64
    adbg_GetTickCountx64();
#else
    // Junk or legit code.
    _asm
    {
        xor eax, eax;
        push eax;
        push ecx;
        pop eax;
        pop ecx;
        sub ecx, eax;
        shl ecx, 4;
    }
#endif

    t2 = GetTickCount();

    // 30 milliseconds is an empirical value
    if ((t2 - t1) > 30)
    {
        found = TRUE;
    }

    if (found)
    {
        DBG_MSG(DBG_GETTICKCOUNT, "Caught by GetTickCount!");
        exit(DBG_GETTICKCOUNT);
    }
}


// =======================================================================
// CPU Checks
// These checks focus on aspects of the CPU, including hardware break-
// points, special interrupt opcodes, and flags.
// =======================================================================

void adbg_HardwareDebugRegisters(void)
{
    BOOL found = FALSE;
    CONTEXT ctx = { 0 };
    HANDLE hThread = GetCurrentThread();

    ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
    if (GetThreadContext(hThread, &ctx))
    {
        if ((ctx.Dr0 != 0x00) || (ctx.Dr1 != 0x00) || (ctx.Dr2 != 0x00) || (ctx.Dr3 != 0x00) || (ctx.Dr6 != 0x00) || (ctx.Dr7 != 0x00))
        {
            found = TRUE;
        }
    }

    if (found)
    {
        DBG_MSG(DBG_HARDWAREDEBUGREGISTERS, "Caught by a Hardware Debug Register Check!");
        exit(DBG_HARDWAREDEBUGREGISTERS);
    }
}


void adbg_MovSS(void)
{
    BOOL found = FALSE;

#ifdef _WIN64
    // This method does not work on x64
#else
    _asm
    {
        push ss;
        pop ss;
        pushfd;
        test byte ptr[esp + 1], 1;
        jne fnd;
        jmp end;
    fnd:
        mov found, 1;
    end:
        nop;
    }
#endif

    if (found)
    {
        DBG_MSG(DBG_MOVSS, "Caught by a MOV SS Single Step Check!");
        exit(DBG_MOVSS);
    }
}


// =======================================================================
// Exception Checks
// These checks focus on exceptions that occur when under the control of 
// a debugger. In several cases, there are certain exceptions that will
// be thrown only when running under a debugger.
// =======================================================================


void adbg_CloseHandleException(void)
{
    HANDLE hInvalid = (HANDLE)0xBEEF; // an invalid handle
    DWORD found = FALSE;

    __try
    {
        CloseHandle(hInvalid);
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        found = TRUE;
    }

    if (found)
    {
        DBG_MSG(DBG_CLOSEHANDLEEXCEPTION, "Caught by an CloseHandle exception!");
        exit(DBG_CLOSEHANDLEEXCEPTION);
    }
}


void adbg_SingleStepException(void)
{
    DWORD found = TRUE;

    // In this method we force an exception to occur. If it occurs
    // outside of a debugger, the __except() handler is called setting
    // found to FALSE. If the exception occurs inside of a debugger, the
    // __except() will not be called (in certain cases) leading to
    // found being TRUE.

    __try
    {
#ifdef _WIN64
        adbg_SingleStepExceptionx64();
#else
        _asm
        {
            pushfd;						// save EFFLAGS register
            or byte ptr[esp + 1], 1;	// set trap flag in EFFLAGS
            popfd;						// restore EFFLAGS register
        }
#endif
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        found = FALSE;
    }

    if (found)
    {
        DBG_MSG(DBG_SINGLESTEPEXCEPTION, "Caught by a Single Step Exception!");
        exit(DBG_SINGLESTEPEXCEPTION);
    }
}


void adbg_Int3(void)
{
    BOOL found = TRUE;

    __try
    {
#ifdef _WIN64
        adbg_Int3x64();
#else
        _asm
        {
            int 3;	// 0xCC standard software breakpoint
        }
#endif
    }

    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        found = FALSE;
    }

    if (found)
    {
        DBG_MSG(DBG_INT3CC, "Caught by a rogue INT 3!");
        exit(DBG_INT3CC);
    }
}


void adbg_PrefixHop(void)
{
    BOOL found = TRUE;

    __try
    {
#ifdef _WIN64
        // TODO: Not yet implemented in x64
        found = FALSE;
#else
        _asm
        {
            __emit 0xF3;	// 0xF3 0x64 is the prefix 'REP'
            __emit 0x64;
            __emit 0xCC;	// this gets skipped over if being debugged
        }
#endif
    }

    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        found = FALSE;
    }

    if (found)
    {
        DBG_MSG(DBG_PREFIXHOP, "Caught by a Prefix Hop!");
        exit(DBG_PREFIXHOP);
    }
}


void adbg_Int2D(void)
{
    BOOL found = TRUE;

    __try
    {
#ifdef _WIN64
        adbg_Int2Dx64();
#else
        _asm
        {
            int 0x2D;
            nop;
        }
#endif
    }

    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        found = FALSE;
    }

    if (found)
    {
        DBG_MSG(DBG_NONE, "Caught by a rogue INT 2D!");
        exit(DBG_NONE);
    }
}

// =======================================================================
// Other Checks
// Other kinds of checks that don't fit into the normal categories.
// =======================================================================

void adbg_CrashOllyDbg(void)
{
    // crash OllyDbg v1.x by exploit
    __try {
        OutputDebugString(TEXT("%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s"));
    }
    __except (EXCEPTION_EXECUTE_HANDLER) { ; }
}

peb(进程环境块）

//system version:18363.418

0: kd> dt nt!_peb
   +0x000 InheritedAddressSpace : UChar
   +0x001 ReadImageFileExecOptions : UChar
   +0x002 BeingDebugged    : UChar
   +0x003 BitField         : UChar
   +0x003 ImageUsesLargePages : Pos 0, 1 Bit
   +0x003 IsProtectedProcess : Pos 1, 1 Bit
   +0x003 IsImageDynamicallyRelocated : Pos 2, 1 Bit
   +0x003 SkipPatchingUser32Forwarders : Pos 3, 1 Bit
   +0x003 IsPackagedProcess : Pos 4, 1 Bit
   +0x003 IsAppContainer   : Pos 5, 1 Bit
   +0x003 IsProtectedProcessLight : Pos 6, 1 Bit
   +0x003 IsLongPathAwareProcess : Pos 7, 1 Bit
   +0x004 Padding0         : [4] UChar
   +0x008 Mutant           : Ptr64 Void
   +0x010 ImageBaseAddress : Ptr64 Void
   +0x018 Ldr              : Ptr64 _PEB_LDR_DATA
   +0x020 ProcessParameters : Ptr64 _RTL_USER_PROCESS_PARAMETERS
   +0x028 SubSystemData    : Ptr64 Void
   +0x030 ProcessHeap      : Ptr64 Void
   +0x038 FastPebLock      : Ptr64 _RTL_CRITICAL_SECTION
   +0x040 AtlThunkSListPtr : Ptr64 _SLIST_HEADER
   (部分）



0: kd> dt nt!_peb_ldr_data
   +0x000 Length           : Uint4B
   +0x004 Initialized      : UChar
   +0x008 SsHandle         : Ptr64 Void
   +0x010 InLoadOrderModuleList : _LIST_ENTRY  按加载循序的模块列表
   +0x020 InMemoryOrderModuleList : _LIST_ENTRY  按内存循序的模块列表
   +0x030 InInitializationOrderModuleList : _LIST_ENTRY  按初始化循序的列表
   +0x040 EntryInProgress  : Ptr64 Void
   +0x048 ShutdownInProgress : UChar
   +0x050 ShutdownThreadId : Ptr64 Void


0: kd> dt nt!_rtl_user_process_parameters
   +0x000 MaximumLength    : Uint4B
   +0x004 Length           : Uint4B
   +0x008 Flags            : Uint4B
   +0x00c DebugFlags       : Uint4B
   +0x010 ConsoleHandle    : Ptr64 Void
   +0x018 ConsoleFlags     : Uint4B
   +0x020 StandardInput    : Ptr64 Void
   +0x028 StandardOutput   : Ptr64 Void
   +0x030 StandardError    : Ptr64 Void
   +0x038 CurrentDirectory : _CURDIR
   +0x050 DllPath          : _UNICODE_STRING
   +0x060 ImagePathName    : _UNICODE_STRING   镜像路径
   +0x070 CommandLine      : _UNICODE_STRING   命令行参数
   +0x080 Environment      : Ptr64 Void
   +0x088 StartingX        : Uint4B
   +0x08c StartingY        : Uint4B
   +0x090 CountX           : Uint4B
   +0x094 CountY           : Uint4B
   +0x098 CountCharsX      : Uint4B
   +0x09c CountCharsY      : Uint4B
   +0x0a0 FillAttribute    : Uint4B
   +0x0a4 WindowFlags      : Uint4B
   +0x0a8 ShowWindowFlags  : Uint4B
   +0x0b0 WindowTitle      : _UNICODE_STRING   窗口标题
   +0x0c0 DesktopInfo      : _UNICODE_STRING
   +0x0d0 ShellInfo        : _UNICODE_STRING
   +0x0e0 RuntimeData      : _UNICODE_STRING
   +0x0f0 CurrentDirectores : [32] _RTL_DRIVE_LETTER_CURDIR
   +0x3f0 EnvironmentSize  : Uint8B
   +0x3f8 EnvironmentVersion : Uint8B
   +0x400 PackageDependencyData : Ptr64 Void
   +0x408 ProcessGroupId   : Uint4B
   +0x40c LoaderThreads    : Uint4B
   +0x410 RedirectionDllName : _UNICODE_STRING
   +0x420 HeapPartitionName : _UNICODE_STRING
   +0x430 DefaultThreadpoolCpuSetMasks : Ptr64 Uint8B
   +0x438 DefaultThreadpoolCpuSetMaskCount : Uint4B

PEB结构----枚举用户模块列表
05-16 1383
参考文章：1.  http://blog.youkuaiyun.com/ayken/archive/2...3/1509027.aspx2.  http://icwin.net/ShowArtitle.ASP?art_id=6315&cat_id=39本文在主主要以上述两篇文章为基础，对PEB的结构进行了详细的分析，重点是在揭示PEB结构中的list—entry的应用，并且以C语言Code进行实证。本文主要分
PEB TEB结构体使用
左手
08-02 4943
PEB TEB结构体属于windows平台进程的一个重要数据结构，使用windbg查看结构体信息及相关结构体成员信息的利用
windows-PEB结构
记录学习，一起进步
01-02 1154
peb结构指南
Windows逆向之PEB（Process Environment Block，进程环境块）
最新发布
m0_57836225的博客
08-12 1011
需要注意的是，在用户模式下直接访问和修改 PEB 是不被允许的，并且可能导致系统不稳定或出现错误。通常，开发人员会使用 Windows 提供的 API 函数来获取与进程相关的信息，而不是直接操作 PEB 结构。需要强调的是，使用这些技术进行恶意活动是非法和不道德的。在网络安全研究和合法的防御工作中，对这些技术的了解有助于增强系统的安全性和防范恶意攻击。进程环境块（PEB，Process Environment Block）是 Windows 操作系统中用于存储特定进程的相关信息的数据结构。
Windows探究TEB和PEB
qq_30528603的博客
09-03 841
在x86模式下FS寄存器是指向当前线程的TEB结构体的。GetProcessHeap是一个API函数，如果函数成功，则返回值是调用进程的堆的句柄。首先会获取TEB的地址，接着找到TEB偏移18h的位置找到ProcessHeap这个成员的值返回。我们只关注两个成员，一个是在偏移0x60处的ProcessEnvironmentBlock成员，一个就是第一个成员NtTib。我们知道在x64下gs指向的是TEB,在TEB偏移60的位置取得ProcessEnvionmentBlock,也就是PEB的地址。
Windows10下的TEB和PEB的分析
塔塔的日记
11-15 1855
TEB：线程环境块（Thread Environment Block），PEB是进程环境块（Process Environment Block）。
C语言实现windows反调试
05-21
在 Windows 平台上实现反调试可以采取多种方法，其中一种是使用 C 语言，以下是一些实现反调试的技术和方法： 1. 检测调试器 可在程序中使用 IsDebuggerPresent 函数来检测是否存在调试器。 2. 检测 PEB 可在...
静态反调试技术
优快云_2023的博客
03-12 3855
文章目录声明静态反调试目的注意PEBhttps://blog.youkuaiyun.com/CSNN2019/article/details/113113347BeingDebugged（+0x2）破解之法：Ldr（0xc）破解之法：ProcessHeap（+0x18）Flags(0xC)&Force Flags(+0x10)破解之法：NtGlobalFlag（+0x68）破解之法调试程序代码反调试技术系列： 声明 静态反调试目的 被调试的进程用静态反调试技术来侦测自身是否处于被调试状态，若侦测到处于被调试的状
windows下的反调试探究——调用API
星星我啊，已经很努力在学习了， 有人一起学习吗？Ziansec-1
03-04 920
那么可以用代码进行判断如下，若返回为TRUE则处于调试状态，若返回FALSE则未处于调试状态。那么这里为了更明显一点，首先看下QQ的PID是3872对应十六进制为F20是能够对应上的。(不考虑服务进程)，而当我们处于调试状态则父进程为调试器进程，那么我们就可以通过。是微软未公开的一个API，目前只能够通过一些结构的名字和逆向的方式来推断用途。因为这里检测的是否启用内核调试，这里直接运行是不处于调试状态。的相反数，当调试器存在时，返回值为0，不存在时则返回1。字段，当进程正在被调试时，返回值为。
由一道CTF对10种反调试的探究
0xDQ的博客
04-23 2101
0x00 前言 最近做的有些ctf中总是出现一些反动态调试的情况。由次对一些常见的反动态调试进行一些总结。 参考文章： https://blog.youkuaiyun.com/hgy413/article/details/7996652https://blog.youkuaiyun.com/yiyefangzhou24/article/details/6242459https://www.52pojie.cn/th...
5.4 Windows驱动开发：内核通过PEB取进程参数
优快云
11-21 8370
PEB结构`(Process Envirorment Block Structure)`其中文名是进程环境块信息，进程环境块内部包含了进程运行的详细参数信息，每一个进程在运行后都会存在一个特有的PEB结构，通过附加进程并遍历这段结构即可得到非常多的有用信息。 在应用层下，如果想要得到PEB的基地址只需要取`fs:[0x30]`即可，TEB线程环境块则是`fs:[0x18]`，如果在内核层想要得到应用层进程的PEB信息我们需要调用特定的内核函数来获取。
软件调试笔记10 - Windows概要：进程结构：令牌，PEB，ID, 句柄
imJaron的博客
11-23 625
访问令牌： TOKEN字段记录着这个进程的TOKEN结构地址，进程很多与安全有关的信息都在这个结构中。找到TOKEN字段值，然后用!Token命令查看。 也可以用dt nt!_TOKEN加上令牌地址来观察令牌对象。 PEB： PEB即进程环境块，包含了进程的大多数用户态信息。与EPROCESS结构位于内核空间的不同，PEB是在内核态建立后映射到用户空间的，因此在一个系统中，
枚举windows进程模块的几种方法—PEB内核结构详解
阔野的专栏
11-18 5447
1. 引言 在诸多的场景中（例如软件测试，软件安全研究等领域）经常需要分析在目标进程中具体加载了哪些模块(DLL)，以及所加载的模块的信息（如模块基地址，映射文件大小等）。获取这windows进程加载的模块信息，曾经有一个行之有效又很便捷的方法，使用windows提供PSAPI(psapi.dll，windows进程状态信息接口)提供的相关的接口就可以快捷的获取进程及进程加载的模块信息。有关PSAPI接口可以参考psapi.h或者微软的官方文档Psapi.h heade...
四种方法获取Teb和Peb
QXinHan的博客
12-05 2727
。
Shellcode编写
weixin_54452942的博客
04-23 1441
二是ESI寄存器的值自动增加32位，也就是当第一轮执行之后，esi中放的是下一个函数名称的地址，继续将其指向的内存空间的前四个字节送到eax中（也就是函数名称列表中的第一个函数名称的前四个字节），同时esi加4，指向了第二个函数名称的地址，一直向后比对，直到每个字节都比对成功后，此时的ecx中存的就是目标函数在函数名称列表中的位置。这个成员在PEB结构体中的偏移量是0x0C。在32位Windows系统中，FS寄存器指向TEB的起始地址，而在64位Windows系统中，GS寄存器指向TEB的起始地址。
枚举Windows进程中模块的几种方法-PEB内核结构详解
QQ_3094353627的博客
05-06 2112
1. 引言 在诸多的场景中（例如软件测试，软件安全研究等领域）经常需要分析在目标进程中具体加载了哪些模块(DLL)，以及所加载的模块的信息（如模块基地址，映射文件大小等）。获取这windows进程加载的模块信息，曾经有一个行之有效又很便捷的方法，使用windows提供PSAPI(psapi.dll，windows进程状态信息接口)提供的相关的接口就可以快捷的获取进程及进程加载的模块信息。有关PSAPI接口可以参考psapi.h或者微软的官方文档Psapi.h header - Win32 ...
TEB和PEB学习记录（一）
QXinHan的博客
11-07 893
TEB和PEB的学习记录
PEB结构块解析
热门推荐
liutianheng654的博客
03-22 1万+
peb结构块解析： 项目需要获取程序运行的一些状态，目前只能获取寄存器信息，故采用fs寄存器获取peb信息，本文主要探索peb中可以获得的进程信息。 windbg信息如下：win xp 下，和win7不一样，下面为xp环境dt nt!_peb +0x000 InheritedAddressSpace : UChar +0x001 ReadImageFileExecOptions :
windbg学习23（!peb和PEB结构）
weixin_30487201的博客
01-10 559
调试器用户经常会需要查看在启动调试目标时使用了哪些命令行参数，这个信息是保存在PEB中的，可以通过!peb来获取，这个命令将解析PEB并给出完整的命令行，所有已加载DLL的位置，以及环境变量等. 0:000> !peb PEB at 7ffdf000 InheritedAddressSpace: No ReadImageFileExecOptions: N...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值