1. 应用层反调试
1. 检测是否正在被调试（使用 IsDebuggerPresent API）：
```cpp
#include <Windows.h>
if (IsDebuggerPresent())
{
// 检测到调试器，执行相应操作
ExitProcess(0); // 或者其他操作
}
```
2. 使用 NtQueryInformationProcess 检测调试器：
```cpp
#include <Windows.h>
#include <winternl.h>
typedef NTSTATUS (WINAPI *pNtQueryInformationProcess)(
HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);
bool IsBeingDebugged()
{
HANDLE hProcess = GetCurrentProcess();
PPEB pPeb = nullptr;
PROCESS_BASIC_INFORMATION pbi;
ZeroMemory(&pbi, sizeof(pbi));
pNtQueryInformationProcess NtQueryInformationProcess =
(pNtQueryInformationProcess)GetProcAddress(
GetModuleHandle(TEXT("ntdll.dll")),
"NtQueryInformationProcess");
if (NtQueryInformationProcess)
{
NTSTATUS status = NtQueryInformationProcess(
hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), nullptr);
if (NT_SUCCESS(status))
{
pPeb = pbi.PebBaseAddress;
return pPeb->BeingDebugged;
}
}
return false;
}
```
3. 检查调试端口：
```cpp
bool CheckRemoteDebuggerPresent()
{
BOOL isDebuggerPresent = FALSE;
CheckRemoteDebuggerPresent(GetCurrentProcess(), &isDebuggerPresent);
return isDebuggerPresent != FALSE;
}
```
4. 使用异常处理来检测调试器：
```cpp
bool DetectDebuggerViaException()
{
__try
{
RaiseException(EXCEPTION_BREAKPOINT, 0, 0, NULL);
}
__except(GetExceptionCode() == EXCEPTION_BREAKPOINT
? EXCEPTION_EXECUTE_HANDLER
: EXCEPTION_CONTINUE_SEARCH)
{
return false;
}
return true;
}
```
5. 检测调试器的时间差：
```cpp
bool TimingCheck()
{
DWO