سؤال حول كتابة Plugin لتجاوز دالة IsDebuggerPresent

[Rever7eR]

المشروع مرفق Corrumped

يعمل بدون مشاكل ربما الخلل بجهازك على كل حال هذا هو الكود كاملا :

PHP كود :

// Author : Rever7eR
// Special thanks goes to : Kao , Hs32-Idir , onexite , M.ABdelAziZ , S.FATEH
library AADebug;

uses
  SysUtils,
  plugin,
  windows,
  Classes;

{$R *.res}

type

  PEB = record
    Reserved1: array [0 .. 1] of Byte;
    BeingDebugged: Byte;
    Reserved2: Byte;
    Reserved3: array [0 .. 1] of Pointer;
    Ldr: Pointer;
    Reserved4: array [0 .. 102] of Byte;
    Reserved5: array [0 .. 51] of Pointer;
    PostProcessInitRoutine: Pointer;
    Reserved6: array [0 .. 127] of Byte;
    Reserved7: Pointer;
    SessionId: ULONG;
  end;

  PROCESS_BASIC_INFORMATION = record
    Reserved1: Pointer;
    PebBaseAddress: Pointer;
    Reserved2: array [0 .. 1] of Pointer;
    UniqueProcessId: cardinal;
    Reserved3: Pointer;
  end;

resourcestring
 PLUGIN_NAME = 'Anti IsDebuggerPresent';

var
 g_hwndOlly: HWND;  // OllyDbg Window Handle
 ProcessBasicInfo : PROCESS_BASIC_INFORMATION;
 Length:cardinal;
 EB : PEB;

function ODBG_Plugininit(ollydbgversion:Integer;hWndOlly:HWND;features:PULONG):Integer;cdecl;
begin
  g_hwndOlly := hWndOlly;
  Addtolist(0, 0, pchar(PLUGIN_NAME));
  Result := 0;
end;

function ODBG_Plugindata(name: PChar): integer; cdecl;
begin
  StrLCopy(name, PChar(PLUGIN_NAME), 32);
  Result := PLUGIN_VERSION;
end;

function NtQueryInformationProcess(ProcessHandle: THANDLE; ProcessInformationClass: DWORD;
ProcessInformation: Pointer;ProcessInformationLength: ULONG; ReturnLength: PULONG): LongInt;
stdcall; external 'ntdll.dll';

procedure Getinfo;
var
  debugee,PID : THandle;
  buffer : Byte;
  fs :  TMemoryStream;
begin
fs := TMemoryStream.Create;
buffer := $00;
PID := PluginGetValue(VAL_PROCESSID);
debugee := OpenProcess(PROCESS_ALL_ACCESS,False,PID);
NtQueryInformationProcess(debugee,0,@ProcessBasicInfo,sizeof(ProcessBasicInfo),@length);
readprocessmemory(debugee,ProcessBasicInfo.PebBaseAddress,@EB,sizeof(EB),length);
WriteProcessMemory(debugee,pointer(dword(ProcessBasicInfo.PebBaseAddress) + 2),@buffer,sizeof(buffer),length);
fs.Seek(EB.BeingDebugged,soBeginning);
fs.Write(buffer,1);
fs.Free;
end;


procedure ODBG_Pluginaction(origin:Integer; action:Integer; pItem:Pointer);cdecl;
begin
  if (origin = PM_MAIN) then
  begin
      Getinfo;
    end;
end;

   exports
  ODBG_Plugininit    name '_ODBG_Plugininit',
  ODBG_Plugindata    name '_ODBG_Plugindata',
  ODBG_Pluginaction  name '_ODBG_Pluginaction';
begin

end.