-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Anti-Debug - HWBP 감지 - IsDebuggerPresent 감지 - Hypervisor 감지 Anti-Library - TLS 콜백 등록 TODO: TLS 콜백에서 DLL 감지, LDR 루프 Anti-Process: TODO: 프로세스 감지 Code Integrity Check: - 변조 체크 Core TODO: Class initialization, Report 함수 만들기
- Loading branch information
1 parent
2d33e17
commit 5c7b2d7
Showing
7 changed files
with
158 additions
and
21 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| #include <Windows.h> | ||
|
|
||
| inline bool BasicDebugTriggered() | ||
| { | ||
| if (IsDebuggerPresent()) | ||
| return true; | ||
|
|
||
| return false; | ||
| } | ||
| inline bool HWBPDebugTriggered() | ||
| { | ||
| CONTEXT ctx; | ||
| ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS; | ||
| GetThreadContext(GetCurrentThread(), &ctx); | ||
|
|
||
| if (ctx.Dr0 != 0 || ctx.Dr1 != 0 || ctx.Dr2 != 0 || ctx.Dr3 != 0) | ||
| return true; | ||
|
|
||
| return false; | ||
| } | ||
| inline bool HypervisorDebugTriggered() | ||
| { | ||
| __try | ||
| { | ||
| __asm | ||
| { | ||
| __emit 0xf3; | ||
| __emit 0x90; | ||
| __emit 0x00; | ||
| } | ||
| } | ||
| __except (EXCEPTION_EXECUTE_HANDLER) | ||
| { | ||
| return true; | ||
| } | ||
|
|
||
| return false; | ||
| } | ||
|
|
||
| inline bool AntiDebugTriggered() | ||
| { | ||
| if (BasicDebugTriggered()) | ||
| return true; | ||
|
|
||
| if (HWBPDebugTriggered()) | ||
| return true; | ||
|
|
||
| if (HypervisorDebugTriggered()) | ||
| return true; | ||
|
|
||
| return false; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| #include <Windows.h> | ||
|
|
||
| #pragma comment(linker, "/INCLUDE:_tls_used") //Use TLS | ||
|
|
||
| void NTAPI TlsCallback(PVOID DllHandle, DWORD dwReason, PVOID Reserved) | ||
| { | ||
| if (dwReason == DLL_PROCESS_ATTACH) | ||
| { | ||
| //Check if debugger is present | ||
| if (IsDebuggerPresent()) | ||
| ExitProcess(0); | ||
| } | ||
| } | ||
| #pragma data_seg(".CRT$XLX") | ||
| PIMAGE_TLS_CALLBACK p_thread_callback[] = { TlsCallback, 0 }; | ||
| #pragma data_seg() | ||
|
|
||
| //TODO: PEB LDR -> Sign |
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| #include <Windows.h> | ||
| #include <string> | ||
| #include <intrin.h> | ||
| inline bool GetSectionHash(DWORD_PTR moduleBase, const std::string& sectionName, LPDWORD pHash) | ||
| { | ||
| IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)moduleBase; | ||
| if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) | ||
| return false; | ||
| IMAGE_NT_HEADERS* pNtHeaders = (IMAGE_NT_HEADERS*)(moduleBase + pDosHeader->e_lfanew); | ||
| if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE) | ||
| return false; | ||
| IMAGE_SECTION_HEADER* pSectionHeader = IMAGE_FIRST_SECTION(pNtHeaders); | ||
|
|
||
| for (int i = 0; i < pNtHeaders->FileHeader.NumberOfSections; i++) | ||
| { | ||
| if (strcmp((char*)pSectionHeader->Name, sectionName.c_str()) == 0) | ||
| { | ||
| *pHash = 0xDEADBEEF; | ||
| for (int i = 0; i < pSectionHeader->SizeOfRawData; i += 4) | ||
| { | ||
| *pHash = _mm_crc32_u32(*pHash, *(DWORD*)(moduleBase + pSectionHeader->VirtualAddress + i)); | ||
| } | ||
| return true; | ||
| } | ||
| pSectionHeader++; | ||
| } | ||
| return false; | ||
| } | ||
| class CodeIntegrityVerifier | ||
| { | ||
| private: | ||
| DWORD_PTR m_moduleBase; | ||
| DWORD_PTR m_moduleSize; | ||
| DWORD m_sectionHash; | ||
| public: | ||
| CodeIntegrityVerifier(DWORD_PTR moduleBase, DWORD_PTR moduleSize) | ||
| { | ||
| m_moduleBase = moduleBase; | ||
| m_moduleSize = moduleSize; | ||
| GetSectionHash(moduleBase, ".text", &m_sectionHash); | ||
| } | ||
| bool Verify() | ||
| { | ||
| DWORD hash; | ||
| if (!GetSectionHash(m_moduleBase, ".text", &hash)) | ||
| return false; | ||
| return hash == m_sectionHash; | ||
| } | ||
| }; |
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters