diff --git a/Protector/AntiDebug.cpp b/Protector/AntiDebug.cpp new file mode 100644 index 0000000..00be212 --- /dev/null +++ b/Protector/AntiDebug.cpp @@ -0,0 +1,52 @@ +#include + +inline bool BasicDebugTriggered() +{ + if (IsDebuggerPresent()) + return true; + + return false; +} +inline bool HWBPDebugTriggered() +{ + CONTEXT ctx; + ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS; + GetThreadContext(GetCurrentThread(), &ctx); + + if (ctx.Dr0 != 0 || ctx.Dr1 != 0 || ctx.Dr2 != 0 || ctx.Dr3 != 0) + return true; + + return false; +} +inline bool HypervisorDebugTriggered() +{ + __try + { + __asm + { + __emit 0xf3; + __emit 0x90; + __emit 0x00; + } + } + __except (EXCEPTION_EXECUTE_HANDLER) + { + return true; + } + + return false; +} + +inline bool AntiDebugTriggered() +{ + if (BasicDebugTriggered()) + return true; + + if (HWBPDebugTriggered()) + return true; + + if (HypervisorDebugTriggered()) + return true; + + return false; +} \ No newline at end of file diff --git a/Protector/AntiLibrary.cpp b/Protector/AntiLibrary.cpp new file mode 100644 index 0000000..de7c5a8 --- /dev/null +++ b/Protector/AntiLibrary.cpp @@ -0,0 +1,18 @@ +#include + +#pragma comment(linker, "/INCLUDE:_tls_used") //Use TLS + +void NTAPI TlsCallback(PVOID DllHandle, DWORD dwReason, PVOID Reserved) +{ + if (dwReason == DLL_PROCESS_ATTACH) + { + //Check if debugger is present + if (IsDebuggerPresent()) + ExitProcess(0); + } +} +#pragma data_seg(".CRT$XLX") +PIMAGE_TLS_CALLBACK p_thread_callback[] = { TlsCallback, 0 }; +#pragma data_seg() + +//TODO: PEB LDR -> Sign \ No newline at end of file diff --git a/Protector/AntiProcess.cpp b/Protector/AntiProcess.cpp new file mode 100644 index 0000000..e69de29 diff --git a/Protector/CodeIntegrity.cpp b/Protector/CodeIntegrity.cpp new file mode 100644 index 0000000..6f42b75 --- /dev/null +++ b/Protector/CodeIntegrity.cpp @@ -0,0 +1,49 @@ +#include +#include +#include +inline bool GetSectionHash(DWORD_PTR moduleBase, const std::string& sectionName, LPDWORD pHash) +{ + IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)moduleBase; + if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) + return false; + IMAGE_NT_HEADERS* pNtHeaders = (IMAGE_NT_HEADERS*)(moduleBase + pDosHeader->e_lfanew); + if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE) + return false; + IMAGE_SECTION_HEADER* pSectionHeader = IMAGE_FIRST_SECTION(pNtHeaders); + + for (int i = 0; i < pNtHeaders->FileHeader.NumberOfSections; i++) + { + if (strcmp((char*)pSectionHeader->Name, sectionName.c_str()) == 0) + { + *pHash = 0xDEADBEEF; + for (int i = 0; i < pSectionHeader->SizeOfRawData; i += 4) + { + *pHash = _mm_crc32_u32(*pHash, *(DWORD*)(moduleBase + pSectionHeader->VirtualAddress + i)); + } + return true; + } + pSectionHeader++; + } + return false; +} +class CodeIntegrityVerifier +{ +private: + DWORD_PTR m_moduleBase; + DWORD_PTR m_moduleSize; + DWORD m_sectionHash; +public: + CodeIntegrityVerifier(DWORD_PTR moduleBase, DWORD_PTR moduleSize) + { + m_moduleBase = moduleBase; + m_moduleSize = moduleSize; + GetSectionHash(moduleBase, ".text", &m_sectionHash); + } + bool Verify() + { + DWORD hash; + if (!GetSectionHash(m_moduleBase, ".text", &hash)) + return false; + return hash == m_sectionHash; + } +}; \ No newline at end of file diff --git a/Protector/Core.cpp b/Protector/Core.cpp new file mode 100644 index 0000000..e69de29 diff --git a/Protector/Protector.vcxproj b/Protector/Protector.vcxproj index 4b406e7..923fb77 100644 --- a/Protector/Protector.vcxproj +++ b/Protector/Protector.vcxproj @@ -1,4 +1,4 @@ - + @@ -17,7 +17,6 @@ Release x64 - 17.0 @@ -53,27 +52,24 @@ true Unicode - - + + + + + + + + + + + + + - - - - - - - - - - - - - - Level3 @@ -130,9 +126,14 @@ true - - + + + + + + + - + \ No newline at end of file diff --git a/Protector/Protector.vcxproj.filters b/Protector/Protector.vcxproj.filters index 493ccf6..b22b9e2 100644 --- a/Protector/Protector.vcxproj.filters +++ b/Protector/Protector.vcxproj.filters @@ -14,4 +14,21 @@ rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + 소스 파일 + + + 소스 파일 + + + 소스 파일 + + + 소스 파일 + + + 소스 파일 + + \ No newline at end of file