Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #15  
Old 03-02-2005, 05:01
drizz
 
Posts: n/a
Code:
; debug api test
;================
	mov eax,cs
	cmp ax,0FFh
	setg Is9x
	.if Is9x
		;; structures are documented by EliCZ
		mov eax,fs:[20h];TIB.DebugContext
		test eax,eax
		setnz al
		or Detected,al
		mov ebx,fs:[30h];TIB.pParentPDB
		mov eax,[ebx+20h];[ebx].PDB.flags
		and eax,1;fDebugSingle equ 1
		or Detected,al
		mov eax,[ebx+54h];[ebx].PDB.DebuggeeCB  :IsDebuggerPresent
		test eax,eax
		setnz al
		or Detected,al
	.else
		;; ddk
		mov eax,fs:[30h];TEB.pPEB         ; pointer to PEB
		movzx eax,byte ptr [eax+2];[eax].PEB.BeingDebugged   :IsDebuggerPresent
		or Detected,al
	.endif
you can't patch DebugContext in 9x
while BeingDebugged you can (upb's 1st post)

debug api in 9x suck
for example try to trace (single step)
not esp
not esp
*crash*

forget about 9x, support only NT (it's only a unpacker, unpacked exe must work on both)
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Beating a two session max! abitofboth General Discussion 6 04-14-2005 09:07


All times are GMT +8. The time now is 14:01.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )