检测当前进程是否存在硬件断点

来源：互联网发布：淘宝特百惠是正品吗编辑：程序博客网时间：2024/05/15 13:12

当前一些外挂为了躲避检测，不会去patch游戏内存代码，而使用硬断的方式来间接修改。

以下代码片段为了检测当前进程是否存在硬件断点而写：

char buff[MAX_PATH] = {0};DWORD __stdcall ThreadFunc(void* param){DWORD dwID = GetCurrentProcessId();HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, dwID);if (hSnap!=INVALID_HANDLE_VALUE){OutputDebugStringA("CreateToolhelp32Snapshot success.\n");THREADENTRY32 threadEntry;threadEntry.dwSize = sizeof(THREADENTRY32);BOOL b = Thread32First(hSnap, &threadEntry);while (b){OutputDebugStringA("Thread32First success.\n");HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, threadEntry.th32ThreadID);if (hThread!=NULL){OutputDebugStringA("OpenThread success.\n");CONTEXT ctx;memset(&ctx, 0, sizeof(CONTEXT));ctx.ContextFlags = CONTEXT_ALL;b = GetThreadContext(hThread, &ctx);if (b){OutputDebugStringA("GetThreadContext success.\n");if (ctx.Dr6!=0 || ctx.Dr7!=0){sprintf_s(buff, "GTC %08x %08x %08x %08x %08x %08x %08x %08x\n",&ctx,ctx.ContextFlags,ctx.Dr0,ctx.Dr1,ctx.Dr2,ctx.Dr3,ctx.Dr6,ctx.Dr7);OutputDebugStringA(buff);}}CloseHandle(hThread);}b = Thread32Next(hSnap, &threadEntry);}CloseHandle(hSnap);}return 0;}

0 0