[持续更新]过SOD检测OD方法

来源：互联网发布：网络语肝是什么意思编辑：程序博客网时间：2024/04/29 09:29

使用异常

Closehandle
如果给CloseHandle()函数一个无效句柄作为输入参数，在无调试器时，将会返回一个错误代码，而有调试器存在时，
将会触发一个EXCEPTION_INVALID_HANDLE (0xc0000008)的异常。

bool getdebebugbyCloseHandle()//返回true说明有OD{__try{CloseHandle((HANDLE)0x00001234);return false;}__except(1){return true;}}

仅在进程初始化创建主线程时执行的代码

//必须先于程序执行 TLS EPO 窗口回调等等void getdebugbyOEP(){IMAGE_DOS_HEADER*dos_head=(IMAGE_DOS_HEADER*)GetModuleHandle(NULL);PIMAGE_NT_HEADERS32 nt_head=(PIMAGE_NT_HEADERS32)((DWORD)dos_head+(DWORD)dos_head->e_lfanew);BYTE*OEP=(BYTE*)(nt_head->OptionalHeader.AddressOfEntryPoint+(DWORD)dos_head);for(unsigned long index=0;index<200;index++){if(OEP[index]==0xcc){ExitProcess(0);}}}

GetWindowLongA 获取窗口样式

OD的窗口样式出卖了它

代码:

// checkod.cpp : 定义控制台应用程序的入口点。//#include <stdio.h>#include <Windows.h>void CALLBACK HandleWinEvent(HWINEVENTHOOK hook, DWORD event, HWND hwnd,  LONG idObject, LONG idChild,  DWORD dwEventThread, DWORD dwmsEventTime){char name[MAX_PATH];GetWindowTextA(hwnd,name,MAX_PATH);LONG mStyle = GetWindowLongA(hwnd,GWL_STYLE);LONG ExtStyle=GetWindowLongA(hwnd,GWL_EXSTYLE);if(mStyle==0x57c70000&&ExtStyle==0x140){printf("find od 1 %08x %s\r\n",dwEventThread,name);}if (mStyle==0x56CF0000&&ExtStyle==0x140){printf("Find od 2 %08x %s\r\n",dwEventThread,name);}}int main(int argc, char argv[]){CoInitialize(NULL);HWINEVENTHOOK hHook = SetWinEventHook( EVENT_MIN , EVENT_MAX , NULL, HandleWinEvent, 0, 0, WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNPROCESS);if (hHook){printf("set hook ok\r\n");}else{printf("some hack in this os\r\n");exit(-1);}MSG msg;while(GetMessage(&msg,NULL,0,0)){TranslateMessage(&msg);DispatchMessage(&msg);}return 0;}

窗口名的检测

搜集了常见OD的窗口名特征

#include <stdio.h>#include <windows.h>#include <string.h>BOOL bFind = FALSE;BOOL CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam){if (hwnd == INVALID_HANDLE_VALUE){return FALSE;}char szbuf[MAX_PATH] = {0};int ilens = 0;ilens = GetWindowTextA(hwnd, szbuf, sizeof(szbuf)/sizeof(char));if(ilens != 0){PCHAR pstr = NULL;pstr = strstr(szbuf, "LCG");if(pstr == NULL)pstr = strstr(szbuf,"- 主线程");if(pstr == NULL)pstr = strstr(szbuf,"模块 -");if(pstr == NULL)pstr = strstr(szbuf,"main thread");if(pstr == NULL)pstr = strstr(szbuf,",module");if(pstr == NULL)pstr = strstr(szbuf,",- Module;");if(pstr == NULL)pstr = strstr(szbuf,"- Thread");if(pstr == NULL)pstr = strstr(szbuf,"G.P.U");if(pstr == NULL)pstr = strstr(szbuf,"+ 主线程");if(pstr == NULL)pstr = strstr(szbuf,"主线程,");if(pstr == NULL)pstr = strstr(szbuf,",模块");if(pstr == NULL)pstr = strstr(szbuf,"模块 +");if(pstr == NULL)pstr = strstr(szbuf,"PYG");if(pstr == NULL)pstr = strstr(szbuf,"FCK");if(pstr == NULL)pstr = strstr(szbuf,"?块");if(pstr == NULL)pstr = strstr(szbuf,"主线程");if(pstr == NULL)pstr = strstr(szbuf,"BH");if(pstr == NULL)pstr = strstr(szbuf,"吾爱");if(pstr == NULL)pstr = strstr(szbuf,"破解");if(pstr == NULL){pstr = strstr(szbuf,"[");if(pstr != NULL)pstr = strstr(szbuf,"]");if(pstr != NULL)goto END;}END:if(pstr != NULL){bFind = TRUE;printf("Find Od!\r\n");return FALSE;}}return TRUE;}VOID EnumOD(){EnumWindows(EnumWindowsProc, NULL);}int main(int argc, char* argv[]){EnumOD();if (bFind != TRUE){printf("Find nothind!\n");}getchar();return 0;}

0 0