[Amin_Mansouri]

کد:

unit AntiDbg;
{
very simple AntiDebug Unit for Delphi
can detect most debuggers:
OllyDBG,Immunity Debugger,WinDbg,W32DAsm,IDA,....
SoftICE,Syser,TRW,TWX

Tested on Win9x-Me-2k-XP-2k3-Vista

Coded by: Magic_h2001

magic_h2001@yahoo.com
http://magic.shabgard.org

just for fun ;)
}

interface

uses Windows,SysUtils,TlHelp32;

function IsDBG:Boolean;

implementation

var
Found:Boolean=False;
hSnapmod: THANDLE;
ModInfo: MODULEENTRY32;
hSnap: THANDLE;
ProcessInfo: PROCESSENTRY32;
ProcID:DWORD;
Tm1,Tm2:Int64;

function IsDebuggerPresent():BOOL; stdcall;external 'kernel32.dll' name 'IsDebuggerPresent';

function GetSys:string;
var
  Gsys : array[0..MAX_PATH] of Char;
begin
  GetSystemDirectory(Gsys,MAX_PATH);
  Result:=Gsys;
  if length(Result)>0 then
  if Result[length(Result)]<>'\' then Result:=Result+'\';
end;

function UpCaseStr(S:string):String;
var i:integer;
begin
  Result:=s;
  if s='' then exit;
  for i:=1 to length(s) do
    Result[i]:=upcase(Result[i]);
end;

function RDTSC: Int64; assembler;
asm
  PUSH EDI
  PUSH EDI
  PUSH EDI
  PUSH EDI
  DB 0fh ,031h
  POP EDI
  POP EDI
  POP EDI
  POP EDI
end;

function IsRing0DBG(S:string): boolean;
var hFile: Thandle;
begin
  Result := False;
  hFile := CreateFileA(Pchar(S), GENERIC_READ or GENERIC_WRITE,
    0, nil, OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL, 0);
  if( hFile <> INVALID_HANDLE_VALUE ) then begin
    CloseHandle(hFile);
    Result := TRUE;
  end;
end;

function IsDBG:Boolean;
var i: Integer;
begin
  Tm1:=RDTSC;
  for i:=0 to 255 do
    OutputDebugStringA('kernel32.dll');
  Tm2:=RDTSC-Tm1;
  if Tm2<9999 then Found:=True;
  if Tm2>299999999 then Found:=True;
  hSnap:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
  ProcessInfo.dwSize:=sizeof(PROCESSENTRY32);
  Process32First(hSnap,ProcessInfo);
  repeat
   if Pos('OLLYDBG',UpCaseStr(ProcessInfo.szExeFile))<>0 then Found:=True;
   if Pos('DBG',UpCaseStr(ProcessInfo.szExeFile))<>0 then Found:=True;
   if Pos('DEBUG',UpCaseStr(ProcessInfo.szExeFile))<>0 then Found:=True;
   if Pos('IDAG',UpCaseStr(ProcessInfo.szExeFile))<>0 then Found:=True;
   if Pos('W32DSM',UpCaseStr(ProcessInfo.szExeFile))<>0 then Found:=True;
   ProcID:=ProcessInfo.th32ProcessID;
   hSnapMod:=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,ProcID);
   ModInfo.dwSize:=sizeof(MODULEENTRY32);
   Module32First(hSnapMod,ModInfo);
   repeat
    if Pos('OLLYDBG',UpCaseStr(ModInfo.szExePath))<>0 then Found:=True;
    if Pos('W32DSM',UpCaseStr(ModInfo.szExePath))<>0 then Found:=True;
   until (not Module32Next(hSnapMod,ModInfo));
   CloseHandle(hSnapMod);
  until (not Process32Next(hSnap,ProcessInfo));
  CloseHandle(hSnap);
  if FileExists(GetSys+'drivers\sice.sys') then Found:=True;
  if FileExists(GetSys+'drivers\ntice.sys') then Found:=True;
  if FileExists(GetSys+'drivers\syser.sys') then Found:=True;
  if FileExists(GetSys+'drivers\winice.sys') then Found:=True;
  if FileExists(GetSys+'drivers\sice.vxd') then Found:=True;
  if FileExists(GetSys+'drivers\winice.vxd') then Found:=True;
  if FileExists(GetSys+'winice.vxd') then Found:=True;
  if FileExists(GetSys+'vmm32\winice.vxd') then Found:=True;
  if FileExists(GetSys+'sice.vxd') then Found:=True;
  if FileExists(GetSys+'vmm32\sice.vxd') then Found:=True;
  if IsDebuggerPresent then Found:=True;
  if IsRing0DBG('\\.\SICE') then Found:=True;
  if IsRing0DBG('\\.\SIWVID') then Found:=True;
  if IsRing0DBG('\\.\NTICE') then Found:=True;
  if IsRing0DBG('\\.\TRW') then Found:=True;
  if IsRing0DBG('\\.\TWX') then Found:=True;
  if IsRing0DBG('\\.\ICEEXT') then Found:=True;
  if IsRing0DBG('\\.\SYSER') then Found:=True;
  Result:=Found;
end;

end.