反调试——10——检测进程和窗口

检测一些常见的调试器的进程以及窗口是否存在也可以作为一种反调试的手段。

这个比较简单就直接上代码了：

#include<Windows.h>
#include<iostream>
#include<tlhelp32.h>
using namespace std;
​
void TestProcess()
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if (hSnapshot == INVALID_HANDLE_VALUE)
{
cout << "打开进程快照失败" << endl;
return;
}
PROCESSENTRY32 tempContext{ 0 };
tempContext.dwSize = sizeof(PROCESSENTRY32);
Process32First(hSnapshot, &tempContext);
do
{
if (wcscmp(tempContext.szExeFile,L"x32dbg.exe") ==0)
{
cout << "检测到了xdbg调试进程" << endl;
break;
}
} while (Process32Next(hSnapshot,&tempContext));
​
CloseHandle(hSnapshot);
}
​
void CheckWindow()
{
HANDLE hWindow = FindWindowA(0,"x32dbg");
if (hWindow != NULL)
{
cout << "检测到了x32dbg" << endl;
}
​
}
​
int main()
{
TestProcess();
CheckWindow();
return 0;
}

 

#include<Windows.h>#include<iostream>#include<tlhelp32.h>using namespace std;
void TestProcess(){HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);if (hSnapshot == INVALID_HANDLE_VALUE){cout << "打开进程快照失败" << endl;return;}PROCESSENTRY32 tempContext{ 0 };tempContext.dwSize = sizeof(PROCESSENTRY32);Process32First(hSnapshot, &tempContext);do{if (wcscmp(tempContext.szExeFile,L"x32dbg.exe") ==0){cout << "检测到了xdbg调试进程" << endl;break;}} while (Process32Next(hSnapshot,&tempContext));
CloseHandle(hSnapshot);}
void CheckWindow(){HANDLE hWindow = FindWindowA(0,"x32dbg");if (hWindow != NULL){cout << "检测到了x32dbg" << endl;}
}
int main(){TestProcess();CheckWindow();return 0;}