检测INT3 软断点

“INT3”断点指令的机器码是 “0xcch”

检测思路,取函数地址,判断第一个字节是不是 “CCh”

BYTE bFirst = 0;
ProcAddres = GetProcAddress(LoadLibrary("user32.dll","MessageBox"));
bFirst = *((BYTE*)ProcAddress);
if(bFirst == 0xCC)
{
    return TRUE;   
}

 

posted @ 2016-02-27 21:26  dozeoo  阅读(389)  评论(0编辑  收藏  举报