[Anti-Reversing] IsDebuggerPresent() ๊ตฌํ
Visual studio์ inline assembly๋ฅผ ์ฌ์ฉํด ๊ตฌํ. bool isDebuggerPresent(){ bool returnValue = false; __asm{ push eax mov eax, fs:[0x30] //eax = &PEB mov eax, [eax+0x02] //eax = *(&(eax+0x02)) mov dword ptr [returnValue], eax pop eax } return returnValue; } IsDebuggerPresent() ํจ์์ ์๋ ์๋ฆฌ๋ ๊ฐ๋จํ๋ค. ํด๋น ํจ์๋ PEB ๊ตฌ์กฐ์ฒด์ ๋ ๋ฒ์งธ ๋ฉค๋ฒ์ธ BeingDebugged ๊ฐ์ ์ฝ์ด์ค๊ณ , ์ด ๊ฐ์ผ๋ก ๋๋ฒ๊น
์ฌ๋ถ๋ฅผ ์ ์๊ฐ ์๋ค. BeingDebugged != 0 ์ด๋ผ๋ฉด ๋๋ฒ๊น
์ค, BeingDebugge..