Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- //http://waleedassar.blogspot.com
- //http://www.twitter.com/waleedassar
- //In OllyDbg, upon receiving an EXCEPTION_BREAKPOINT, it checks code in ExceptionAddress to ensure it is
- //0xCC or similar. If it is not, the behavior depends on the OllyDbg version.
- //In versions prior to 2.01, the exception is swallowed and the exception handler is not called.
- //In version 2.01 (alpha 4), several error messages pop up and process terminates.
- // Only version 2.01 (beta 2) handles it properly.
- //The following is code that exploits this bug to detect the presence of OllyDbg.
- #include "stdafx.h"
- #include "windows.h"
- #include "stdio.h"
- int __cdecl Hhandler(EXCEPTION_RECORD* pRec,void*,unsigned char* pContext,void*)
- {
- if(pRec->ExceptionCode==EXCEPTION_BREAKPOINT)
- {
- (*(unsigned long*)(pContext+0xB8))++;
- MessageBox(0,"Expected","waliedassar",0);
- ExitProcess(0);
- }
- return ExceptionContinueSearch;
- }
- void main()
- {
- __asm
- {
- push offset Hhandler
- push dword ptr fs:[0x0]
- mov dword ptr fs:[0x0],esp
- }
- RaiseException(EXCEPTION_BREAKPOINT,0,1,0);
- __asm
- {
- pop dword ptr fs:[0x0]
- pop eax
- }
- MessageBox(0,"OllyDbg Detected","waliedassar",0);
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement