كيف إكتشاف وجود منقح ؟ - نسخة قابلة للطباعة

كود :

[الطبعة الأولى من كتاب الفريق] مدخل إلى الهندسة العكسية :
http://www.at4re.com/f/showthread.php?2229

[الطبعة الثانية من كتاب الفريق] الهندسة العكسية : خطوة إلى الأمام :
http://www.at4re.com/f/showthread.php?6557

مشوار الألف ميل يبدأ بخطوة .. : ( موضوع مهم جداً جداً جداً )
http://www.at4re.com/f/showthread.php?4731

كود :

TUnicode_String = packed record
    Length,
    MaximumLength:Word;
    Buffer:PWideChar;
  end;

  Tobject_Type_Tnformation = packed record
    TypeName:TUnicode_String;
    TotalNumberOfHandles,
    TotalNumberOfObjects:LongWord;
  end;

  PObject_All_Information = ^TObject_All_Information;
  TObject_All_Information = packed record
    NumberOfObjects:LongWord;
    ObjectTypeInformation:array[0..0] of Tobject_Type_Tnformation;
  end;


function ZwQueryObject(Handle:LongWord;
                       ObjectInformationClass:LongWord;
                       ObjectInformation:Pointer;
                       ObjectInformationLength:LongWord;
                       var ReturnLength:LongInt):LongWord stdcall;



function GetDebugger:LongBool;
var size:LongWord;
    pMem:PObject_All_Information;
    ReturnLength,length:LongInt;
    TypeName:PWideChar;
    tmpMem:Pointer;
begin  //
  size:=0;
  Result := False;
  ReturnLength:=0;
  repeat
    Inc(size,ReturnLength);
    pMem:=VirtualAlloc(nil,size,MEM_COMMIT,PAGE_READWRITE);
    tmpMem := pMem;
    if(ZwQueryObject(0,3,pMem,size,ReturnLength) < 0)then
    begin
      VirtualFree(pMem,0,MEM_RELEASE);
      pMem := nil;
    end
    else
    Break;
  until False;

  if pMem <> nil then
  begin
    TypeName:='';
    while TypeName <> nil do
    begin
      length :=  pMem.ObjectTypeInformation[0].TypeName.Length;
      TypeName := pmem.ObjectTypeInformation[0].TypeName.Buffer;
      if length = 22 then
      begin
        if TypeName = 'DebugObject' then
        begin
          if pmem.ObjectTypeInformation[0].TotalNumberOfObjects > 0 then
          begin
            Result := True;
            Break;
          end
	        else
	        Break;
        end;
      end;
      pMem:= Pointer(LongInt(TypeName)+length and -4);
    end;
    VirtualFree(tmpMem,0,MEM_RELEASE);
  end;
end;

function ZwQueryObject;external 'ntdll.dll';