strivexjun / xantidebug Goto Github PK

开od就死了。

Why this error?

Source codes in repo https://github.com/lurumdare/khaleesi/tree/xantidebug
commit https://github.com/lurumdare/khaleesi/commit/1929297589062700abc42a51ef8eb14628282aba

Hello

Maybe recode this lib https://github.com/LordNoteworthy/al-khaser for additional protection?

I have some suggestions, would be nice to implement:

• Don't call RtlGetVersion, use ASM and load PEB into RAX
• Don't call get usermode functions... find a way to direct syscall or something (maybe edit wow64ext function X64Call and put in call SYSCALL ?)
• Use RtlComputeCrc32 instead of that class ?
• ldasm can throw exception, find a way to catch all and do another operation ?

That's all for now, let me know what you think.

How to use your code with mingw compiler ?

How to self checksuming work Tell me how it works?

Hi,

What's the purpose of this ?

		unsigned char *pRandChar = (unsigned char *)_pagePtr;
		for (size_t i = 0; i < _pageSize; i++)
		{
			pRandChar[i] = LOBYTE(rand());
		}

It's never used from what I can see...

I came across the following:

if (_flags & FLAG_DETECT_DEBUGGER)
	{
		if (_isArch64)
		{
			//
			// 首先获取 ZwQueryInformationProcess函数地址
			//

You are not checking if it's wow64, yet you call GetModuleHandle64(L"ntdll.dll") which returns 0 if not wow64 process:

DWORD64 GetModuleHandle64(const wchar_t* lpModuleName)
{
	if (!g_isWow64)
		return 0;

Same thing here:

//
		//从 ntdll 虚拟地址转换到实际文件偏移数据
		//
		DWORD	fileOffset = 0;
		if (_isArch64)
		{
			unsigned char pehead[XAD_PAGESIZE];
			getMem64(pehead, GetModuleHandle64(XAD_NTDLL), XAD_PAGESIZE);

I`m not sure, is this intentional or what ?