win32/xp sp3 (Ru) IsDebuggerPresent() 9 bytes
Posted on 10 March 2010
============================================= win32/xp sp3 (Ru) IsDebuggerPresent() 9 bytes ============================================= Tested on Windows XP Pro Rus sp3. Should work anywhere, starting with WinNT. 33 C0 xor eax,eax 64 8B 50 30 mov edx,[fs:eax+0x30] 8A 42 02 mov al,[edx+2] The idea is simple - we copy PEB adress from TIB (dword [fs:0x30]) and return DebuggerPresent byte (byte [PEB+2]). We can go even further, get value in ecx and use jump if ecx zero. 33 C1 xor eax,ecx 64 8B 51 30 mov edx,[fs:ecx+0x30] 8A 4A 02 mov cl,[edx+2] E3 ?? jecxz noDebugger P.S. coded via lord Kelvin # ~ - [ [ : Inj3ct0r : ] ]
