win32/xp sp3 (Ru) IsDebuggerPresent() 9 bytes

=============================================
win32/xp sp3 (Ru) IsDebuggerPresent() 9 bytes
=============================================

Tested on Windows XP Pro Rus sp3. Should work anywhere, starting with WinNT.
33 C0        xor eax,eax
64 8B 50 30  mov edx,[fs:eax+0x30]
8A 42 02     mov al,[edx+2]

The idea is simple - we copy PEB adress from TIB (dword [fs:0x30]) and return DebuggerPresent byte (byte [PEB+2]).
 
We can go even further, get value in ecx and use jump if ecx zero.
 
33 C1        xor eax,ecx
64 8B 51 30  mov edx,[fs:ecx+0x30]
8A 4A 02     mov cl,[edx+2]
E3 ??        jecxz noDebugger
 
P.S. coded via lord Kelvin



#  0day.today [2018-01-24]  #