[持续更新]过SOD检测OD方法

使用异常

Closehandle
如果给CloseHandle()函数一个无效句柄作为输入参数，在无调试器时，将会返回一个错误代码，而有调试器存在时，
将会触发一个EXCEPTION_INVALID_HANDLE (0xc0000008)的异常。

bool getdebebugbyCloseHandle()//返回true说明有OD
{
	__try
	{
		CloseHandle((HANDLE)0x00001234);
		return false;
	}
	__except(1)
	{
		return true;
	}
}

仅在进程初始化创建主线程时执行的代码

//必须先于程序执行 TLS EPO 窗口回调等等
void getdebugbyOEP()
{
	IMAGE_DOS_HEADER*dos_head=(IMAGE_DOS_HEADER*)GetModuleHandle(NULL);
	PIMAGE_NT_HEADERS32 	nt_head=(PIMAGE_NT_HEADERS32)((DWORD)dos_head+(DWORD)dos_head->e_lfanew);
	BYTE*OEP=(BYTE*)(nt_head->OptionalHeader.AddressOfEntryPoint+(DWORD)dos_head);
		for(unsigned long index=0;index<200;index++)
		{
			if(OEP[index]==0xcc)
			{
				ExitProcess(0);
			}
		}
}

GetWindowLongA 获取窗口样式

OD的窗口样式出卖了它

代码:

// checkod.cpp : 定义控制台应用程序的入口点。
//
#include <stdio.h>
#include <Windows.h>


void CALLBACK HandleWinEvent(HWINEVENTHOOK hook, DWORD event, HWND hwnd, 
							 LONG idObject, LONG idChild, 
							 DWORD dwEventThread, DWORD dwmsEventTime)
{
	char name[MAX_PATH];
	GetWindowTextA(hwnd,name,MAX_PATH);
	LONG mStyle = GetWindowLongA(hwnd,GWL_STYLE);
	LONG ExtStyle=GetWindowLongA(hwnd,GWL_EXSTYLE);
	if(mStyle==0x57c70000&&ExtStyle==0x140)
	{
		printf("find od 1 %08x %s\r\n",dwEventThread,name);
	}
	if (mStyle==0x56CF0000&&ExtStyle==0x140)
	{
		printf("Find od 2 %08x %s\r\n",dwEventThread,name);
	}
}
int main(int argc, char argv[])
{

	CoInitialize(NULL);

	HWINEVENTHOOK hHook = SetWinEventHook( EVENT_MIN , EVENT_MAX , NULL, HandleWinEvent, 0, 0, WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNPROCESS);
	if (hHook)
	{
		printf("set hook ok\r\n");
	}
	else
	{
		printf("some hack in this os\r\n");
		exit(-1);
	}
	MSG msg;
	while(GetMessage(&msg,NULL,0,0))
	{
		
		TranslateMessage(&msg);
		DispatchMessage(&msg);
	}
	return 0;
}

窗口名的检测

搜集了常见OD的窗口名特征

#include <stdio.h>
#include <windows.h>
#include <string.h>



BOOL bFind = FALSE;
BOOL CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam)
{
	if (hwnd == INVALID_HANDLE_VALUE)
	{
		return FALSE;
	}
	char szbuf[MAX_PATH] = {0};
	int ilens = 0;
	ilens = GetWindowTextA(hwnd, szbuf, sizeof(szbuf)/sizeof(char));
	if(ilens != 0)
	{
		PCHAR pstr = NULL;
		pstr = strstr(szbuf, "LCG");
		if(pstr == NULL)
			pstr = strstr(szbuf,"- 主线程");
		if(pstr == NULL)
			pstr = strstr(szbuf,"模块 -");
		if(pstr == NULL)
			pstr = strstr(szbuf,"main thread");
		if(pstr == NULL)
			pstr = strstr(szbuf,",module");
		if(pstr == NULL)
			pstr = strstr(szbuf,",- Module;");
		if(pstr == NULL)
			pstr = strstr(szbuf,"- Thread");
		if(pstr == NULL)
			pstr = strstr(szbuf,"G.P.U");
		if(pstr == NULL)
			pstr = strstr(szbuf,"+ 主线程");
		if(pstr == NULL)
			pstr = strstr(szbuf,"主线程,");
		if(pstr == NULL)
			pstr = strstr(szbuf,",模块");
		if(pstr == NULL)
			pstr = strstr(szbuf,"模块 +");
		if(pstr == NULL)
			pstr = strstr(szbuf,"PYG");
		if(pstr == NULL)
			pstr = strstr(szbuf,"FCK");
		if(pstr == NULL)
			pstr = strstr(szbuf,"?块");
		if(pstr == NULL)
			pstr = strstr(szbuf,"主线程");
		if(pstr == NULL)
			pstr = strstr(szbuf,"BH");
		if(pstr == NULL)
			pstr = strstr(szbuf,"吾爱");
		if(pstr == NULL)
			pstr = strstr(szbuf,"破解");
		if(pstr == NULL)
		{
			pstr = strstr(szbuf,"[");
			if(pstr != NULL)
				pstr = strstr(szbuf,"]");
			if(pstr != NULL)
				goto END;
		}
END:			
		if(pstr != NULL)
		{
			bFind = TRUE;
			printf("Find Od!\r\n");
			return FALSE;
		}
			
	}
	return TRUE;
}

VOID EnumOD()
{
	EnumWindows(EnumWindowsProc, NULL);
}

int main(int argc, char* argv[])
{
	EnumOD();
	if (bFind != TRUE)
	{
		printf("Find nothind!\n");
	}
	getchar();
	return 0;
}