Debug_Err() '运行过一次后,当软件崩溃就无法被调试软件附加
所以只在软件开头运行一次就可以了
Sub Debug_Err() '运行过一次后,当软件崩溃就无法被调试软件附加
Local oldprot As Long, addrExitProcess As Long, addrDebug As Long
addrExitProcess = GetProcAddress(GetModuleHandle("kernel32.dll"), "ExitProcess")
addrDebug = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtContinue")
VirtualProtect (ByVal addrDebug, ByVal 7, ByVal %PAGE_EXECUTE_READWRITE, oldprot)
addrExitProcess = addrExitProcess -1
! mov eax, addrDebug
! mov Byte Ptr [eax], &hB8 ;mov eax, xxxx
! inc eax
! mov ebx, addrExitProcess
! mov [eax], ebx ;ExitProcess
! mov Byte Ptr [eax+4], &h40 ;inc eax // eax now pts to ExitProcess
! mov Word Ptr [eax+5], &hE0FF ;jmp eax
! mov eax, addrDebug
End Sub