public ManagedDebuggerPatcherX86(DbgNativeFunctionHookContext context, DbgCorDebugInternalRuntime runtime)
{
if (context == null)
{
throw new ArgumentNullException(nameof(context));
}
process = context.Process;
this.runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
}
public bool IsEnabled(DbgNativeFunctionHookContext context)
{
if (!debuggerSettings.AntiIsDebuggerPresent)
{
return(false);
}
return(CorDebugUtils.TryGetInternalRuntime(context.Process, out _));
}
public void Hook(DbgNativeFunctionHookContext context, out string?errorMessage)
{
switch (context.Process.Architecture)
{
case DbgArchitecture.X86:
HookX86(context, out errorMessage);
break;
case DbgArchitecture.X64:
HookX64(context, out errorMessage);
break;
default:
Debug.Fail($"Unsupported architecture: {context.Process.Architecture}");
errorMessage = $"Unsupported architecture: {context.Process.Architecture}";
break;
}
}
public void Hook(DbgNativeFunctionHookContext context, out string?errorMessage)
{
if (!CorDebugUtils.TryGetInternalRuntime(context.Process, out var runtime))
{
errorMessage = "Couldn't find CorDebug runtime";
return;
}
switch (context.Process.Architecture)
{
case DbgArchitecture.X86:
HookX86(context, runtime, out errorMessage);
break;
case DbgArchitecture.X64:
HookX64(context, runtime, out errorMessage);
break;
default:
Debug.Fail($"Unsupported architecture: {context.Process.Architecture}");
errorMessage = $"Unsupported architecture: {context.Process.Architecture}";
break;
}
}
public IsDebuggerPresentPatcherX86(DbgNativeFunctionHookContext context) : base(context)
{
}
public void Hook(DbgNativeFunctionHookContext context, out string?errorMessage) => errorMessage = null;
public bool IsEnabled(DbgNativeFunctionHookContext context) => TryGetInternalRuntime(context.Process, out _);
protected PatcherX86(DbgNativeFunctionHookContext context)
{
process = context.Process;
functionProvider = context.FunctionProvider;
nextBranchTargetId = ulong.MaxValue;
}
public IsDebuggerPresentPatcherX86(DbgNativeFunctionHookContext context, DbgCorDebugInternalRuntime runtime)
: base(context) => clrFilename = runtime.ClrFilename;
public CheckRemoteDebuggerPresentPatcherX86(DbgNativeFunctionHookContext context) : base(context) => pid = context.Process.Id;
void HookX64(DbgNativeFunctionHookContext context, DbgCorDebugInternalRuntime runtime, [NotNullWhen(false)] out string?errorMessage) => new IsDebuggerPresentPatcherX86(context, runtime).TryPatchX64(dllName, out errorMessage);
void HookX64(DbgNativeFunctionHookContext context, out string?errorMessage) => new IsDebuggerPresentPatcherX86(context).TryPatchX64(dllName, out errorMessage);
public bool IsEnabled(DbgNativeFunctionHookContext context) => debuggerSettings.AntiIsDebuggerPresent;
