public ManagedDebuggerPatcherX86(DbgNativeFunctionHookContext context, DbgCorDebugInternalRuntime runtime) { if (context == null) { throw new ArgumentNullException(nameof(context)); } process = context.Process; this.runtime = runtime ?? throw new ArgumentNullException(nameof(runtime)); }
public bool IsEnabled(DbgNativeFunctionHookContext context) { if (!debuggerSettings.AntiIsDebuggerPresent) { return(false); } return(CorDebugUtils.TryGetInternalRuntime(context.Process, out _)); }
public void Hook(DbgNativeFunctionHookContext context, out string?errorMessage) { switch (context.Process.Architecture) { case DbgArchitecture.X86: HookX86(context, out errorMessage); break; case DbgArchitecture.X64: HookX64(context, out errorMessage); break; default: Debug.Fail($"Unsupported architecture: {context.Process.Architecture}"); errorMessage = $"Unsupported architecture: {context.Process.Architecture}"; break; } }
public void Hook(DbgNativeFunctionHookContext context, out string?errorMessage) { if (!CorDebugUtils.TryGetInternalRuntime(context.Process, out var runtime)) { errorMessage = "Couldn't find CorDebug runtime"; return; } switch (context.Process.Architecture) { case DbgArchitecture.X86: HookX86(context, runtime, out errorMessage); break; case DbgArchitecture.X64: HookX64(context, runtime, out errorMessage); break; default: Debug.Fail($"Unsupported architecture: {context.Process.Architecture}"); errorMessage = $"Unsupported architecture: {context.Process.Architecture}"; break; } }
public IsDebuggerPresentPatcherX86(DbgNativeFunctionHookContext context) : base(context) { }
public void Hook(DbgNativeFunctionHookContext context, out string?errorMessage) => errorMessage = null;
public bool IsEnabled(DbgNativeFunctionHookContext context) => TryGetInternalRuntime(context.Process, out _);
protected PatcherX86(DbgNativeFunctionHookContext context) { process = context.Process; functionProvider = context.FunctionProvider; nextBranchTargetId = ulong.MaxValue; }
public IsDebuggerPresentPatcherX86(DbgNativeFunctionHookContext context, DbgCorDebugInternalRuntime runtime) : base(context) => clrFilename = runtime.ClrFilename;
public CheckRemoteDebuggerPresentPatcherX86(DbgNativeFunctionHookContext context) : base(context) => pid = context.Process.Id;
void HookX64(DbgNativeFunctionHookContext context, DbgCorDebugInternalRuntime runtime, [NotNullWhen(false)] out string?errorMessage) => new IsDebuggerPresentPatcherX86(context, runtime).TryPatchX64(dllName, out errorMessage);
void HookX64(DbgNativeFunctionHookContext context, out string?errorMessage) => new IsDebuggerPresentPatcherX86(context).TryPatchX64(dllName, out errorMessage);
public bool IsEnabled(DbgNativeFunctionHookContext context) => debuggerSettings.AntiIsDebuggerPresent;