Defense.cpp

#include "Defense.h"
#include <windows.h>
#include <intrin.h>     // __readgsqword / __readfsdword
#include <tlhelp32.h>
#include <psapi.h>      // 用于 GetModuleBaseName
#include <string>
#include <vector>
#include <algorithm>
#include <cctype>

#ifdef _MSC_VER
#pragma comment(lib, "psapi.lib")
#endif

// ---------- 内置黑名单 ----------
static const std::vector<std::string> 调试器黑名单 = {
    "x64dbg.exe", "x32dbg.exe",
    "ollydbg.exe", "ollyice.exe",
    "ida.exe", "idag.exe", "ida64.exe",
    "windbg.exe",
    "cheatengine.exe", "cheat engine.exe",
    "immunitydebugger.exe",
    "dnspy.exe",
    "de4dot.exe"
};

static const std::vector<std::string> 抓包黑名单 = {
    "wireshark.exe",
    "fiddler.exe", "fiddler everywhere.exe",
    "charles.exe",
    "httpdebugger.exe",
    "burpsuite.exe",
    "mitmproxy.exe"
};

// ---------- 内部工具函数 ----------

// 将字符串转为小写（用于不区分大小写比较）
static std::string toLower(const std::string& str) {
    std::string lower = str;
    std::transform(lower.begin(), lower.end(), lower.begin(),
        [](unsigned char c) { return std::tolower(c); });
    return lower;
}

// 获取当前进程文件名（用于排除自身）
static std::string 获取当前进程名() {
    char path[MAX_PATH];
    GetModuleFileNameA(NULL, path, MAX_PATH);
    std::string full(path);
    size_t pos = full.find_last_of("\\/");
    if (pos != std::string::npos)
        return full.substr(pos + 1);
    return full;
}

// ---------- 核心检测函数 ----------

bool 防破解::进程存在(const std::vector<std::string>& 黑名单) {
    // 获取当前进程名，排除自身（避免误杀）
    std::string 自身进程名 = 获取当前进程名();
    std::string 自身小写 = toLower(自身进程名);

    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnapshot == INVALID_HANDLE_VALUE)
        return false;

    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(PROCESSENTRY32);

    bool found = false;
    if (Process32First(hSnapshot, &pe32)) {
        do {
            std::string 进程名(pe32.szExeFile);
            std::string 进程名小写 = toLower(进程名);

            // 跳过自身进程
            if (进程名小写 == 自身小写)
                continue;

            for (const auto& 黑 : 黑名单) {
                std::string 黑小写 = toLower(黑);
                if (进程名小写 == 黑小写) {
                    found = true;
                    break;
                }
            }
            if (found) break;
        } while (Process32Next(hSnapshot, &pe32));
    }

    CloseHandle(hSnapshot);
    return found;
}

bool 防破解::检测调试器进程() {
    return 进程存在(调试器黑名单);
}

bool 防破解::检测抓包进程() {
    return 进程存在(抓包黑名单);
}

bool 防破解::检测指定进程(const std::vector<std::string>& 进程名列表) {
    return 进程存在(进程名列表);
}

// ---------- Windows API 反调试 ----------

bool 防破解::检测调试标志() {
    return IsDebuggerPresent() == TRUE;
}

bool 防破解::检测PEB标志() {
    unsigned char beingDebugged = 0;
#ifdef _WIN64
    // x64: GS[0x60] 指向 PEB，+0x02 为 BeingDebugged
#ifdef __GNUC__
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Warray-bounds"
#endif
    beingDebugged = *(unsigned char*)(__readgsqword(0x60) + 0x02);
#ifdef __GNUC__
#pragma GCC diagnostic pop
#endif
#else
    // x86: FS[0x30] 指向 PEB，+0x02 为 BeingDebugged
#ifdef __GNUC__
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Warray-bounds"
#endif
    beingDebugged = *(unsigned char*)(__readfsdword(0x30) + 0x02);
#ifdef __GNUC__
#pragma GCC diagnostic pop
#endif
#endif
    return beingDebugged == 1;
}

bool 防破解::检测调试端口() {
    // 动态获取 NtQueryInformationProcess
    HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
    if (!hNtdll) return false;

    typedef NTSTATUS(WINAPI* pNtQueryInformationProcess)(
        HANDLE, DWORD, PVOID, ULONG, PULONG
        );
    auto NtQueryInformationProcess = (pNtQueryInformationProcess)GetProcAddress(hNtdll, "NtQueryInformationProcess");
    if (!NtQueryInformationProcess) return false;

    DWORD debugPort = 0;
    NTSTATUS status = NtQueryInformationProcess(
        GetCurrentProcess(),
        7,                      // ProcessDebugPort
        &debugPort,
        sizeof(debugPort),
        nullptr
    );
    return (status == 0 && debugPort != 0);
}

bool 防破解::检测硬件断点() {
    // 读取当前线程的调试寄存器
    // Dr0~Dr3 保存硬件断点地址，Dr7 低 8 位控制各断点是否启用
    CONTEXT ctx;
    ZeroMemory(&ctx, sizeof(ctx));
    ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;

    if (!GetThreadContext(GetCurrentThread(), &ctx))
        return false;

    // 任一调试地址寄存器非零，说明设置了硬件断点
    if (ctx.Dr0 != 0 || ctx.Dr1 != 0 || ctx.Dr2 != 0 || ctx.Dr3 != 0)
        return true;

    // 即使 Dr0~Dr3 为 0，也检查 Dr7 的启用位（L0~L3 / G0~G3）
    const DWORD dr7EnableMask = 0x000000FF;
    if ((ctx.Dr7 & dr7EnableMask) != 0)
        return true;

    return false;
}

// ---------- 综合检测 ----------

bool 防破解::综合检测() {
    if (检测调试器进程()) return true;
    if (检测抓包进程()) return true;
    if (检测调试标志()) return true;
    if (检测PEB标志()) return true;
    if (检测调试端口()) return true;
    if (检测硬件断点()) return true;
    return false;
}