<?xml version="1.0" encoding="UTF-8"?>
  <feed xmlns="http://www.w3.org/2005/Atom">
  <title type="html"><![CDATA[〓荣耀±一生〓---X14071Z1's BLOG]]></title>
  <subtitle type="html"><![CDATA[沉迷的黑色岁月~~孤寂,永远的孤寂..落寞...然后一直沉沦..]]></subtitle>
  <id>http://www.Fuckadmin.com/Blog/</id>
  <link rel="alternate" type="text/html" href="http://www.Fuckadmin.com/Blog/" /> 
  <link rel="self" type="application/atom+xml" href="http://www.Fuckadmin.com/Blog/atom.asp" /> 
  <generator uri="http://www.pjhome.net/" version="2.8">PJBlog3</generator> 
  <updated>2008-12-31T17:29:01+08:00</updated>

  <entry>
	  <title type="html"><![CDATA[[笑话] “同志，你闯红灯了。&#34;]]></title>
	  <author>
		 <name>hkylin</name>
		 <uri>http://www.Fuckadmin.com/Blog/</uri>
		 <email>x14071z1@gmail.com</email>
	  </author>
	  <category term="" scheme="http://www.Fuckadmin.com/Blog/default.asp?cateID=8" label="杂七杂八" /> 
	  <updated>2008-12-31T17:29:01+08:00</updated>
	  <published>2008-12-31T17:29:01+08:00</published>
		  <summary type="html"><![CDATA[“同志，你闯红灯了。&#34;<br/>司机四处张望，作无辜状：&#34;红灯在哪里？&#34;<br/>交警手指向红灯。<br/>司机：&#34;靠，挂那么高，我能闯得上吗？&#34;<br/>交警语塞，牛人驱车溜走。<br/>片刻，牛人又被一交警拦住：&#34;同志，你压线了。&#34;<br/>司机低头看线，大骂：&#34;又没给你压坏！&#34;<br/>交警晕，牛人加油溜走。<br/>不久，又一交警向牛人示停，牛人下车后，交警说：&#34;同志，你酒后驾车。&#34;<br/>司机冷笑道：&#34;啤酒也算酒？那你说酱油也是油？&#34;<br/>交警又晕，牛人开溜。<br/>须臾，交警再次拦住牛人要求出示驾照。<br/>司机无证，遂上下打量交警：&#34;你不赶紧去讨个老婆，管我屁事？&#34;<br/>交警：&#34;我孩子都上中学了。&#34;<br/>司机：&#34;那你把结婚证拿出来。&#34;<br/>交警：&#34;没带。&#34;<br/>司机：&#34;没带就是没结婚。&#34;<br/>交警：&#34;不能这样说啊，没带证不代表没结婚啊。&#34;<br/>司机：&#34;我也没带驾驶证…………&#34;<br/>交警血喷，司机狂笑绝尘而去。 ]]></summary>
	  <link rel="alternate" type="text/html" href="http://www.Fuckadmin.com/Blog/article.asp?id=639" /> 
	  <id>http://www.Fuckadmin.com/Blog/default.asp?id=639</id>
  </entry>	
		
  <entry>
	  <title type="html"><![CDATA[[最新]《狼牙》今日上映 吴京功夫秀打得惨烈]]></title>
	  <author>
		 <name>hkylin</name>
		 <uri>http://www.Fuckadmin.com/Blog/</uri>
		 <email>x14071z1@gmail.com</email>
	  </author>
	  <category term="" scheme="http://www.Fuckadmin.com/Blog/default.asp?cateID=4" label="影视音乐" /> 
	  <updated>2008-12-31T17:26:12+08:00</updated>
	  <published>2008-12-31T17:26:12+08:00</published>
		  <summary type="html"><![CDATA[<p>今日，武打明星吴京首次自编自导的影片《狼牙》在全国上映。影片几乎是吴京个人的功夫秀，大量的打斗都是吴京在痛扁各种人肉沙包：包括手提单刀的落难大佬、手掌就有吴京脸那么大的泰国巨人、成群的黑衣人等。<br />
<br />
<br />
记者采访了吴京，他不仅谈到自己首次当导演的得失体会，更透露出自己作为一个内地人，在香港打拼至今的艰难。 采写 本报记者 陈弋弋 实习生 简芳</p>
<p><img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://img1.qq.com/ent/pics/14612/14612597.jpg" /><br />
<br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://img1.qq.com/ent/pics/14612/14612709.jpg" /><br />
吴京凌空踢腿,把对手打得趴倒一地。可惜该片并未出现强劲对手与吴京对打,吴京说:&ldquo;唉&hellip;&hellip;这些,暂时没什么办法。&rdquo;<br />
<br />
1刺杀<br />
<br />
<br />
先击碎对手双膝，再凌空拧断脖子<br />
<br />
<br />
深夜，吴京饰演的阿布只身来到跨国毒贩马爷的藏身之所，在轻松地从头顶、侧面突袭将几个保镖打晕，快到完全不见吴京的身形。之后他与手持关二爷偃月刀的马爷对杀，这一段打斗中吴京的胳膊被大刀划伤，不过他动作凌厉，速度也快，几招之后马爷的大刀飞出去砍在一棵树上。吴京用拳将马爷打到，只听见骨骼声声作响，马爷跪在地上，吴京跃起，从上方跳下，将马爷的双膝击碎，进而用双腿把马爷的脖子扭断。<br />
<br />
<br />
2偶遇<br />
<br />
<br />
凌空劈叉躲圆桌，对决巨人锁喉反击<br />
<br />
<br />
吴京正与女警察晓禾在一家露天的&ldquo;酒店&rdquo;吃鱼蛋面，晓禾突然发现身后坐着的三个大汉竟然是泰国的犯罪分子，于是上前盘问，不想起了拳脚冲突。吴京腿踢对手背部将对手击倒，腿部功夫得到了很好的展示。其中一个镜头是他凌空劈叉躲过飞来的大圆桌，双脚落在另外一张桌上，进而攻击对方。在躲避对方出招的同时还要分神照顾花拳绣腿的女差人，三个泰国人都很粗壮，其中一个高大无比。吴京在几张小餐桌之间左右救场，身手灵活。这一段最有教学意义的就是吴京成功地演示了如何在自己被锁喉的情况下进行反击。<br />
<br />
<br />
3决斗<br />
<br />
<br />
单枪匹马迎战数十黑衣人<br />
<br />
<br />
最后一场戏也是全片的高潮所在，吴京饰演的角色在大雨夜前往搭救被犯罪分子绑架的晓禾。路的两旁依次排开了几十个黑衣打手，两边人马一拥而上，吴京一人敌几十人，一开始他还击有力，越打越往前移，试图靠近吊着晓禾的露台。这一场戏几乎都是贴身肉搏，直到他爬上露台的一侧才有空间用腿踢，但蚁多咬死象，吴京之后体力不支，被人脖子、胳膊、膝盖几处扭折，躺在地上。<br />
<br />
<br />
吴京：我承认文戏不够跌宕起伏<br />
<br />
<br />
文戏不足？&ldquo;今后找个特强的编剧合作&rdquo;<br />
<br />
<br />
《<u><strong><font color="#ff0000">狼牙</font></strong></u>》打戏好看，但文戏却略显不足。除了感情戏缺少说服力外，悬念铺排、剧情推进以及一些细节都还不够精致。<br />
<br />
<br />
吴京大方承认：&ldquo;文戏确实还不够好。&rdquo;他说：&ldquo;由谁执导不是我一个人定的。现在的两个导演，我和李忠志都擅长武戏，他负责全部武戏，我是文武都来。我承认文戏不够跌宕起伏，但我尽量做到表现一段简单的爱情，让观众看到吴京的铁汉柔情。我们重点在武戏上多做铺排，然后用文戏穿插，希望能做到5分钟一变。我觉得今后我会再做导演，到时候我会找一个特别强的编剧合作，弥补文戏这方面的缺憾。再找一个专业的动作指导，他帮我搞定整个动作班底，我们两个专业的来努力一部戏&mdash;&mdash;&mdash;这个想法，让我觉得自己，前途无量。&rdquo;<br />
<br />
<br />
缺乏强对手？&ldquo;这些，暂时没什么办法&rdquo;<br />
<br />
<br />
《<u><strong><font color="#ff0000">狼牙</font></strong></u>》中所有和吴京对打的，几乎都是&ldquo;人肉沙包&rdquo;。遗憾并没有两个功夫高手对决的场面。吴京对此略感无奈，&ldquo;我找不到这样的演员。&rdquo;是否在香港不多的能打的明星中，目前还难找到一个愿意在吴京的戏里演男二号的人。吴京对此不置可否，但是他说：&ldquo;唉&hellip;&hellip;这些，暂时都没有什么办法。电影这个行当，个人行为的影响力会很强。&rdquo;一声叹息后，他又忽然振奋：&ldquo;但是我还年轻，我还能熬，我还有空间，这是我最大的优势！我今后一定不会打压新人！因为我曾经是新人，我体会过新人受的所有的苦。&rdquo;<br />
<br />
&nbsp;</p>]]></summary>
	  <link rel="alternate" type="text/html" href="http://www.Fuckadmin.com/Blog/article.asp?id=638" /> 
	  <id>http://www.Fuckadmin.com/Blog/default.asp?id=638</id>
  </entry>	
		
  <entry>
	  <title type="html"><![CDATA[[最新] 08最新贺岁大片《非诚勿扰》[DVDscr/rmvb][迅雷]]]></title>
	  <author>
		 <name>hkylin</name>
		 <uri>http://www.Fuckadmin.com/Blog/</uri>
		 <email>x14071z1@gmail.com</email>
	  </author>
	  <category term="" scheme="http://www.Fuckadmin.com/Blog/default.asp?cateID=4" label="影视音乐" /> 
	  <updated>2008-12-31T17:09:39+08:00</updated>
	  <published>2008-12-31T17:09:39+08:00</published>
		  <summary type="html"><![CDATA[<div class="t_msgfont" id="postmessage_20223789"><img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" onclick="zoom(this)" style="cursor: pointer" src="http://farm4.static.flickr.com/3056/3116417783_07fb67ac4f_b.jpg" /><br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" onclick="zoom(this)" style="cursor: pointer" src="http://farm4.static.flickr.com/3215/3116417763_931f1535cc_b.jpg" /><br />
◎译　　名　非诚勿扰<br />
◎片　　名　If You Are The One<br />
◎年　　代　2008<br />
◎国　　家　中国<br />
◎类　　别　爱情/喜剧<br />
◎语　　言　普通话<br />
◎字　　幕　中文/英文（内置）<br />
◎文件格式　DVDscr-RMVB<br />
◎视频尺寸　608 x 256<br />
◎文件大小　1CD 49 x 15MB<br />
◎片　　长　1h 56mn <br />
◎导　　演　冯小刚 Xiaogang Feng<br />
◎主　　演　You Ge 葛优 You Ge<br />
　　　　　　Hsu Chi 舒淇 Hsu Chi<br />
　　　　　　Ke Hu 胡可 Ke Hu<br />
　　　　　　Vivian Hsu 徐若瑄 Vivian Hsu<br />
　　　　　　Alex Fong 方中信 Alex Fong<br />
　　　　　　Wei Fan 范伟 Wei Fan<br />
　　　　　　Miumiu 巩新亮 Miumiu<br />
　　　　　　Yuanzheng Feng 冯远征 Yuanzheng Feng<br />
　　　　　　Xiao Che 车晓 Xiao Che<br />
　　　　　　Haiqiong Luo 罗海琼 Haiqiong Luo<br />
<br />
◎简　　介　<br />
<br />
&nbsp; &nbsp; 秦奋(葛优饰)的天才发明被风险投资人(范伟饰)出天价买断。一夜暴富的这位&ldquo;剩男&rdquo;揣着家底开始了&ldquo;征婚&rdquo;旅程。漫漫&ldquo;征途&rdquo;上，各怀心事者纷至沓来，一段&ldquo;人间喜剧&rdquo;演出2008世间百态。几经周折后，秦奋终遇倾心佳人梁笑笑(舒淇饰)。无奈，美人心有所属。秦奋究竟如何逆流而上？几番悲欣交集后，有志者事竟成！秦奋终于带着他的真爱开始一段全新征程。 <br />
<br />
【幕后制作】<br />
<br />
主创谈征婚<br />
<br />
　　冯小刚：人还是得在自然的状态下接触、认识、有了好感。俩人不认识坐在那，我觉得这可能是一个挺省事的办法，但是对我来说可能是太尴尬了，不知道说什么，当然我不反对大家去做这件事，而且我相信有很多夫妻就是用征婚这种形式，走到一起的，而且过得也很好。<br />
<br />
　　葛优：这事得看逼到什么份儿上。特想结婚，一直没有的话，我觉得我可能还是会去的这种人。老想自然的去碰，可能机会少一些，征婚是一个好的机会。<br />
<br />
　　舒淇：(学葛优)咳，咳，咳，咳！不晓得，搞不好哦。不过我觉得&ldquo;非诚勿扰&rdquo;四个字非常非常好。<br />
<br />
　　陈国富：我觉得通过征婚能找到幸福，虽然我&ldquo;不能&rdquo;。这是性格问题，比如说一个人如果过于内向，你让我去见一个我没见过的人，并且和她交流，从头到尾也不敢正眼看她，这样你怎会有第二次。征婚是一个寻找那个角落的合理过程。<br />
<br />
　　范伟：除了自己认识之外，征婚是个挺好的办法。如果自己没有缘分跟生活中的人相识，征婚是个很好的办法。我就是靠着征婚成家立业的。像我这种性格平时比较拘谨比较内向的人，生活中结识谁，还怕是不是骚扰人家，有顾虑有障碍。有这么个媒介敞开了往这儿一坐，经过相处&hellip;&hellip;挺好的。我就是靠这个成功的。 <br />
<br />
【制作缘起】<br />
<br />
　　1997年，《甲方乙方()》，1998年，《不见不散》，2001年，《大腕》，2003年，《手机》，2004年，《天下无贼()》。十年来，冯小刚、葛优这对百姓导演、百姓影帝组合共同攀越了中国贺岁电影的巅峰。冯小刚导演的贺岁电影不仅在票房上领跑中国，带领中国影市走出低迷，而且凭借对社会现象和百姓生活极为细腻的捕捉和睿智风趣的萃取，成为中国观众每年翘首期望的年度娱乐大事。2004年的《天下无贼》，2006年的《夜宴》，冯小刚导演成功转型，两部电影都大幅刷新之前的票房成绩。2007年《集结号()》全面获得成功，不仅票房达到了2.6亿，而且在29届百花奖上一举获得最佳导演、最佳影片、最佳男主角、最佳男配角4项大奖，树立了中国战争大片的一座丰碑。2008年，冯小刚再度携手葛优，高调回归贺岁喜剧。<br />
<br />
　　冯小刚导演创作《非诚勿扰》剧本的初衷，是希望在08年贺岁的时候带给观众一个励志、深情的喜剧故事，&ldquo;今年发生了很多的事，雪灾、地震、金融危机，其实大家觉得08年是有点不太顺利，但是大家往后还是要走下去，我还是相信未来是不错的。所以要拍一个喜剧让观众在年底的时候心情放松一下，迎接新的一年的到来，能够克服这些灾害和天灾人祸对观众心理造成的影响，把这个阴影抹去。当然一部电影是没有那么大作用的，但是一部电影是可以让观众再看的时候让自己的身心得到一种放松。爱情故事总是有些忧伤，我觉得应该是变成一个开心的、励志的，给大家打气的状态来收这个电影。电影还是为大众服务的，尤其《非诚勿扰》这部电影，从一开始我们的立意、目标就是要让观众非常的开心。所以后面会跟作词、作曲商量能做一首比较励志的主题曲。&rdquo;<br />
<br />
　　冯小刚导演这次回归贺岁喜剧，还有一个推动力是几年以来观众的强烈需求而他自己在做《非诚勿扰》的时候也是乐在其中，&ldquo;我有几年没拍喜剧了，我经常会碰到一些观众，他们有强烈的这样一个愿望，总是在问，什么时候拍喜剧，这一点对我来说也是很大的鞭策，让我觉得既然有这么多人想看，就应该拍一部来满足观众的需要，我自己也会很享受拍摄喜剧的乐趣。原来在写剧本之前我还担心是不是能够把这种喜剧的状态找回来，但是从一开始写剧本我就发现还仍然不是太费事。&rdquo;<br />
<br />
　　冯小刚导演创作《非诚勿扰》的灵感来自于十年前的电影《征婚启事》。这部电影的导演陈国富是华谊兄弟的艺术总监，冯小刚的老友，同时也是《非诚勿扰》的总监制。冯小刚导演今年春天偶然看到《征婚启事》全片，顿觉兴味盎然，有了《非诚勿扰》的故事概念。在总监制陈国富看来：&ldquo;影片内有些部分切合了他现在的熟男心境：一方面看到了人生中有很多无奈；另一方面也能够更加坦然地去面对。&rdquo;正如冯小刚导演所言：&ldquo;《非诚勿扰》是我熟悉的这个年龄段的人的心态。&rdquo; <br />
<br />
【花絮】<br />
<br />
&middot;有消息传出，《非诚勿扰》的灵感来自于台湾导演陈国富的电影《征婚启事》。<br />
<br />
&middot;其实我一开始是想用一个征婚的故事来弄，但是当舒淇进入之后，就变成了一个爱情故事，所以在剪接的时候我也会把征婚的部分进行大量的删减、压缩，就是把主线靠到葛优和舒淇的爱情关系上。完成的东西跟当初写剧本时脑子里的构思是不一样的。<br />
<br />
&middot;胡静在片中扮演一个与葛优征婚的神经女，抱着布娃娃说是葛优的儿子，剪辑时冯小刚觉得不可乐，便删除了整段戏码。<br />
<br />
&middot;片中葛优凭借&ldquo;分歧终端机 &rdquo;忽悠到范伟200万英镑发家，然而这台&ldquo;分歧终端机&rdquo;和特制的19个山寨&ldquo;分歧终端机&rdquo;，一起被片方授权放在网上卖。不过这项行动被提前终止，因为网友质疑&ldquo;片方贪心敛财&rdquo;。<br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://img.album.pchome.net/54/68/31/42/ab43d375c92a464c7e10cbf921fbb4d1.jpg" /><br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://img.album.pchome.net/54/68/31/42/8893da902e14ebba7b50a03ec46e1d10.jpg" /><br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://img.album.pchome.net/54/68/31/42/f64be0e385c8ac4af6ad18a8b729282d.jpg" /><br />
下载地址：<br />
<br />
CD1<br />
<br />
thunder://QUFmdHA6Ly9keWdvZDE6ZHlnb2QxQGQxMzEuZHlnb2QuY246MzA0OS+3x7PPzvDIxURWRHNjci9btefTsMzszMN3d3cuZHlnb2QuY25dt8ezz87wyMVjZDEucm12YiBaWg==<br />
<br />
2008-12-31 09:05:08 开始连接......<br />
2008-12-31 09:05:08 开始搜索候选资源......<br />
2008-12-31 09:05:09 搜索到3个候选资源<br />
2008-12-31 09:05:09 使用候选资源进行连接......<br />
2008-12-31 09:05:10 搜索到120个候选资源<br />
2008-12-31 09:05:10 使用候选资源进行连接......<br />
2008-12-31 09:05:10 搜索到80个候选资源<br />
2008-12-31 09:05:10 使用候选资源进行连接......<br />
2008-12-31 09:05:11 开始创建文件......<br />
CD2<br />
<br />
thunder://QUFmdHA6Ly9keWdvZDE6ZHlnb2QxQGQxMzEuZHlnb2QuY246MzA0OS+3x7PPzvDIxURWRHNjci9btefTsMzszMN3d3cuZHlnb2QuY25dt8ezz87wyMVjZDIucm12Ylpa<br />
<br />
2008-12-31 09:05:38 开始连接......<br />
2008-12-31 09:05:38 开始搜索候选资源......<br />
2008-12-31 09:05:38 搜索到2个候选资源<br />
2008-12-31 09:05:38 使用候选资源进行连接......<br />
2008-12-31 09:05:40 搜索到120个候选资源<br />
2008-12-31 09:05:40 使用候选资源进行连接......<br />
2008-12-31 09:05:40 搜索到80个候选资源<br />
2008-12-31 09:05:40 使用候选资源进行连接......<br />
2008-12-31 09:05:42 开始创建文件......</div>]]></summary>
	  <link rel="alternate" type="text/html" href="http://www.Fuckadmin.com/Blog/article.asp?id=637" /> 
	  <id>http://www.Fuckadmin.com/Blog/default.asp?id=637</id>
  </entry>	
		
  <entry>
	  <title type="html"><![CDATA[[最新] [12月31日]08最新贺岁大片《叶问》DVD高清晰修正版]]></title>
	  <author>
		 <name>hkylin</name>
		 <uri>http://www.Fuckadmin.com/Blog/</uri>
		 <email>x14071z1@gmail.com</email>
	  </author>
	  <category term="" scheme="http://www.Fuckadmin.com/Blog/default.asp?cateID=4" label="影视音乐" /> 
	  <updated>2008-12-31T17:05:10+08:00</updated>
	  <published>2008-12-31T17:05:10+08:00</published>
		  <summary type="html"><![CDATA[<p>[12月29日]08最新贺岁大片《叶问》DVD高清晰修正版 --http://blog.fuckadmin.com</p>
<p><img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://i3.6.cn/cvbnm/77/a8/df/e652cdeca1ee3633718d177c98fc55b8.jpg" /><br />
<br />
◎译　　名　叶问/一代宗师&middot;叶问/一代宗师叶问<br />
◎片　　名　Ip Man<br />
◎年　　代　2008<br />
◎国　　家　中国香港<br />
◎类　　别　动作/传记/历史<br />
◎语　　言　普通话<br />
◎字　　幕　中文<br />
◎IMDB评分&nbsp;&nbsp;8.3/10 (176 votes)<br />
◎文件格式　DVD-RMVB<br />
◎视频尺寸　672 x 272 <br />
◎文件大小　2CD <br />
◎片　　长　106 Mins<br />
◎导　　演　叶伟信 Wilson Yip<br />
◎主　　演　甄子丹 Donnie Yen&nbsp;&nbsp;....Ip Man<br />
　　　　　　任达华 Simon Yam&nbsp;&nbsp;....Zhou Qing Quan<br />
　　　　　　池内博之 Hiroyuki Ikeuchi&nbsp;&nbsp;....Miura<br />
　　　　　　林家栋 Ka Tung Lam&nbsp;&nbsp;....Li Zhao<br />
　　　　　　樊少皇 Siu-Wong Fan&nbsp;&nbsp;....Jin Shan Zhao<br />
　　　　　　释行宇 Xingyu Shi&nbsp;&nbsp;....Master Zealot Lin<br />
　　　　　　黄又南 You-Nam Wong&nbsp;&nbsp;....Shao Dan Yuan<br />
　　　　　　陈之辉 Chen Zhi Hui&nbsp;&nbsp;....Master Liao<br />
　　　　　　洪金宝 Sammo Hung<br />
　　　　　　玛丽卡&middot;沙拉瓦特 Mallika Sherawat<br />
　　　　　　熊黛林 Lynn Hung<br />
　　　　　　<br />
◎简　　介　<br />
<br />
　　一九三零年代，中国武术之都的佛山，武风顶盛，各门各派为广纳门徒，经常集体比斗以显实力。叶问(甄子丹饰)习得一身武艺但为人低调，故未有设馆授徒，只待在家中与友人闭门切磋、钻研武术。<br />
<br />
　　以金山找(樊少皇饰)为首的北方武师，为了在佛山扬名立万，遂狠狠挫下各派馆主。金山找为搏得佛山市民的认同，决意挑战不问世事的叶问，且不惜一切逼叶问出手。叶问在妻子张永成(熊黛林饰)的鼓励下毅然出手，以熟练的咏春拳大胜金山找。经此一役，佛山掀起了炽盛的咏春热潮。<br />
<br />
　　好景不常，中日战争爆发，佛山沦陷，叶家大宅被日军强占，叶问被迫带着妻儿移居废屋。叶问一家生活艰苦，但叶问仍积极面对，一改阔少的态度，到煤炭厂当苦力，自力更生。众中国人默默耕耘之际，一批日军却前来生事，陪伴着日军主任佐腾旁边的翻译官，竟是昔日的佛山巡警李钊(林家栋饰)。<br />
<br />
　　日本将军三蒲(池内博之饰)是一名武痴，故以白米作奖赏，邀请中国人到打斗场与日军切磋，藉以观摩中国武术。叶问的好友武痴林(行宇饰)于打斗场内侮辱三蒲，被活生生击毙。叶问为寻找武痴林，到打斗场查看，甫一进场即见廖师傅被佐腾无理射杀。叶问遂把心中悲愤于打斗场上发泄出来，以一敌十，痛击日本人。三蒲对叶问的身手大为欣赏，并表示期待与叶问一战。<br />
<br />
　　叶问的挚友周清泉(任达华饰)被沦为山贼的金山找勒索。周清泉为养活一众工人，未有弃厂撤离，令叶问明白到每人都有其使命，遂留在棉花厂教众工人以咏春自卫。金山找再次来袭，一众工友在叶问带领下齐起以咏春反抗，一众卑微的工人竟能以自己的拳头击退山贼，大感振奋。<br />
<br />
　　三蒲带兵至棉花厂捉拿叶问，要求叶问向日军传授中国武术。叶问不甘作汉奸，且欲替中国人挽回尊严，遂公然挑战三蒲，要以双拳唤起中国人的团结心。三蒲自视甚高，为保名声毅然应战。佐腾为保三蒲胜出竟暗设埋伏，叶问未知已身陷危机，以咏春力战三蒲的空手道，二人在擂台上展开激烈生死决战。<br />
<br />
<font color="#0000ff">◎剧　　照　</font><br />
<br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://i3.6.cn/cvbnm/15/6a/1d/3ae2c5146478c0f0c5a76542ffb4b381.jpg" /> <br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://i3.6.cn/cvbnm/b3/6f/ff/3e0b0f1a299f30bee8224f7b56e54e48.jpg" /> <br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://i3.6.cn/cvbnm/28/ef/d5/535346a18b175d5cb9a8f1010ca4323f.jpg" /> <br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://i3.6.cn/cvbnm/12/af/63/8f26003d797bff2b6e1cf977629782e7.jpg" /> <br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://i3.6.cn/cvbnm/e4/8f/61/c41979db4e6d3993f727719936d36708.jpg" /> <br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" style="cursor: pointer" src="http://i3.6.cn/cvbnm/d7/40/cd/ab08d938b7a58f38aafa09d31e390c44.jpg" /> <br />
<br />
幕后制作<br />
<br />
银幕上再度点燃爱国热情<br />
<br />
　　《叶问》一条非常重要的线索，就是叶问同日本侵略者的抗争。其中叶问凭一己之力击败日本武道馆十位武师，不顾个人生命安危拳打三蒲将军等情节，绝对可以激发起广大观众的爱国热情。《精武英雄》《霍元甲》等片的热血情节，在《叶问》中也有着精彩的展示。<br />
<br />
一流的武打设计<br />
<br />
　　甄子丹虽然之前没有研习过咏春，但是其超高的悟性着实令人惊叹。在洪金宝的辅佐下，银幕上甄子丹的动作凌厉潇洒、咏春短打寸劲的威力一展无余。一秒钟内连击数拳的精彩表现同样给观众以级高的视觉享受。<br />
<br />
甄子丹表演风格的转变<br />
<br />
　　以往甄子丹在银幕上，呈现出几乎千篇一律的脸谱化表演，《画皮》中子丹尝试喜剧路线，获得认可。这一次在《叶问》中，甄子丹为人物减肥、探访叶问故居，揣摩人物的内心世界，更加低调幽默、更加内敛。<br />
<br />
南北拳法再度PK<br />
<br />
　　甄子丹饰演的叶问与樊少皇饰演的金山找分别代表了南北两派拳法，影片中他俩有两次交手，金山找的拳法大开大阖，叶问则以小制大、以静制动，第二次叶问以六点半棍法迎战来敌，以一敌二，同样十分精彩。<br />
<br />
向叶问学做好男人<br />
<br />
　　叶问武功高强却为人谦逊，对老婆百依百顺，但是在爱妻遇到危险时就能毫不顾忌挺身而出，用他自己的话说，爱老婆所以才怕老婆。想要通过电影教会男友如何做新好男人，《叶问》算是一个不错的选择。<br />
<br />
花絮 <br />
<br />
&middot;甄子丹透露，十年前就有人找他拍摄《叶问》，不过最后没有拍成，他还严肃地表示当时片方想让周星驰来演李小龙。<br />
<br />
&middot;大陆版被删除的段落包括：为不伤害山东同胞感情，删除汉奸的山东口音；汉奸形象不提倡，删除山东拳师金山像日本人同分报信的段落；为了国人的团结精神，删除不明就理的群众暴打无辜李钊的段落。<br />
<br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" onclick="zoom(this)" style="cursor: pointer" src="http://img.album.pchome.net/54/68/27/17/c4b5b2a6d0d8613001233860d2863f36.jpg" /> <br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" onclick="zoom(this)" style="cursor: pointer" src="http://img.album.pchome.net/54/68/27/17/7add8d79cdbbf61f54f04d9aa07dcb08.jpg" /> <br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" onclick="zoom(this)" style="cursor: pointer" src="http://img.album.pchome.net/54/68/27/17/19c21663b3699f302e7cd5320b8258e3.jpg" /> <br />
<img alt="" width="299" border="0" resized="resized" onload="if(this.width&gt;document.body.clientWidth*0.5) {this.resized=true;this.width=document.body.clientWidth*0.5;this.style.cursor='pointer';} else {this.onclick=null}" onclick="zoom(this)" style="cursor: pointer" src="http://img.album.pchome.net/54/68/27/17/6a6bebe465692416b22bd82df948486d.jpg" /><br />
<br />
<br />
<br />
<strong><font color="#ff0000">下载地址：</font></strong><br />
CD1<br />
thunder://QUFmdHA6Ly9keWdvZDE6ZHlnb2QxQGQxMzEuZHlnb2QuY246NDA0OS/lj7bpl65EVkTlm73or63kuK3lrZfpq5jmuIXmmbDniYgvW+eUteW9seWkqeWggnd3dy5keWdvZC5jbl3lj7bpl67pq5jmuIXniYhjZDEucm12Ylpa<br />
CD2<br />
thunder://QUFmdHA6Ly9keWdvZDE6ZHlnb2QxQGQxMzEuZHlnb2QuY246NDA0OS/lj7bpl65EVkTlm73or63kuK3lrZfpq5jmuIXmmbDniYgvW+eUteW9seWkqeWggnd3dy5keWdvZC5jbl3lj7bpl67pq5jmuIXniYhjZDIucm12Ylpa<br />
<br />
2008-12-29 21:20:02 开始连接......<br />
2008-12-29 21:20:02 开始搜索候选资源......<br />
2008-12-29 21:20:03 搜索到29个候选资源<br />
2008-12-29 21:20:03 使用候选资源进行连接......<br />
2008-12-29 21:20:03 搜索到88个候选资源<br />
2008-12-29 21:20:03 使用候选资源进行连接......<br />
2008-12-29 21:20:03 搜索到79个候选资源<br />
2008-12-29 21:20:03 使用候选资源进行连接......<br />
2008-12-29 21:20:17 开始创建文件......<br />
2008-12-29 21:20:17 磁盘剩余存储空间不够，创建文件失败<br />
2008-12-29 21:20:17 下载失败<br />
$SO</p>
<p>&nbsp;</p>
<p>&nbsp;</p>]]></summary>
	  <link rel="alternate" type="text/html" href="http://www.Fuckadmin.com/Blog/article.asp?id=636" /> 
	  <id>http://www.Fuckadmin.com/Blog/default.asp?id=636</id>
  </entry>	
		
  <entry>
	  <title type="html"><![CDATA[[影视] 妻子的诱惑41]]></title>
	  <author>
		 <name>hkylin</name>
		 <uri>http://www.Fuckadmin.com/Blog/</uri>
		 <email>x14071z1@gmail.com</email>
	  </author>
	  <category term="" scheme="http://www.Fuckadmin.com/Blog/default.asp?cateID=4" label="影视音乐" /> 
	  <updated>2008-12-31T17:02:08+08:00</updated>
	  <published>2008-12-31T17:02:08+08:00</published>
		  <summary type="html"><![CDATA[<br/>妻子的诱惑41<br/><br/><br/><a href="http://video.baidu.com/v?ct=301989888" target="_blank" rel="external">http://video.baidu.com/v?ct=301989888</a>&amp;rn=20&amp;pn=0&amp;db=0&amp;s=8&amp;word=%C6%DE%D7%D3%B5%C4%D3%D5%BB%F341]]></summary>
	  <link rel="alternate" type="text/html" href="http://www.Fuckadmin.com/Blog/article.asp?id=635" /> 
	  <id>http://www.Fuckadmin.com/Blog/default.asp?id=635</id>
  </entry>	
		
  <entry>
	  <title type="html"><![CDATA[[写真] 女子拍写真网上卖房走红网络（图）1楼 2008-12-24 10:01:28 ]]></title>
	  <author>
		 <name>hkylin</name>
		 <uri>http://www.Fuckadmin.com/Blog/</uri>
		 <email>x14071z1@gmail.com</email>
	  </author>
	  <category term="" scheme="http://www.Fuckadmin.com/Blog/default.asp?cateID=10" label="图形图像" /> 
	  <updated>2008-12-31T17:00:28+08:00</updated>
	  <published>2008-12-31T17:00:28+08:00</published>
		  <summary type="html"><![CDATA[<p>　　<b>&ldquo;卖房写真女&rdquo;放在网上的写真图片</b></p>
<p>　当下金融危机，楼市不景气。</p>
<p>近日，一女子把自己的写真图片放在网上二手房的店铺当中，受到众多网友关注，被网友称为&ldquo;卖房写真女&rdquo;。</p>
<p>而二手房产经纪这个职业也成了大家讨论的热门话题。</p>
<p><a href="http://img1.bbs.163.com/20081224/baoliao/yu/yuanquan928/45b517af5a9e9ee48c6df40d801e23b0.jpg" target="_blank"><img src="http://img1.bbs.163.com/20081224/baoliao/yu/yuanquan928/45b517af5a9e9ee48c6df40d801e23b0.jpg" onload="BbsUtil.imgZoom(this);" border="0" alt="" /></a> <br />
<br />
　　<a href="http://img2.bbs.163.com/20081224/baoliao/yu/yuanquan928/e50417d890283f747a777806a41e7d75.jpg" target="_blank"><img src="http://img2.bbs.163.com/20081224/baoliao/yu/yuanquan928/e50417d890283f747a777806a41e7d75.jpg" onload="BbsUtil.imgZoom(this);" border="0" alt="" /></a> <br />
<br />
　　<a href="http://img3.bbs.163.com/20081224/baoliao/yu/yuanquan928/f702416402ae17fc048c6a3684974d2d.jpg" target="_blank"><img src="http://img3.bbs.163.com/20081224/baoliao/yu/yuanquan928/f702416402ae17fc048c6a3684974d2d.jpg" onload="BbsUtil.imgZoom(this);" border="0" alt="" /></a> <br />
<br />
　　<a href="http://img1.bbs.163.com/20081224/baoliao/yu/yuanquan928/8255786c1aea572a3cb4721855152000.jpg" target="_blank"><img src="http://img1.bbs.163.com/20081224/baoliao/yu/yuanquan928/8255786c1aea572a3cb4721855152000.jpg" onload="BbsUtil.imgZoom(this);" border="0" alt="" /></a> <br />
<br />
<br />
<br />
　　<b>网帖：女房产经纪人眼中的&ldquo;卖房写真女&rdquo;</b> <br />
<br />
　　很多人都说&ldquo;&ldquo;房产写真女&rdquo;是在哗众取宠，甚至有些人说她是醉翁之意不在酒，实际上是想借此炒红自己，进军娱乐圈。虽然我和&ldquo;房产写真女&ldquo;同在北京做着基本相同的事情，但是我并不认识她，所以她是不是真的想进军娱乐圈这个我也只能是和所有网友一样，八卦一下而已，也不知道她是不是真的这样想。但是就她在自己的经纪人店铺的房源里加写真图片来讲，倒也并不觉得是一件坏事。我认为，这样的做法实际上是一种新型的营销模式，叫自己的房源信息更加生动真实。叫客户对自己手下的资源产生更多的信赖感。，这对于房产经纪人来说，是非常重要的。作为一个中介媒体，我觉得最重要的就是他的诚信，可信赖感。其是当你是网络经纪人时，你最大的真是平台就是你的店铺信息，客户对你房源信息的可信度，很有可能取决于你在店铺上展示的信息是否详细可靠。这种人性化的生活化的信息展示方式，实际上有助于帮助你树立一个有个性的品牌形象。 <br />
<br />
　　我觉得，这不失为一个创立个人品牌形象的方法。所以作为同行来讲，她的这种做法首先的感觉是并不反感。但是我同样作为一个女房产经纪人，也许并不会采取她这样的方式来宣传自己，它确实有它积极地一面，但是另一方面，很有可能客户会在看完房子以后，感觉自己本来中意的房子里却出现了另一个类似主人的人占据着而产生不好的感觉。所以，我认为&ldquo;&ldquo;房产写真女&rdquo;的创意值得鼓励，但是是否有可学习的价值，这倒不一定。起码，每个人都有自己营销方式，她的这种方式或许只适应于她自己，而不是所有房产经纪人。 <br />
<br />
　　其实这件事，先让我有强烈想法的是有些网友因为&ldquo;房产写真女&rdquo;而说中介怎么怎么回事，甚至更难听的还有说中介都是忽悠人的，上嘴皮一碰下嘴皮就挣了买房和卖方人的血汗钱。我看到这样的说法真的很难过，也很委屈。我知道现在有很多人都在一些因为找了中介而发生了不愉快的事情，但是我想说，大多数中介公司和大多数房产经纪人并不是如此，只是个别因为个别的人而叫人对房产中介产生了反感。而且我们并不是想大家想的那样，好多人都在说买，卖，中介。三方中中介永远是强势，其他两方都是弱势。真的是这样么？我们每个月都回遇见很多单&rdquo;跳单&ldquo;，也就是买卖双方通过我们认识以后，自己私下联系，没有我们什么事了，还有很多房东，任何事情都谈好了却突然加价，我刚刚做这个职业的时候，有多少次都是因为房东临时加价，自己辛苦做出来的交易告吹了？要知道，为了能叫买卖上方都合适，我们可能要带着客户看连着看几套甚至十几套的房子，冬天刮风得扛着，夏天日晒得挨着。这个工作真的不好做。尤其是作为一名女人，我做房产经纪人四年，回头看看自己当年的照片，觉得自己老了又岂止仅仅是四岁？我今天在这里写帖子不是想说房产经纪人有多么多么的伟大，只是希望大家能够多少宽容一些。不是还有更多的人，是通过中介找到了自己的满意的房子么？ <br />
<br />
　　现在经济危机越来越严重了，二手房也越来越不好做了。我们每天都在想尽了方法能叫自己的客户对自己满意，能叫自己成为一个可以信赖的中介人。做房产经纪人其实很难，做女房产经纪人更难。所以尽管网友们对于&ldquo;房产写真女&rdquo;的看法褒贬不一，但是起码我作为一个同行，在内心深处还是理解她的。同时也真心的希望大家能够理解我们这个职业。　</p>]]></summary>
	  <link rel="alternate" type="text/html" href="http://www.Fuckadmin.com/Blog/article.asp?id=634" /> 
	  <id>http://www.Fuckadmin.com/Blog/default.asp?id=634</id>
  </entry>	
		
  <entry>
	  <title type="html"><![CDATA[[影视] 韩国限制电影叫《重庆》 内容灰暗网友要求改名]]></title>
	  <author>
		 <name>hkylin</name>
		 <uri>http://www.Fuckadmin.com/Blog/</uri>
		 <email>x14071z1@gmail.com</email>
	  </author>
	  <category term="" scheme="http://www.Fuckadmin.com/Blog/default.asp?cateID=4" label="影视音乐" /> 
	  <updated>2008-12-31T16:56:44+08:00</updated>
	  <published>2008-12-31T16:56:44+08:00</published>
		  <summary type="html"><![CDATA[<div class="flashPlayer" align="center">本报讯 (记者 汪再兴) 这不是很搞吗？昨日，在重庆某网站论坛出现了一帖名为《韩国超尺度电影取名重庆》，帖子迅速成为当日热帖，一上午点击率过千。这部由中国导演执导在重庆拍摄的影片中过多颓废、性暗示的镜头引起了众多重庆网友们不满，网友一致要求其导演向重庆道歉，影片改名。</div>
<div class="flashPlayer" id="p_player" align="center"><object id="myMovie" sendtestspeed="function () {
return eval(instance.CallFunction(&quot;&lt;invoke name=\&quot;&quot;+name+&quot;\&quot; returntype=\&quot;javascript\&quot;&gt;&quot; + __flash__argumentsToXML(arguments,0) + &quot;&lt;/invoke&gt;&quot;));
}" classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" width="482" height="388" codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,28,0">
<param name="_cx" value="12753" />
<param name="_cy" value="10266" />
<param name="FlashVars" value="" />
<param name="Movie" value="http://p.you.video.sina.com.cn/swf/svplayer081216001.swf" />
<param name="Src" value="http://p.you.video.sina.com.cn/swf/svplayer081216001.swf" />
<param name="WMode" value="Transparent" />
<param name="Play" value="0" />
<param name="Loop" value="-1" />
<param name="Quality" value="High" />
<param name="SAlign" value="LT" />
<param name="Menu" value="-1" />
<param name="Base" value="" />
<param name="AllowScriptAccess" value="always" />
<param name="Scale" value="NoScale" />
<param name="DeviceFont" value="0" />
<param name="EmbedMovie" value="0" />
<param name="BGColor" value="" />
<param name="SWRemote" value="" />
<param name="MovieData" value="" />
<param name="SeamlessTabbing" value="1" />
<param name="Profile" value="0" />
<param name="ProfileAddress" value="" />
<param name="ProfilePort" value="0" />
<param name="AllowNetworking" value="all" />
<param name="AllowFullScreen" value="true" /></object></div>
<script type="text/javascript">
				var sinaBokePlayerConfig_o = {
					container: "p_player",  //Div容器的id
					playerWidth:482,     //宽
					playerHeight:388,    //高
					autoLoad: 1,        //自动加载
					autoPlay: 0,        //自动播放
					as:0,              //广告
					tj:1             //推荐
				};
				</script><script src="http://v.sina.com.cn/js/pg/play/playflash.js" type="text/javascript"></script><!-- flash player end --><script language="javascript" type="text/javascript">

				sinaBokePlayerConfig_o.autoLoad = 1;
				sinaBokePlayerConfig_o.autoPlay = 1;
				SinaBokePlayer_o.addVars("vid", 18056957);
				SinaBokePlayer_o.addVars("as", 1);
				SinaBokePlayer_o.addVars("logo", 0);
				SinaBokePlayer_o.addVars("pid", 28);
				SinaBokePlayer_o.addVars("head", 0);
				SinaBokePlayer_o.addVars("tj", 0);
				SinaBokePlayer_o.addVars("vblog", 2);
				SinaBokePlayer_o.showFlashPlayer();

				</script><!-- 播放器 end -->
<p>&nbsp;</p>
<center><img alt="韩国限制电影叫《重庆》内容灰暗网友要求改名" style="border-right: #000 1px solid; border-top: #000 1px solid; border-left: #000 1px solid; border-bottom: #000 1px solid" src="http://i1.sinaimg.cn/ent/m/c/2008-12-30/U996P28T3D2321080F326DT20081230110029.jpg" /><br />
<img height="5" alt="" width="1" style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" src="http://i0.sinaimg.cn/home/c.gif" /><br />
这部影片中的颓废镜头 <!--br><font class=f12><b><a href=http://ent.sina.com.cn/photo />点击此处查看全部娱乐图片</a></font></b--><br />
<br />
</center><center><img alt="韩国限制电影叫《重庆》内容灰暗网友要求改名" style="border-right: #000 1px solid; border-top: #000 1px solid; border-left: #000 1px solid; border-bottom: #000 1px solid" src="http://i0.sinaimg.cn/ent/m/c/2008-12-30/U996P28T3D2321080F329DT20081230110029.jpg" /><br />
<img height="5" alt="" width="1" style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" src="http://i0.sinaimg.cn/home/c.gif" /><br />
在派出所面对父亲召妓的尴尬<br />
<br />
</center><center><img alt="韩国限制电影叫《重庆》内容灰暗网友要求改名" style="border-right: #000 1px solid; border-top: #000 1px solid; border-left: #000 1px solid; border-bottom: #000 1px solid" src="http://i3.sinaimg.cn/ent/m/c/2008-12-30/U996P28T3D2321080F328DT20081230110029.jpg" /><br />
<img height="5" alt="" width="1" style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" src="http://i0.sinaimg.cn/home/c.gif" /><br />
《重庆》剧照<br />
<br />
</center>
<p>　　本报讯 (记者 汪再兴) 这不是很搞吗？昨日，在重庆某网站论坛出现了一帖名为《韩国超尺度电影取名重庆》，帖子迅速成为当日热帖，一上午点击率过千。这部由中国导演执导在重庆拍摄的影片中过多颓废、性暗示的镜头引起了众多重庆网友们不满，网友一致要求其导演向重庆道歉，影片改名。</p>
<p>　　<strong>影片暴露尺度大被限&nbsp;&nbsp;&nbsp; //http://blogFuckadmin.com</strong></p>
<p>　　这部名为《重庆》的电影，讲述了一名与父亲相依为命的重庆女孩苏伊(音)靠教外国人中文维生。一日，父亲因为涉嫌召妓被捕。苏伊赶到警局，幸遇民警网开一面放过了其父，女孩苏伊作为感谢以身相许。后来，苏伊发现王伟除自己外还有诸多情人，大受打击下偷了王伟的配枪。</p>
<p>　　这部影片于10月28日在韩国釜山试映。记者昨日看了这部影片的一些片花，其中影片中有一段主要人物王警官和重庆女孩苏伊长时间暴露私处的场面，还有苏伊父亲召妓时的隐私部位特写镜头。韩国影视审查当局也认定该影片含过度裸露的性镜头和颓废压抑的城市环境等因素，不允许韩国青少年观看。</p>
<p>　<strong>　主创人员都是中国人</strong></p>
<p>　　记者了解到，《重庆》的导演<a class="akey" target="_blank" href="http://ent.sina.com.cn/m/2007-02-15/14471452932.html"><font color="#000099">张律</font></a>、主演及其他主创人员都是中国人，但影片由韩国电影公司Sponge全资制作，因此被归类为韩国电影。导演张律是朝鲜族人，曾获得过韩国<a class="akey" target="_blank" href="http://ent.sina.com.cn/f/m/piff2008/index.shtml"><font color="#000099">釜山电影节</font></a>大奖。</p>
<p>　　昨日记者联系到一名要求电影改名的网友。他表示，这部电影大部分都取景重庆的宾馆、棚户区，情节中充斥着不信任、放纵等等灰暗色调的情节，试问我们的城市是否真有这样的黑暗？他还附上了一些剧照，其剧照的场景不是裸露场景，就是棚户区的特写。</p>
<p>　　回帖的网友均认为，这部影片的导演根本不了解真实的重庆。有网友担心&ldquo;这部影片在国外放映，国外友人会怎么看重庆这个城市？&rdquo;渝网友一致要求导演道歉、电影改名。</p>
<p>　　<strong>导演：影片来源自己的真实感触</strong></p>
<p>　　导演张律在谈到这部影片拍摄的灵感时曾表示，创作最初来源自己的真实感触，&ldquo;我现在在一个叫&lsquo;韩国&rsquo;的地方生活着，世界上的人们各自在不<strong>//http://blogFuckadmin.com</strong>同的城市忙碌着、追求着叫&lsquo;理想&rsquo;的东西 。&rdquo;</p>
<p>　　&ldquo;《重庆》侧重拍摄熟悉的中国,所以不存在没有信心的问题。&rdquo;所以其选择先拍《重庆》。</p>
<p>　<strong>　影片评论：每个人都像一座孤岛</strong></p>
<p>　　记者查找了关于《重庆》的相关评论，一媒体写的电影影评中如此写道，一到夜晚就像纽约和首尔一样华丽，但重庆的每个人都像一座孤岛。</p>
<p>　　张律简介</p>
<p>　　生日：1962年</p>
<p>　　学历：延边大学</p>
<p>　　出道：2000年短片《11岁》</p>
<p>　　代表作品：《11岁》、《芒种》、<a class="akey" target="_blank" href="http://ent.sina.com.cn/m/f/desertdream/index.html"><font color="#000099">《沙漠之梦》</font></a></p>
<p>　　编后语</p>
<p>　　<strong>让张律、张晓舟、</strong><a class="akey" target="_blank" href="http://ent.sina.com.cn/f/ninghao/index.html"><strong><font color="#000099">宁浩</font></strong></a><strong>碰个头吧</strong></p>
<p>　　记得前年上演<a class="akey" target="_blank" href="http://ent.sina.com.cn/f/m/fkdst/index.shtml"><font color="#000099">《疯狂的石头》</font></a>时，电影中重庆人的幽默<a class="akey" target="_blank" href="http://ent.sina.com.cn/s/m/f/gengzh/index.html"><font color="#000099">耿直</font></a>征服了全国观众，甚至在网上掀起了一股&ldquo;重庆人太可爱了，我也要学重庆话&rdquo;的热潮。</p>
<p>　　时隔不久，今年初《南方都市报》上一篇&ldquo;很搞的城市&rdquo;，又让重庆的城市形象瞬间逆转。在一些不了解重庆的读者眼中，重庆形象被误读。</p>
<p>　　现在，又把&ldquo;重庆&rdquo;二字又被一部电影带到了国门之外。目前我们可以肯定的是，重庆的&ldquo;知名度&rdquo;再次提高了，然而剧照的场景不是裸露场景，就是棚户区的特写，这不仅是误读，更是亵渎。</p>
<p>　　让重庆走向世界，让世界了解重庆，光靠一个电视台每天例行的鸟瞰也是远远不够的。我想，我们为什么不能请张律，请张晓舟，还请宁浩碰个头，还原一个真实的重庆、宜居的重庆、开放的重庆。</p>]]></summary>
	  <link rel="alternate" type="text/html" href="http://www.Fuckadmin.com/Blog/article.asp?id=633" /> 
	  <id>http://www.Fuckadmin.com/Blog/default.asp?id=633</id>
  </entry>	
		
  <entry>
	  <title type="html"><![CDATA[[照片] 徐倩照片]]></title>
	  <author>
		 <name>hkylin</name>
		 <uri>http://www.Fuckadmin.com/Blog/</uri>
		 <email>x14071z1@gmail.com</email>
	  </author>
	  <category term="" scheme="http://www.Fuckadmin.com/Blog/default.asp?cateID=10" label="图形图像" /> 
	  <updated>2008-12-31T16:54:54+08:00</updated>
	  <published>2008-12-31T16:54:54+08:00</published>
		  <summary type="html"><![CDATA[<p><font size="2">名模<font color="#c60a00">徐倩</font>,因为7000块钱,结果落得个悲惨下场,真是让人感慨万分,由张柏芝、阿娇的艳门照,再到<font color="#c60a00">徐倩</font>,暗里没有显露出来的不晓得还有多少呢?...凶手辩称两人是相约自杀 2007年11月2日,魏磊通过他人介绍与<font color="#c60a00">徐倩</font>取得了联系,邀请<font color="#c60a00">徐倩</font>当模特,到云南丽江拍一些少数民族服饰的<font color="#c60a00">照片</font>,并许诺,事后给<font color="#c60a00">徐倩</font>7000元的酬金。...</font></p>
<p>&nbsp;</p>
<p><font size="2"><img id="439267" title="" src="http://www.qingdaonews.com/images/attachement/jpg/site1/20081229/0015c51a93bd0ac26da013.jpg" align="center" border="0" sourcedescription="编辑提供的本地文件" sourcename="本地文件" md5="" style="width: 400px; height: 602px" alt="" /></font></p>
<p>&nbsp;</p>
<p><font size="2">
<p>&nbsp;</p>
<table cellspacing="0" cellpadding="0" align="center" border="0">
    <tbody>
        <tr>
            <td align="center">
            <table cellspacing="0" cellpadding="0" border="0">
                <tbody>
                    <tr>
                        <td><img alt="徐倩" src="http://photocdn.sohu.com/20081229/Img261477980.jpg" align="middle" /></td>
                    </tr>
                </tbody>
            </table>
            </td>
        </tr>
        <tr>
            <td align="center" scw_ig="yes" style="font-size: 12px">徐倩</td>
        </tr>
    </tbody>
</table>
<table cellspacing="0" cellpadding="0" align="center" border="0">
    <tbody>
        <tr>
            <td align="center">
            <table cellspacing="0" cellpadding="0" border="0">
                <tbody>
                    <tr>
                        <td><img alt="徐倩" src="http://photocdn.sohu.com/20081229/Img261477981.jpg" align="middle" /></td>
                    </tr>
                </tbody>
            </table>
            </td>
        </tr>
        <tr>
            <td align="center" scw_ig="yes" style="font-size: 12px">徐倩</td>
        </tr>
    </tbody>
</table>
<table cellspacing="0" cellpadding="0" align="center" border="0">
    <tbody>
        <tr>
            <td align="center">
            <table cellspacing="0" cellpadding="0" border="0">
                <tbody>
                    <tr>
                        <td><img alt="徐倩" src="http://photocdn.sohu.com/20081229/Img261477982.jpg" align="middle" /></td>
                    </tr>
                </tbody>
            </table>
            </td>
        </tr>
        <tr>
            <td align="center" scw_ig="yes" style="font-size: 12px">徐倩</td>
        </tr>
    </tbody>
</table>
</font>
<div align="center"><img src="http://pic4.sdnews.com.cn/NewsImg/2008/12/29/20081229101734_C4BMUOTT.jpg" style="width: auto" alt="" /></div>
<p>　　<strong>两轮激情后的血案 他称&ldquo;相约自杀&rdquo;</strong></p>
<p>　　被保安从机场接到丽王大酒店，他们用徐倩的身份证登记，住进了提前预订的1301号标间。魏磊说，因为很累，他们约好次日去爬玉龙雪山，便各自在一张床上睡了。</p>
<p>　　从他们包租车辆的驾驶员和酒店多位工作人员所提供的情况来看，11月4日，魏磊和徐倩玩得非常开心。他们一大早就去了玉龙雪山，午后下山，回到城里吃野生菌。徐倩觉得很累，不想吃，独自在车里小睡了一会。魏磊和驾驶员吃完后，三人又一起去了拉什海，黄昏时分返回，魏磊和徐倩又去买了一些水果，还有一把不锈钢水果刀。</p>
<p>　　当晚，丽王大酒店1301号房间中究竟发生了些什么，已经注定成为了难以破解的谜。唯一确定的是模特徐倩的&ldquo;非正常死亡&rdquo;。根据魏磊供述：他们各自洗完澡后，便分坐在两张床上，看电视、吃水果、聊天。聊着聊着，就说到了关于性的话题，而且，两人&ldquo;都没有什么不好意思的&rdquo;。接下来，&ldquo;我爬到她床上去，她没有说什么，我把她的被子掀开，见她的睡衣里面没穿内衣，下面穿了一条带花纹的内裤。我就和她发生了性关系。&rdquo;</p>
<p>　　之后，魏继续和徐聊天。大约20分钟后，他和徐发生了第二次性关系。魏磊称，在这两番激情之后，他回到自己的床上躺着，继续和徐倩聊天，一直聊到大约凌晨三四点，这次，他们谈起了各自的生活。&ldquo;我们都觉得活着没有意思，之后，就提出了一起死的问题。当时是谁先提出来的，我记不得了。她说，要么你先死，要么我先死。我说我先死，但她说她下不了手，就说&lsquo;我先死&rsquo;。&rdquo;</p>
<p>　　&ldquo;我就过去，坐在她的床边，用双手掐她的脖子，她没有反抗，也没有叫&hellip;&hellip;我又骑在她身上掐她的脖子，一直掐到她不动。我问自己：她真的死了吗？接着我拿她睡衣上的带子，拴在脖子上，我的手在抖，有没有用力拉不记得了。之后，我见她嘴巴张开了，很害怕，就拿来一个枕头，盖住她的脸&hellip;&hellip;&rdquo;</p>
<p>　　<strong>她的身体已冰凉 &ldquo;我就总是没死成&rdquo;</strong></p>
<p>　　在实施了以上罪行之后，魏磊开始自杀。他用白天买的水果刀，割自己的手腕，见流血了，便躺上床去睡觉，但天亮时又醒过来了，&ldquo;感觉做了一个梦，自己还没死&rdquo;。而当时，徐倩的身体已经冰凉，&ldquo;这时我更加害怕了，我到底是死，是跑，还是去自首？&rdquo;</p>
<p>　　紧接着，魏磊并没选择这三条路里的任何一条，而是把他和徐倩各自买的普洱茶、他的数码相机、银行卡、身份证打包起来，扛着出了酒店。他特意多次向总台交代&ldquo;1301号房间不用打扫了！&rdquo;他来到附近的邮局，把这些东西全部寄回家，打包裹时，他悄悄往里面夹藏了一些现金，还留了一份&ldquo;遗书&rdquo;进去：&ldquo;爸爸妈妈，我永远爱你们。我跟徐倩走了，感谢你们的养育之恩。请原谅。&rdquo;落款是&ldquo;不孝的儿子&rdquo;。</p>
<p>　　魏磊似乎觉得，这样就可以给家人一个交代了。之后，他又买了一把水果刀和一瓶大可乐，回酒店，打算继续割腕自杀。但此时的他，已经变得越来越烦躁和恐惧，在房间里不停灌着可乐，不停抽着烟走来走去，不停地调换电视频道，还接连冲了几次澡。之后，他多次用水果刀割腕，由于总是不够狠，也就总是没死得成。</p>
<style type="text/css">.pb{}.pb textarea{font-size:14px; margin:10px; font-family:"宋体"; background:#FFFFEE; color:#000066}.pb_t{line-height:30px; font-size:14px; color:#000; text-align:center;}/* 分页 */.pagebox{overflow:hidden; zoom:1; font-size:12px; font-family:"宋体",sans-serif;}.pagebox span{float:left; margin-right:2px; overflow:hidden; text-align:center; background:#fff;}.pagebox span a{display:block; overflow:hidden; zoom:1; _float:left;}.pagebox span.pagebox_pre_nolink{border:1px #ddd solid; width:53px; height:21px; line-height:21px; text-align:center; color:#999; cursor:default;}.pagebox span.pagebox_pre{color:#3568b9; height:23px;}.pagebox span.pagebox_pre a,.pagebox span.pagebox_pre a:visited,.pagebox span.pagebox_next a,.pagebox span.pagebox_next a:visited{border:1px #9aafe5 solid; color:#3568b9; text-decoration:none; text-align:center; width:53px; cursor:pointer; height:21px; line-height:21px;}.pagebox span.pagebox_pre a:hover,.pagebox span.pagebox_pre a:active,.pagebox span.pagebox_next a:hover,.pagebox span.pagebox_next a:active{color:#363636; border:1px #2e6ab1 solid;}.pagebox span.pagebox_num_nonce{padding:0 8px; height:23px; line-height:23px; color:#fff; cursor:default; background:#296cb3; font-weight:bold;}.pagebox span.pagebox_num{color:#3568b9; height:23px;}.pagebox span.pagebox_num a,.pagebox span.pagebox_num a:visited{border:1px #9aafe5 solid; color:#3568b9; text-decoration:none; padding:0 8px; cursor:pointer; height:21px; line-height:21px;}.pagebox span.pagebox_num a:hover,.pagebox span.pagebox_num a:active{border:1px #2e6ab1 solid;color:#363636;}.pagebox span.pagebox_num_ellipsis{color:#393733; width:22px; background:none; line-height:23px;}.pagebox span.pagebox_next_nolink{border:1px #ddd solid; width:53px; height:21px; line-height:21px; text-align:center; color:#999; cursor:default;}</style>
<p><img src="http://pic4.sdnews.com.cn/NewsImg/2008/12/29/20081229101753_4WMR08R5.jpg" style="width: auto" alt="" />&nbsp;</p>
</p>
<p>&nbsp;&nbsp;&nbsp; 一位曾多次在国内及国际大赛中夺魁的超级模特，受聘从山东来到云南丽江，原本是为了帮雇主拍些民族服饰照片回去，用于新开民族服饰店的宣传。结果最后，竟就此香销玉焚在了美丽的丽江，凶手正是承诺此行结束后，将支付7000元酬劳的雇主。已经查明的情况显示，死前，二人曾发现过两次性关系。</p>]]></summary>
	  <link rel="alternate" type="text/html" href="http://www.Fuckadmin.com/Blog/article.asp?id=632" /> 
	  <id>http://www.Fuckadmin.com/Blog/default.asp?id=632</id>
  </entry>	
		
  <entry>
	  <title type="html"><![CDATA[[新闻] 港学生性爱视频网上流传 警方称将揪出元凶]]></title>
	  <author>
		 <name>hkylin</name>
		 <uri>http://www.Fuckadmin.com/Blog/</uri>
		 <email>x14071z1@gmail.com</email>
	  </author>
	  <category term="" scheme="http://www.Fuckadmin.com/Blog/default.asp?cateID=1" label="业界资讯" /> 
	  <updated>2008-12-31T16:49:15+08:00</updated>
	  <published>2008-12-31T16:49:15+08:00</published>
		  <summary type="html"><![CDATA[　核心提示：一对香港学生做爱短片近日在网上闹得热烘烘，片段中自比为陈冠希的男事主被指为遵理学校中五毕业生，早前更未得校方同意穿校服参加一本杂志举办的校草选举，遵理表示会保留追究权利。 <br/>中新网12月31日电 据香港媒体报道，一对香港学生做爱短片近日在网上闹得热烘烘，片段中自比为陈冠希的男事主被指为遵理学校中五毕业生，早前更未得校方同意穿校服参加一本杂志举办的校草选举，遵理表示会保留追究权利。<br/><br/>有网民怀疑当事人将情欲短片储存在有Foxy软件的个人电脑内而“中招”，令短片外泄。警方暂列作求警调查处理，消息指，警方有信心可揪出发放短片上网的元凶。<br/><br/>29日有人把四段涉及同一对男女做爱短片的海外网址上载香港讨论区，吸引大批网民追看，有网民更踢爆片段中的男事主为遵理学校的学生，更指他曾参加过一本杂志举办的校草选举。而女事主则是一间专上院校一年级学生。记者30日上网发现，该两个讨论区的网站主持人已删除有关短片的讨论。<br/><br/>遵理学校创办人伍经衡回应查询时证实，有关男生曾于几年前在该校就读中四，其后自动停学两年，去年9月再返该校就读中五，并已于今年6月毕业。<br/><br/>针对该名毕业男生在今年7月穿该校校服参加一本杂志举办的校草选举，伍经衡指出，根据该校校规，毕业生或已非该校学生未经校方同意而公开穿该校校服，是违反校规。伍称，该名男生此举并没有获得该校同意，有影响该校声誉之嫌，会咨询法律意见，保留追究权利。<br/><br/>记者向女事主被指就读的专上院校查询，职员说暂不作任何回应。<br/><br/>警方发言人表示，警方商业罪案调查科科技罪案组正积极跟进调查案件，案件暂列作求警调查处理，警方呼吁市民如发现有人发布淫亵或不雅物品，应尽快向警方举报。<br/><br/>消息指，警方至今尚未接获任何人士报警求助，但由于事件已明显触犯淫亵及不雅物品条例，“就算没有人报警，警方都可以去追查。”提及有关讨论区已删除有关片段及讨论，会否阻碍警方调查，“就算删除了，警方都有办法去查(发放源头)，所谓天网恢恢，疏而不漏，有信心可以追查到。”<br/><br/>香港立法会保安事务委员会副主席涂谨申指出，随资讯自由发放，会诱发网民参与网上发布这类淫亵不雅物品的意欲，“资讯自由化气氛笼罩下，网民有发表参与意欲，相信这次并非受陈冠希事件影响。”<br/>]]></summary>
	  <link rel="alternate" type="text/html" href="http://www.Fuckadmin.com/Blog/article.asp?id=631" /> 
	  <id>http://www.Fuckadmin.com/Blog/default.asp?id=631</id>
  </entry>	
		
  <entry>
	  <title type="html"><![CDATA[[破解] 软件保护壳技术专题 - 反调试器技术]]></title>
	  <author>
		 <name>hkylin</name>
		 <uri>http://www.Fuckadmin.com/Blog/</uri>
		 <email>x14071z1@gmail.com</email>
	  </author>
	  <category term="" scheme="http://www.Fuckadmin.com/Blog/default.asp?cateID=2" label="计算机技术" /> 
	  <updated>2008-12-29T17:28:03+08:00</updated>
	  <published>2008-12-29T17:28:03+08:00</published>
		  <summary type="html"><![CDATA[标 题: 【原创】软件保护壳技术专题 - 反调试器技术<br/>作 者: 玩命<br/>时 间: 2008-08-21,10:38<br/>链 接: <a href="http://bbs.pediy.com/showthread.php?t=71113" target="_blank" rel="external">http://bbs.pediy.com/showthread.php?t=71113</a><br/><br/>反调试是软件保护壳的最基本的功能之一。<br/>反调试方法也是多种多样。通过调用标准的API接口，计算指令时间差。查看当调试器加载后的<br/>内存的一些标志，还有就是判断当前运行环境是否合乎逻辑等方法。这里收集了一些反调试的方法，其中的命名规则使用了壳狼的反调试程序的方式，希望不要和我收取版权的费用。^_^,其中借鉴了不少壳狼的函数。增加了一些，也删除了一些。大部分的参考资料来自&lt;&lt;脱壳的艺术&gt;&gt;,&lt;&lt;Anti-UnPacker Tricks&gt;&gt;与&lt;&lt;加密与解密第三版&gt;&gt;。<br/>这里要说明的一点是。每个函数编写都是自己建立堆栈了，看的不习惯的多看下就习惯了 呵呵。<br/>原因也很简单，MASM不允许在函数内定义函数了。<br/>这些函数还有一个要讲的是。因为最后这些函数要在以后的章节中用到<br/>为了能允许用户自定义反调试的功能。免去重定位的麻烦，所以<br/>利用栈传递了API集合地址和外部函数集合的地址。<br/>朋友们还是先看代码了。。。<br/><br/><br/>利用IsDebuggerPresent确定是否存在,IsDebuggerPresent是WIN提供的一个标准调试API<br/>用于确定是否存在调试器。这个方法很简单TRUE为存在,FASLE则为不存在。<br/><br/>代码:<br/>FD_IsDebuggerPresent:<br/>FD_IsDebugger_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ 04h<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [esp+FD_IsDebugger_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [eax].xIsDebuggerPresent<br/>Exit_FD_IsDebuggerPresent:<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>End_FD_IsDebuggerPresent:<br/>我们更进一步的剖析IsDebuggerPresent函数，逆向它后即可得知。<br/>这个函数读取当前进程的PEB中的BeingDebugger标志。<br/>如果确定这个标志呢？<br/>当进程加载的时候FS寄存器总是被设置成当前线程的TEB。这下就都OK<br/>而在TEB的30h偏移处就是ProcessEnvironmentBlock了。<br/>而PEB的偏移02h出就是BeingDebugged了。当BeingDebugger为0则没有调试器<br/>不为0时则存在调试器。<br/><br/>代码:<br/>FD_PEB_BeingDebuggedFlag:<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume fs : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, fs:[30h]&nbsp;&nbsp; ; eax = TEB.ProcessEnvironmentBlock<br/>&nbsp;&nbsp;&nbsp;&nbsp;inc eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;inc eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax]<br/>&nbsp;&nbsp;&nbsp;&nbsp;and eax, 000000FFh&nbsp;&nbsp;; al = PEB.BeingDebugged<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_PEB_BeingDebuggedFlag_Found<br/>Exit_PEB_BeingDebuggedFlag:<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 0&nbsp;&nbsp;&nbsp;&nbsp;<br/>FD_PEB_BeingDebuggedFlag_Found:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp&nbsp;&nbsp;Exit_PEB_BeingDebuggedFlag<br/>End_FD_PEB_BeingDebuggedFlag:<br/>在当BeingDebugged被设置为TRUE时，存在与PEB中的<br/>NtGlobalFlag也会做出相应的改变。查看WIN2K代码的LdrpInitialize<br/>会发现以下代码<br/>if (Peb-&gt;BeingDebugged)<br/>Peb-&gt;NtGlobalFlag |= FLG_HEAP_ENABLE_FREE_CHECK |<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FLG_HEAP_ENABLE_TAIL_CHECK |<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FLG_HEAP_VALIDATE_PARAMETERS;<br/>这个组合值为70h。所以我们又得到一个反调试的函数<br/><br/>代码:<br/>FD_PEB_NtGlobalFlags:<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume fs : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, fs:[30h]<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax+68h]<br/>&nbsp;&nbsp;&nbsp;&nbsp;and eax, 070h<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_PEB_NtGlobalFlags_Found<br/>Exit_FD_PEB_NtGlobalFlags:<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 0<br/>FD_PEB_NtGlobalFlags_Found:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp&nbsp;&nbsp;Exit_FD_PEB_NtGlobalFlags<br/>End_FD_PEB_NtGlobalFlags:<br/>BeingDebugger标志还会影响ProcessHeap.Flags<br/>如果这个标志不为0则存在调试器。<br/><br/>代码:<br/>FD_Heap_ForceFlags:<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume fs : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, fs:[30h]<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax+18h]&nbsp;&nbsp;&nbsp;&nbsp;; PEB.ProcessHeap<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax+10h]&nbsp;&nbsp;&nbsp;&nbsp;; PEB.ProcessHeap.Flags<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Heap_ForceFlags<br/>Exit_FD_Heap_ForceFlag:<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 0<br/>Found_FD_Heap_ForceFlags:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Heap_ForceFlag&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br/>End_FD_Heap_ForceFlags:<br/>在BeingDebugger下ProcessHeap.ForceFlags也受到影响<br/>如果不为2则存在调试器。细节部分可以查看WIN2K的代码。<br/>由于版本影响这里就不给出其中的代码了。<br/><br/>代码:<br/>FD_Heap_HeapFlags:<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume fs : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, fs:[30h]<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax+18h]&nbsp;&nbsp;&nbsp;&nbsp;; PEB.ProcessHeap<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax+0ch]&nbsp;&nbsp;&nbsp;&nbsp;; PEB.ProcessHeap.ForceFlags<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, 2<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Heap_HeapFlags<br/>Exit_FD_Heap_HeapFlags:<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 0&nbsp;&nbsp;<br/>Found_FD_Heap_HeapFlags:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Heap_HeapFlags&nbsp;&nbsp;<br/>End_FD_Heap_HeapFlags:<br/>通过另一个API。CheckRemoteDebuggerPresent，这个API可以检测任何进程是否被调试器<br/>加载。这里通过GetCurrentProcess取得自身进程的句柄。进行鉴别<br/><br/>代码:<br/>FD_CheckRemoteDebuggerPresent:<br/>FD_CheckRemoteDebuggerPresent_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;equ 04h<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [esp+FD_CheckRemoteDebuggerPresent_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;push esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [eax].xGetCurrentProcess<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [eax].xCheckRemoteDebuggerPresent<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>End_FD_CheckRemoteDebuggerPresent:<br/>如果逆向了CheckRemoteDebuggerPresent函数就可以明白，其实最终它是调用<br/>NtQueryInformationProcess，查询进程的ProcessDebugPort。此值是用来维持系统<br/>与调试器通讯的，在程序被调试器加载时系统会设置这个值为非0。<br/><br/>代码:<br/>FD_NtQueryInfoProc_DbgPort:<br/>FD_NtQueryInfoProc_DbgPort_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;equ 08h<br/>FD_NtQueryInfoProc_DbgPort_StackSize&nbsp;&nbsp;&nbsp;&nbsp;equ sizeof PROCESS_DEBUG_PORT_INFO<br/>FD_NtQueryInfoProc_DbgPort_ProcessInfo&nbsp;&nbsp;equ -(FD_NtQueryInfoProc_DbgPort_StackSize)<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebp, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub esp, FD_NtQueryInfoProc_DbgPort_StackSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, dword ptr [ebp+FD_NtQueryInfoProc_DbgPort_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push sizeof PROCESS_DEBUG_PORT_INFO<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_NtQueryInfoProc_DbgPort_ProcessInfo]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ProcessDebugPort<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xGetCurrentProcess<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xZwQueryInformationProcess<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_NtQueryInfoProc_DbgPort_Tmp1<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_NtQueryInfoProc_DbgPort_ProcessInfo]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : ptr PROCESS_DEBUG_PORT_INFO<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax].DebugPort<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_NtQueryInfoProc_DbgPort<br/>FD_NtQueryInfoProc_DbgPort_Tmp1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>Exit_FD_NtQueryInfoProc_DbgPort:<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esp, ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>Found_FD_NtQueryInfoProc_DbgPort:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_NtQueryInfoProc_DbgPort&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br/>End_FD_NtQueryInfoProc_DbgPort:<br/>当Windows系统创建一个调试会话开始，一个调试对象也被创建并产生一个<br/>调试句柄。我们可以查询这个句柄的值来确定是否存在调试器。<br/><br/>代码:<br/>FD_NtQueryInfoProc_DbgObjHandle:<br/>FD_NtQueryInfoProc_DbgObjHandle_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;equ 08h<br/>FD_NtQueryInfoProc_DbgObjHandle_StackSize&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ sizeof PROCESS_DEBUG_OBJECTHANDLE_INFO<br/>FD_NtQueryInfoProc_DbgObjHandle_ProcessInfo&nbsp;&nbsp;&nbsp;&nbsp; equ -(FD_NtQueryInfoProc_DbgObjHandle_StackSize)<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebp, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub esp, FD_NtQueryInfoProc_DbgObjHandle_StackSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, dword ptr [ebp+FD_NtQueryInfoProc_DbgObjHandle_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push sizeof PROCESS_DEBUG_OBJECTHANDLE_INFO<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_NtQueryInfoProc_DbgObjHandle_ProcessInfo]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push SystemNotImplemented8<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xGetCurrentProcess<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xZwQueryInformationProcess<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_NtQueryInfoProc_DbgObjHandle_Tmp1<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_NtQueryInfoProc_DbgObjHandle_ProcessInfo]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : ptr PROCESS_DEBUG_OBJECTHANDLE_INFO<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax].ObjectHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_NtQueryInfoProc_DbgObjHandle<br/>FD_NtQueryInfoProc_DbgObjHandle_Tmp1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>Exit_FD_NtQueryInfoProc_DbgObjHandle:<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esp, ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>Found_FD_NtQueryInfoProc_DbgObjHandle:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_NtQueryInfoProc_DbgObjHandle<br/>End_FD_NtQueryInfoProc_DbgObjHandle:<br/>也可以通过使用ZwQueryInformationProcess函数,利用SystemNotImplemented9(1fh)<br/>返回的PROCESS_DEBUG_FLAGS_INFO结构，如果DebugFlags返回0则检测到调试器。返回非0<br/>则没发现调试器。<br/><br/>代码:<br/>FD_NtQueryInfoProc_DbgFlags:<br/>FD_NtQueryInfoProc_DbgFlags_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;equ 08h<br/>FD_NtQueryInfoProc_DbgFlags_StackSize&nbsp;&nbsp;&nbsp;&nbsp;equ sizeof PROCESS_DEBUG_FLAGS_INFO<br/>FD_NtQueryInfoProc_DbgFlags_ProcessInfo&nbsp;&nbsp;equ -(FD_NtQueryInfoProc_DbgFlags_StackSize)<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebp, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub esp, FD_NtQueryInfoProc_DbgFlags_StackSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, dword ptr [ebp+FD_NtQueryInfoProc_DbgFlags_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push sizeof PROCESS_DEBUG_FLAGS_INFO<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_NtQueryInfoProc_DbgFlags_ProcessInfo]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push SystemNotImplemented9<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xGetCurrentProcess<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xZwQueryInformationProcess<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_NtQueryInfoProc_DbgFlags_Tmp1<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_NtQueryInfoProc_DbgFlags_ProcessInfo]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : ptr PROCESS_DEBUG_FLAGS_INFO<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax].DebugFlags<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_NtQueryInfoProc_DbgFlags<br/>FD_NtQueryInfoProc_DbgFlags_Tmp1: <br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>Exit_FD_NtQueryInfoProc_DbgFlags:<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esp, ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>Found_FD_NtQueryInfoProc_DbgFlags:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_NtQueryInfoProc_DbgFlags<br/>End_FD_NtQueryInfoProc_DbgFlags:<br/>如果Windows以调试方式启动，并与系统调试器建立通讯。<br/>通过ZwQuerySystemInformation对SystemKernelDebuggerInformation进行查询<br/>系统中是否存在系统调试器。<br/><br/>代码:<br/>FD_NtQueryInfoProc_SysKrlDbgInfo:<br/>FD_NtQueryInfoProc_SysKrlDbgInfo_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;equ 08h<br/>FD_NtQueryInfoProc_SysKrlDbgInfo_StackSize&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ sizeof PROCESS_DEBUG_FLAGS_INFO<br/>FD_NtQueryInfoProc_SysKrlDbgInfo_Info&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; equ -(sizeof PROCESS_DEBUG_FLAGS_INFO)<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebp, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub esp, FD_NtQueryInfoProc_SysKrlDbgInfo_StackSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, dword ptr [ebp+FD_NtQueryInfoProc_SysKrlDbgInfo_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push sizeof PROCESS_DEBUG_FLAGS_INFO<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_NtQueryInfoProc_SysKrlDbgInfo_Info]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push SystemKernelDebuggerInformation<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xGetCurrentProcess<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xZwQuerySystemInformation<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_NtQueryInfoProc_SysKrlDbgInfo_Tmp1<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_NtQueryInfoProc_SysKrlDbgInfo_Info]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : ptr PROCESS_DEBUG_FLAGS_INFO<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax].DebugFlags<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_NtQueryInfoProc_SysKrlDbgInfo<br/>FD_NtQueryInfoProc_SysKrlDbgInfo_Tmp1:&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>Exit_FD_NtQueryInfoProc_SysKrlDbgInfo:<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esp, ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>Found_FD_NtQueryInfoProc_SysKrlDbgInfo:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_NtQueryInfoProc_SysKrlDbgInfo<br/>End_FD_NtQueryInfoProc_SysKrlDbgInfo:<br/>当调试会话被创建,这个标志会影响堆的创建。初始化中的堆内存填充了<br/>很多类似0ABABABABh,0BAADF00Dh,0FEEEFEEEh这三个值。可以通过检测内存看<br/>是否存在过多的这样值。判断调试器的存在，而正常启动的程序则不会被填充。<br/><br/>代码:<br/>FD_Heap_Magic:<br/>FD_Heap_Magic_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ 04h<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [esp+FD_Heap_Magic_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push 100h<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xGetProcessHeap<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov edi, eax&nbsp;&nbsp;&nbsp;&nbsp;; HeapHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xHeapAlloc<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esi, eax&nbsp;&nbsp;&nbsp;&nbsp;; HeapMem<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor ecx, ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov edx, 100h<br/>&nbsp;&nbsp;&nbsp;&nbsp;cld<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Heap_Magic_Loop:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lodsd<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, 0ABABABABh<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_Heap_Magic_Tmp1<br/>&nbsp;&nbsp;&nbsp;&nbsp;inc ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Heap_Magic_Tmp1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, 0BAADF00Dh<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_Heap_Magic_Tmp2<br/>&nbsp;&nbsp;&nbsp;&nbsp;inc ecx&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Heap_Magic_Tmp2:<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, 0FEEEFEEEh<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_Heap_Magic_Tmp3<br/>&nbsp;&nbsp;&nbsp;&nbsp;inc ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Heap_Magic_Tmp3:<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub edx, 04h<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_Heap_Magic_Loop<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ecx&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; free heap<br/>&nbsp;&nbsp;&nbsp;&nbsp;push esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;push HEAP_NO_SERIALIZE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xHeapFree<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; judge count<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp ecx, 10h<br/>&nbsp;&nbsp;&nbsp;&nbsp;jae Found_FD_Heap_Magic<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>Exit_FD_Heap_Magic:&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edi&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>Found_FD_Heap_Magic:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Heap_Magic<br/>End_FD_Heap_Magic:<br/>一般程序是没有被设置SeDebugPrivilege，如果一个当前进程被设置SeDebugPrivilege后<br/>它就拥有了完全控制CSRSS.EXE的权限。通过进程表快照取得CSRSS.EXE进程的PID，之后<br/>通过OpenProcess以PROCESS_ALL_ACCESS打开。开是否能打开此进程。<br/><br/>代码:<br/>FD_SeDebugPrivilege:<br/>FD_SeDebugPrivilege_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;equ 08h<br/>FD_SeDebugPrivilege_StackSize&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; equ 10h + sizeof PROCESSENTRY32<br/>FD_SeDebugPrivilege_hProcessSnap&nbsp;&nbsp;&nbsp;&nbsp;equ -04h<br/>FD_SeDebugPrivilege_PID_csrss&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; equ -08h<br/>FD_SeDebugPrivilege_FingFlag&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ -0ch<br/>FD_SeDebugPrivilege_pe32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ -(10h+sizeof PROCESSENTRY32)<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebp, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub esp, FD_SeDebugPrivilege_StackSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; clear stack<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea edi, [ebp-FD_SeDebugPrivilege_StackSize]<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ecx, FD_SeDebugPrivilege_StackSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;cld<br/>&nbsp;&nbsp;&nbsp;&nbsp;rep stosb<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, dword ptr [ebp+FD_SeDebugPrivilege_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea edi, [ebp+FD_SeDebugPrivilege_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume edi : ptr PROCESSENTRY32<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br/>&nbsp;&nbsp;&nbsp;&nbsp;push 0<br/>&nbsp;&nbsp;&nbsp;&nbsp;push TH32CS_SNAPPROCESS<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateToolhelp32Snapshot<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, INVALID_HANDLE_VALUE<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz NotFound_FD_SeDebugPrivilege<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov dword ptr [ebp+FD_SeDebugPrivilege_hProcessSnap], eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;push sizeof PROCESSENTRY32<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop dword ptr [edi].dwSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_SeDebugPrivilege_hProcessSnap]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xProcess32First<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_SeDebugPrivilege_Loop<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_SeDebugPrivilege_hProcessSnap]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCloseHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp NotFound_FD_SeDebugPrivilege<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_SeDebugPrivilege_Loop:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_SeDebugPrivilege_Str<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#39;CSRSS.EXE&#39;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_SeDebugPrivilege_Str:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [edi].szExeFile<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_SeDebugPrivilege_Tmp2<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [edi].th32ProcessID<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop dword ptr [ebp+FD_SeDebugPrivilege_PID_csrss]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push TRUE<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop dword ptr [ebp+FD_SeDebugPrivilege_FingFlag]<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_SeDebugPrivilege_Tmp2:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [ebp+FD_SeDebugPrivilege_FingFlag]<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_SeDebugPrivilege_Tmp3<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_SeDebugPrivilege_hProcessSnap]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xProcess32Next<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_SeDebugPrivilege_Loop<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_SeDebugPrivilege_Tmp3:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [ebp+FD_SeDebugPrivilege_FingFlag]<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz FD_SeDebugPrivilege_Tmp4<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_SeDebugPrivilege_PID_csrss]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FALSE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push PROCESS_QUERY_INFORMATION<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xOpenProcess<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz FD_SeDebugPrivilege_Tmp4<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_SeDebugPrivilege_hProcessSnap]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCloseHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Found_FD_SeDebugPrivilege<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_SeDebugPrivilege_Tmp4:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_SeDebugPrivilege_hProcessSnap]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCloseHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp NotFound_FD_SeDebugPrivilege<br/>Exit_FD_SeDebugPrivilege:<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume edi : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esp, ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>NotFound_FD_SeDebugPrivilege:<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_SeDebugPrivilege<br/>Found_FD_SeDebugPrivilege:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_SeDebugPrivilege<br/>End_FD_SeDebugPrivilege:<br/>通过逻辑的判断也可以找到调试器所在，一般来讲程序都是有explorer.exe进程启动的(通过双击)<br/>如果我们的进程的父进程不是explorer.exe则发现调试器。如果有调试的名称冒名是explorer.exe<br/>那么我们判断父进程ID后进一步判断explorer.exe进程的路径是否存在于Windows目录下。如果不是<br/>则发现调试器。此类方法也可以也被病毒用作穿透仿真机。<br/><br/>代码:<br/>FD_Parent_Process:<br/>FD_Parent_Process_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ 08h<br/>FD_Parent_Process_StackSize&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; equ MAX_PATH + sizeof PROCESSENTRY32 + sizeof MODULEENTRY32 + 20h<br/>FD_Parent_Process_hParnet&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; equ -04h<br/>FD_Parent_Process_PIDExplorer&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; equ -08h<br/>FD_Parent_Process_PIDParent&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; equ -0ch<br/>FD_Parent_Process_PIDChild&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ -10h<br/>FD_Parent_Process_hSnapshot&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; equ -14h<br/>FD_Parent_Process_pe32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ -(20h + PROCESSENTRY32)<br/>FD_Parent_Process_me32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ -(20h + PROCESSENTRY32 + MODULEENTRY32)<br/>FD_Parent_Process_lpszSystemInfo&nbsp;&nbsp;&nbsp;&nbsp;equ -(20h + PROCESSENTRY32 + MODULEENTRY32 + MAX_PATH)<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebp, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub esp, FD_Parent_Process_StackSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;push esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; clear the stack<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea edi, [ebp-FD_Parent_Process_StackSize]<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ecx, FD_Parent_Process_StackSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;cld<br/>&nbsp;&nbsp;&nbsp;&nbsp;rep stosb<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, dword ptr [ebp+FD_Parent_Process_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : ptr PROCESSENTRY32<br/>&nbsp;&nbsp;&nbsp;&nbsp;push sizeof PROCESSENTRY32<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop dword ptr [eax].dwSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xGetCurrentProcessId<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov dword ptr [ebp+FD_Parent_Process_PIDChild], eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push 0<br/>&nbsp;&nbsp;&nbsp;&nbsp;push TH32CS_SNAPPROCESS<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateToolhelp32Snapshot<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov dword ptr [ebp+FD_Parent_Process_hSnapshot], eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Parent_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xProcess32First<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz FD_Parent_Process_Tmp1<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Loop1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Parent_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xProcess32Next<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz FD_Parent_Process_Tmp2<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Parent_Process_Str1<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;EXPLORER.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Str1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [eax].szExeFile&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_Parent_Process_Tmp3<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [ebp+FD_Parent_Process_PIDExplorer]<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_Parent_Process_Tmp3<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : ptr PROCESSENTRY32<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [eax].th32ProcessID<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop dword ptr [ebp+FD_Parent_Process_PIDExplorer]<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Tmp3:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax].th32ProcessID<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub eax, dword ptr [ebp+FD_Parent_Process_PIDChild]<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_Parent_Process_Tmp4<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [eax].th32ParentProcessID<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop dword ptr [ebp+FD_Parent_Process_PIDParent]<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Tmp4:<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp FD_Parent_Process_Loop1<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Tmp1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Parent_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCloseHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp NotFound_FD_Parent_Process<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Tmp2:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [ebp+FD_Parent_Process_PIDExplorer]<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub eax, dword ptr [ebp+FD_Parent_Process_PIDParent]<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz FD_Parent_Process_Tmp5<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Parent_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCloseHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Found_FD_Parent_Process<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Tmp5:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_me32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : ptr MODULEENTRY32<br/>&nbsp;&nbsp;&nbsp;&nbsp;push sizeof MODULEENTRY32<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop dword ptr [eax].dwSize&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Parent_Process_PIDExplorer]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push TH32CS_SNAPMODULE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateToolhelp32Snapshot<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov dword ptr [ebp+FD_Parent_Process_hSnapshot], eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_me32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Parent_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xModule32First<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz FD_Parent_Process_Tmp6<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Loop2:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_me32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [eax].th32ProcessID<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub eax, dword ptr [ebp+FD_Parent_Process_PIDExplorer]<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_Parent_Process_Tmp7<br/>&nbsp;&nbsp;&nbsp;&nbsp;push MAX_PATH<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_lpszSystemInfo]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xGetWindowsDirectoryA<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Parent_Process_Str2<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#39;\&#39;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Str2:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_lpszSystemInfo]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcatA<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Parent_Process_Str3<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;EXPLORER.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Str3:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_lpszSystemInfo]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcatA<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_lpszSystemInfo]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_me32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [eax].szExePath<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz FD_Parent_Process_Tmp6<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Parent_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCloseHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Found_FD_Parent_Process<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Tmp7:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Parent_Process_me32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Parent_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xModule32Next<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_Parent_Process_Loop2<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Parent_Process_Tmp6:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Parent_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCloseHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp NotFound_FD_Parent_Process<br/>Exit_FD_Parent_Process:<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume eax : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esp, ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>NotFound_FD_Parent_Process:<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Parent_Process<br/>Found_FD_Parent_Process:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Parent_Process&nbsp;&nbsp;&nbsp;&nbsp;<br/>End_FD_Parent_Process:<br/>当调试会话创建，将产生一个调试对象，我们通过ntdll中的<br/>NtQueryObject函数参看调试对象的个数是否不为零，来确定调试器的存在<br/>以ObjectAllTypeInformation使用NtQueryObject查询后会返回一个<br/>OBJECT_ALL_INFORMATION的结构，其中NumberOfObjectsTypes成员为所有的<br/>对象类型在ObjectTypeInformation数组中的计数<br/>此对象如下<br/>typedef struct _OBJECT_ALL_INFORMATION<br/>ULONG&nbsp;&nbsp;&nbsp;&nbsp;NumberOfObjectsTypes;<br/>OBJECT_TYPE_INFORMATION ObjectTypeInformation[1];<br/>}<br/>typedef strcut _OBJECT_TYPE_INFORMATION {<br/>[00]UNICODE_STRING TypeName;<br/>[08]ULONG TotalNumberofHandles;<br/>[0c]ULONG TotalNumberofObjects;<br/>...<br/>}<br/>循环遍历ObjectTypeInformation对比类型的名字,如有类型名为DebugObject则<br/>检测TotalNumberofHandles与TotalNumberofObjects如果不为0则存在调试器。<br/><br/>代码:<br/>FD_DebugObject_NtQueryObject:<br/>FD_DebugObject_NtQueryObject_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ 04h<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, dword ptr [esp+FD_DebugObject_NtQueryObject_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;push esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edx&nbsp;&nbsp;&nbsp;&nbsp;; alloc the stack<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push esp&nbsp;&nbsp;&nbsp;&nbsp;; ReturnLength<br/>&nbsp;&nbsp;&nbsp;&nbsp;push 0<br/>&nbsp;&nbsp;&nbsp;&nbsp;push 0<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ObjectAllTypeInformation<br/>&nbsp;&nbsp;&nbsp;&nbsp;push 0<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xNtQueryObject<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; make a tmp stack<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebp, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub esp, ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esi, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; ObjectInformationLength<br/>&nbsp;&nbsp;&nbsp;&nbsp;push 0<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ObjectAllTypeInformation<br/>&nbsp;&nbsp;&nbsp;&nbsp;push 0<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xNtQueryObject<br/>&nbsp;&nbsp;&nbsp;&nbsp;cld<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; NumberOfObjectsTypes<br/>&nbsp;&nbsp;&nbsp;&nbsp;lodsd<br/>&nbsp;&nbsp;&nbsp;&nbsp;xchg ecx, eax ; ecx = NumberOfObjectsTypes<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_DebugObject_NtQueryObject_Loop:&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; load string lengths<br/>&nbsp;&nbsp;&nbsp;&nbsp;lodsd<br/>&nbsp;&nbsp;&nbsp;&nbsp;movzx edx, ax<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; pointer to TypeName<br/>&nbsp;&nbsp;&nbsp;&nbsp;lodsd<br/>&nbsp;&nbsp;&nbsp;&nbsp;xchg esi, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; sizeof(L&#34;DebugObject&#34;)<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; avoids superstrings<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; like &#34;DebugObjective&#34;<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp edx, 16h<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_DebugObject_NtQueryObject_Tmp2<br/>&nbsp;&nbsp;&nbsp;&nbsp;xchg ecx, edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_DebugObject_NtQueryObject_Tmp1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_DebugObject_NtQueryObject_UnicodeStr1<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dw &#39;D&#39;,&#39;e&#39;,&#39;b&#39;,&#39;u&#39;,&#39;g&#39;<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dw &#39;O&#39;,&#39;b&#39;,&#39;j&#39;,&#39;e&#39;,&#39;c&#39;,&#39;t&#39;<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_DebugObject_NtQueryObject_UnicodeStr1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;repe cmpsb<br/>&nbsp;&nbsp;&nbsp;&nbsp;xchg ecx, edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_DebugObject_NtQueryObject_Tmp2<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; TotalNumberOfObjects<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp dword ptr [eax], edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_DebugObject_NtQueryObject<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; point to trailing&nbsp;&nbsp;null<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_DebugObject_NtQueryObject_Tmp2:<br/>&nbsp;&nbsp;&nbsp;&nbsp;add esi, edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; round down to dword<br/>&nbsp;&nbsp;&nbsp;&nbsp;and esi, -4<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; skip trailing null<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; and any alignment bytes<br/>&nbsp;&nbsp;&nbsp;&nbsp;lodsd<br/>&nbsp;&nbsp;&nbsp;&nbsp;loop FD_DebugObject_NtQueryObject_Loop<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>Exit_FD_DebugObject_NtQueryObject:<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; clear the tmp stack<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esp, ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>Found_FD_DebugObject_NtQueryObject:&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_DebugObject_NtQueryObject<br/>End_FD_DebugObject_NtQueryObject:<br/>此类方法，利用FindWindow函数通过寻找是否存在一些常见调试软件的Title。这里收集了一些<br/>如果有其他的Title,请朋友们告知。。。<br/><br/>代码:<br/>FD_Find_Debugger_Window:<br/>FD_Find_Debugger_Window_Arg_WinApi32&nbsp;&nbsp; equ 08h<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebp, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, dword ptr [ebp+FD_Find_Debugger_Window_Arg_WinApi32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_Str1<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;1212121&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_Str1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_Str2<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;icu_dbg&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_Str2:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_Str3<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;pe--diy&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_Str3:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window&nbsp;&nbsp;&nbsp;&nbsp; <br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_Str5<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;ollydbg&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_Str5:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window <br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_Str6<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;odbydyk&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_Str6:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_Str7<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;WinDbgFrameClass&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_Str7:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_Str8<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;TDeDeMainForm&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_Str8:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_Str9<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;TIdaWindow&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_Str9:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_StrA<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;TESTDBG&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_StrA:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_StrB<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;kk1&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_StrB:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_StrC<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;Eew75&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_StrC:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_StrD<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;Shadow&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_StrD:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br/>&nbsp;&nbsp; <br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_StrE<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;PEiD v0.94&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_StrE:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp; <br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_StrF<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;Registry Monitor - Sysinternals: www.sysinternals.com&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_StrF:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window&nbsp;&nbsp;&nbsp;&nbsp;<br/> <br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_Str10<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;File Monitor - Sysinternals: www.sysinternals.com&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_Str10:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window&nbsp;&nbsp;&nbsp;&nbsp;<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Window_Str11<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;Import REConstructor v1.6 FINAL (C) 2001-2003 MackT/uCF&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Window_Str11:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xFindWindowA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Debugger_Window<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp NotFound_Found_FD_Find_Debugger_Window<br/>Exit_FD_Find_Debugger_Window:<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esp, ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>NotFound_Found_FD_Find_Debugger_Window:<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Find_Debugger_Window<br/>Found_FD_Find_Debugger_Window:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Find_Debugger_Window&nbsp;&nbsp;&nbsp;&nbsp;<br/>End_FD_Find_Debugger_Window:<br/>这种方面的核心思想是比对在进程表中是否是出现了调试器进程名，如果出现则退出。<br/>不过这种方法很容易躲过，而且也可能造成误判。<br/><br/>代码:<br/>FD_Find_Debugger_Process:<br/>FD_Find_Debugger_Process_Arg_Win32Api&nbsp;&nbsp; equ 08h<br/>FD_Find_Debugger_Process_StackSize&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ 10h + sizeof PROCESSENTRY32<br/>FD_Find_Debugger_Process_hSnapshot&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ -04h<br/>FD_Find_Debugger_Process_hParnet&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ -08h<br/>FD_Find_Debugger_Process_pe32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; equ -(10+sizeof PROCESSENTRY32)<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebp, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;sub esp, FD_Find_Debugger_Process_StackSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;push esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; clear the stack<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;lea edi, [ebp-FD_Find_Debugger_Process_StackSize]<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;mov ecx, FD_Find_Debugger_Process_StackSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cld<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rep stosb<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, dword ptr [ebp+FD_Find_Debugger_Process_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea esi, [ebp+FD_Find_Debugger_Process_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume esi : ptr PROCESSENTRY32<br/>&nbsp;&nbsp;&nbsp;&nbsp;push sizeof PROCESSENTRY32<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop dword ptr [esi].dwSize<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push 0<br/>&nbsp;&nbsp;&nbsp;&nbsp;push TH32CS_SNAPPROCESS<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateToolhelp32Snapshot<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov dword ptr [ebp+FD_Find_Debugger_Process_hSnapshot], eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Find_Debugger_Process_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Find_Debugger_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xProcess32First<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz NotFound_FD_Find_Debugger_Process<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Process_Loop:<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [esi].szExeFile<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov edi, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Process_Str1<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;OLLYICE.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Process_Str1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_Find_Debugger_Process<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Process_Str2<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;IDAG.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Process_Str2:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_Find_Debugger_Process <br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Process_Str3<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;OLLYDBG.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Process_Str3:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_Find_Debugger_Process&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Process_Str4<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;PEID.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Process_Str4:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_Find_Debugger_Process&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Process_Str5<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;SOFTICE.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Process_Str5:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_Find_Debugger_Process<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Process_Str6<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;LORDPE.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Process_Str6:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_Find_Debugger_Process<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Process_Str7<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;IMPORTREC.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Process_Str7:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_Find_Debugger_Process<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Process_Str8<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;W32DSM89.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Process_Str8:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_Find_Debugger_Process&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Debugger_Process_Str9<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;WINDBG.EXE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Debugger_Process_Str9:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xlstrcmpiA<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_Find_Debugger_Process<br/>&nbsp;&nbsp;&nbsp;&nbsp;lea eax, [ebp+FD_Find_Debugger_Process_pe32]<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Find_Debugger_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xProcess32Next<br/>&nbsp;&nbsp;&nbsp;&nbsp;test eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz FD_Find_Debugger_Process_Loop<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp NotFound_FD_Find_Debugger_Process<br/>Exit_FD_Find_Debugger_Process:<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; close the Shotsnap handle<br/>&nbsp;&nbsp;&nbsp;&nbsp;push dword ptr [ebp+FD_Find_Debugger_Process_hSnapshot]<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCloseHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume esi : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esp, ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebp <br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>NotFound_FD_Find_Debugger_Process:<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Find_Debugger_Process<br/>Found_FD_Find_Debugger_Process:<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Find_Debugger_Process&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br/>End_FD_Find_Debugger_Process:<br/>这种方法通过打开一些调试软件加载到系统中驱动的句柄，从而判断是否有<br/>调试软件的存在。<br/><br/>代码:<br/>FD_Find_Device_Driver:<br/>FD_Find_Device_Driver_Arg_Win32Api&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;equ 08h<br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebp, esp<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;push esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;push edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov ebx, dword ptr [ebp+FD_Find_Device_Driver_Arg_Win32Api]<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; check softice on unknow system<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_ATTRIBUTE_NORMAL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push OPEN_EXISTING<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_SHARE_READ + FILE_SHARE_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push GENERIC_READ + GENERIC_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Device_Driver_Str1<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;\\.\SIWVID&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Device_Driver_Str1:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateFileA<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, INVALID_HANDLE_VALUE<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Device_Driver<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; check softice 4.05 on win2k<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_ATTRIBUTE_NORMAL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push OPEN_EXISTING<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_SHARE_READ + FILE_SHARE_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push GENERIC_READ + GENERIC_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Device_Driver_Str2<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;\\.\NTICE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Device_Driver_Str2:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateFileA<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, INVALID_HANDLE_VALUE<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Device_Driver<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; check softice on win9x<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_ATTRIBUTE_NORMAL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push OPEN_EXISTING<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_SHARE_READ + FILE_SHARE_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push GENERIC_READ + GENERIC_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Device_Driver_Str3<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;\\.\SICE&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Device_Driver_Str3:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateFileA<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, INVALID_HANDLE_VALUE<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Device_Driver&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; check softice on win9x<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_ATTRIBUTE_NORMAL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push OPEN_EXISTING<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_SHARE_READ + FILE_SHARE_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push GENERIC_READ + GENERIC_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Device_Driver_Str4<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;\\.\SIWDEBUG&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Device_Driver_Str4:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateFileA<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xGetLastError<br/>&nbsp;&nbsp;&nbsp;&nbsp;test al, 032h<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jz Found_FD_Find_Device_Driver<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; check regmon on win9x<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_ATTRIBUTE_NORMAL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push OPEN_EXISTING<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_SHARE_READ + FILE_SHARE_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push GENERIC_READ + GENERIC_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Device_Driver_Str5<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;\\.\REGVXD&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Device_Driver_Str5:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateFileA&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, INVALID_HANDLE_VALUE<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Device_Driver<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; check RegMON<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_ATTRIBUTE_NORMAL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push OPEN_EXISTING<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_SHARE_READ + FILE_SHARE_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push GENERIC_READ + GENERIC_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Device_Driver_Str6<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;\\.\FILEM&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Device_Driver_Str6:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateFileA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, INVALID_HANDLE_VALUE<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Device_Driver<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; check TRW<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_ATTRIBUTE_NORMAL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push OPEN_EXISTING<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_SHARE_READ + FILE_SHARE_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push GENERIC_READ + GENERIC_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Device_Driver_Str7<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;\\.\TRW&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Device_Driver_Str7:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateFileA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, INVALID_HANDLE_VALUE<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Device_Driver&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;;; check softice extender<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_ATTRIBUTE_NORMAL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push OPEN_EXISTING<br/>&nbsp;&nbsp;&nbsp;&nbsp;push NULL<br/>&nbsp;&nbsp;&nbsp;&nbsp;push FILE_SHARE_READ + FILE_SHARE_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;push GENERIC_READ + GENERIC_WRITE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call FD_Find_Device_Driver_Str8<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;db &#34;\\.\ICEEXT&#34;,0<br/>&nbsp;&nbsp;&nbsp;&nbsp;FD_Find_Device_Driver_Str8:<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCr&#101;ateFileA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;cmp eax, INVALID_HANDLE_VALUE<br/>&nbsp;&nbsp;&nbsp;&nbsp;jnz Found_FD_Find_Device_Driver <br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp NotFound_FD_Find_Device_Driver<br/>&nbsp;&nbsp;&nbsp;&nbsp;<br/>Exit_FD_Find_Device_Driver:&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edi<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop esi<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop edx<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ecx<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebx<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing&nbsp;&nbsp;&nbsp;&nbsp;<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov esp, ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;pop ebp<br/>&nbsp;&nbsp;&nbsp;&nbsp;retn 04h<br/>NotFound_FD_Find_Device_Driver:<br/>&nbsp;&nbsp;&nbsp;&nbsp;xor eax, eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Find_Device_Driver<br/>Found_FD_Find_Device_Driver:<br/>&nbsp;&nbsp;&nbsp;&nbsp;push eax<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : ptr WIN32APIBASE<br/>&nbsp;&nbsp;&nbsp;&nbsp;call dword ptr [ebx].xCloseHandle<br/>&nbsp;&nbsp;&nbsp;&nbsp;assume ebx : nothing<br/>&nbsp;&nbsp;&nbsp;&nbsp;mov eax, 1<br/>&nbsp;&nbsp;&nbsp;&nbsp;jmp Exit_FD_Find_Device_Driver<br/>End_FD_Find_Device_Driver:<br/>利用int3中断引起异