【安全加密】反调试：调试器附加的检测与对抗

local function checkDebugger()
    local suspicious = false
    local markers = { "ida", "x64dbg", "ollydbg", "cheatengine" }
    local processList = getProcessList()
    for _, proc in ipairs(processList) do
        for _, marker in ipairs(markers) do
            if string.find(string.lower(proc), marker) then
                suspicious = true
            end
        end
    end
    return suspicious
end
setontimerex(230, 30)
function ontimer230()
    if checkDebugger() then
        sendcentermsg("检测到异常环境，即将退出")
        os.exit(1)
    end
end

local WHITELIST = { "sandbox", "vmware", "virtualbox" }
local function isWhitelisted(procName)
    for _, w in ipairs(WHITELIST) do
        if string.find(string.lower(procName), w) then
            return true
        end
    end
    return false
end
local function smartCheck()
    local processList = getProcessList()
    for _, proc in ipairs(processList) do
        if not isWhitelisted(proc) and checkDebugger() then
            setsysvarex("DBG_FLAG", os.time(), 1)
            sendmail("#安全组", 960, "调试器检测告警",
                "发现调试进程，已写入安全日志", "")
        end
    end
end