Checking the BeingDebugged member of PEB structure, Anti-Debugging, Checking for Debugger

I have just started code in assembly, this is a program to detect the presence of a debugger. Trying to compile it, i'm getting following error:

Here is the code, basically it checks the is debugger byte in PEB Structure:

Here, try this:

The error you were getting, was because you used the hexadecimal notation of C/C++ (where hexadecimal numbers are written such as 0x0AA) instead of ASM (where the same number would be written as 0AAh).

The error lies in the following line of the code you posted:

Besides that, you were passing literal strings instead of pointers to strings in your MessageBox calls...
The ADDR keyword, denotes that a pointer to the string is passed to the function...

This question does not pertain to WinAsm Studio.

In the future....

Please Post in the appropriate Forum.

EDIT

Thank you Samael. I would have moved the post but wanted to be certain Samjeba did not get confused.

I have also renamed this topic in accordance with new forum guidelines.

Sorry for wrong posting - SeaFarer

thanx for the help - samael

samjeba,

You are welcome.

As for the post being in the wrong forum: Actually i didn't notice this, else i would have made a remark. You see, we are working hard to check all topics and reorganizing the site.
So, keeping posting in the appropriate forums, would really help... ;)
For the time, i moved the topic to the "Newbies" Forum.

Now, as far as this method of detecting if you are running under a debugger, don't rely heavily on it. It's already well known ; besides, a call to IsDebuggerPresent API, executes _exactly_ the same code.

Also, this method is OS - dependent, because the PEB structure is not published / documented by Microsoft.
I guess it works on NT-based systems, but this may change in the future.

Anyway, here is a link that describes the PEB structure members...

http://undocumented.ntinternals.net/UserMo...rocess/PEB.html

As you can see, the code we are using in this example, checks the third member of the PEB structure: the BOOLEAN (byte) sized BeingDebugged.



If you are interested into anti-debugging, there are numerous methods to detect the presence of a ring-3 debugger...
For more information on the subject, check this link here:

http://www.openrce.org/reference_library/anti_reversing

Happy studying!

Thanks for the link, it's great!