#include <windows.h>
#include <iostream>

// TLS回调函数定义
void NTAPI TLS_Callback(PVOID DllHandle, DWORD Reason, PVOID Reserved) {
    if (Reason == DLL_PROCESS_ATTACH) {
        // 检测是否存在调试器
        if (IsDebuggerPresent()) {
            std::cout<<"Debugger detected!\n";
            ExitProcess(1);  // 如果检测到调试器则退出
        } else {
            std::cout<<"No debugger detected.\n";
        }
    }
}

// 声明TLS回调函数
#ifdef _MSC_VER
#pragma const_seg(".CRT$XLB")
EXTERN_C const PIMAGE_TLS_CALLBACK pTLS_CALLBACK = TLS_Callback;
#pragma const_seg()
#else
__attribute__((section(".CRT$XLB"))) PIMAGE_TLS_CALLBACK pTLS_CALLBACK = TLS_Callback;
#endif


int main() {
    std::cout<<"Program started.\n";
    return 0;
}

#include <windows.h>
#include <tlhelp32.h>
#include <iostream>
#include <string>

// 检查是否存在指定的调试器进程
bool IsDebuggerProcessRunning() {
    const char* debuggerNames[] = { "ollydbg.exe", "x64dbg.exe", "ida.exe", "windbg.exe" };

    // 创建进程快照
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnapshot == INVALID_HANDLE_VALUE) {
        return false;
    }

    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(PROCESSENTRY32);

    // 遍历进程列表
    if (Process32First(hSnapshot, &pe32)) {
        do {
            // 遍历已知的调试器名称
            for (const auto& debuggerName : debuggerNames) {
                // 将进程名转换为小写以进行匹配
                std::string processName = pe32.szExeFile;
                for (auto& c : processName) c = tolower(c);

                if (processName == debuggerName) {
                    CloseHandle(hSnapshot);
                    return true;  // 找到匹配的调试器进程
                }
            }
        } while (Process32Next(hSnapshot, &pe32));
    }

    CloseHandle(hSnapshot);
    return false;  // 未找到调试器进程
}

int main() {
    if (IsDebuggerProcessRunning()) {
        std::cout << "Debugger process detected! Exiting...\n";
        ExitProcess(1);  // 检测到调试器，退出程序
    } else {
        std::cout << "No debugger detected.\n";
    }

    // 正常程序逻辑
    std::cout << "Program is running.\n";
    return 0;
}

#include <windows.h>
#include <iostream>

// 定义要检查的调试器窗口名称
const char* debuggerWindowNames[] = {
    "OllyDbg",  "x64dbg", "IDA", "WinDbg"
};

// 枚举系统中所有窗口，查找是否有调试器窗口存在
BOOL CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam) {
    char windowTitle[256];
    GetWindowTextA(hwnd, windowTitle, sizeof(windowTitle));

    // 遍历已知的调试器窗口名称
    for (const auto& debuggerWindowName : debuggerWindowNames) {
        if (strstr(windowTitle, debuggerWindowName)) {
            std::cout << "Debugger window detected: " << windowTitle << "\n";
            return FALSE;  // 找到调试器窗口，停止枚举
        }
    }

    return TRUE;  // 继续枚举其他窗口
}

// 检查是否存在调试器窗口
bool IsDebuggerWindowOpen() {
    return !EnumWindows(EnumWindowsProc, 0);
}

int main() {
    if (IsDebuggerWindowOpen()) {
        std::cout << "Debugger window detected! Exiting...\n";
        ExitProcess(1);  // 检测到调试器窗口，退出程序
    } else {
        std::cout << "No debugger window detected.\n";
    }

    std::cout << "Program is running.\n";
    return 0;
}

#include <windows.h>
#include <iostream>

int main() {
    DWORD time1 = GetTickCount();
    int result, a = 1, b = 2;
    __asm(
            "movl %1, %%ebx\n\t"
            "addl %%ebx, %0"
            : "=r" (result)
            : "r" (b), "0" (a)
            );
    DWORD time2 = GetTickCount();
    if(time2-time1>0x10)
        ExitProcess(0);
    std::cout << "Program started.\n";
    std::cout << result;
    return 0;
}

#include <iostream>
#include <windows.h>

int main() {
    // 保存原来的EFLAGS寄存器值
    unsigned int eflags;

    __asm {
        pushfd                   // 将EFLAGS压入栈中
        pop eax                  // 将栈顶的EFLAGS值弹出到EAX寄存器
        mov eflags, eax          // 保存EFLAGS寄存器到eflags变量
        or eax, 0x100            // 设置TF（Trap Flag）位为1，启用单步调试模式
        push eax                 // 将修改后的EFLAGS值压回栈
        popfd                    // 恢复EFLAGS寄存器，使Trap Flag生效
    }

    // 执行单步调试后检测
    __asm {
        nop                      // 一个空操作，用于单步执行检测
        pushfd                   // 将当前的EFLAGS寄存器值压入栈
        pop eax                  // 弹出EFLAGS到EAX
        mov eflags, eax          // 保存当前的EFLAGS值
    }

    // 检测Trap Flag是否被清除（如果有调试器在调试，该标志可能被复位）
    if (eflags & 0x100) {
        std::cout << "No debugger detected (TF still set)." << std::endl;
    } else {
        std::cout << "Debugger detected (TF cleared)." << std::endl;
        ExitProcess(0);           // 检测到调试器，退出程序
    }

    std::cout << "Program continues running..." << std::endl;
    return 0;
}