Madmouse

arm breakpoint detection, standard mode

Jan 31st, 2015
272
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 1.12 KB | None | 0 0
  1. /*
  2.  
  3. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  4. @ Arm / Thumb Anti debugging 101  @
  5. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  6.  
  7. .section .text
  8. .global scan
  9.  
  10. @ scan(void* code, unsigned int depth);
  11. scan:
  12.     .code 32
  13.     ldr r3, =0xE7F00000 @ load breakpoint constant
  14.     ldr r4, =0xFFFF0000 @ mask
  15. loop:
  16.     ldr r2, [r0]    @ load byte code into r2
  17.     and r2, r4  @ clear out extra data in bytecode with mask
  18.     cmp r2, r3  @ is it a breakpoint?
  19.     beq fuck    @ if so FUCK
  20.     cmp r1, #0  @ are we at the end?
  21.     beq safe    @ if so we are safe
  22.     sub r1, #1  @ decrement the counter
  23.     add r0, #1  @ increment our pointer
  24.     bne loop    @ if we are still looping, loop
  25. safe:
  26.     mov r0, #0  @ return false
  27.     mov r1, r0
  28.     bx lr
  29. fuck:
  30.     mov r0, #0x1    @ return true
  31.     mov r1, #0
  32.     bx lr
  33.  
  34.  
  35.  
  36. */
  37.  
  38. bool scan(void (*fun), unsigned int depth)  /// scans a section of a function for break points
  39. {
  40.     int i;
  41.     unsigned int inst;
  42.     for(i=0;i<=depth;i+=sizeof(inst))   /// count from offset start to depth
  43.     {
  44.         inst = (*(volatile unsigned int *)((unsigned int)fun + i) & 0xffff0000)>>16;
  45.         if (inst == 0xE7F0) /// if this is a break point
  46.             return true;    /// return true
  47.     }
  48.     return false;
  49. }
Advertisement
Add Comment
Please, Sign In to add comment