来源(白菜乐园)

From: http://www.crackbest.org/read.php?tid=17

.486
.model flat, stdcall
option casemap :none
include \masm32\include\windows.inc
include \masm32\include\masm32.inc
include \masm32\include\gdi32.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
include \masm32\include\shell32.inc
include \masm32\macros\macros.asm
includelib \masm32\lib\masm32.lib
includelib \masm32\lib\gdi32.lib
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\shell32.lib

.data
Caption db "Anti-Debug Example",0
MsgDetectIsDebug db "Debugger Detected via IsDebuggerPresent",0
MsgDetectPEB db "Debugger Detected via PEB!",0
MsgDetectNTGlobals db "Debugger Detected via NT Globals Flag", 0
MsgNone db "No Debugger Detected!",0

.code
start:
    ; # IsDebuggerPresent Method
    invoke IsDebuggerPresent
    test eax, eax
    jz TestPEB
    invoke MessageBoxA, NULL, ADDR MsgDetectIsDebug, ADDR Caption, MB_OK
TestPEB:
    ; # PEB Method
    assume fs:nothing
    mov eax, fs:[30h]
    mov eax, [eax+2]
    test al, al
    jz TestNtGlobals
    invoke MessageBoxA, NULL, ADDR MsgDetectPEB, ADDR Caption, MB_OK
    jmp TestNtGlobals
TestNtGlobals:
    assume fs:nothing
    mov eax, fs:[30h]
    mov eax, [eax+68h]
    and eax, 70h
    jz None
    invoke MessageBoxA, NULL, ADDR MsgDetectNTGlobals, ADDR Caption, MB_OK
    jmp Close
None:
    invoke MessageBoxA, NULL, ADDR MsgNone, ADDR Caption, MB_OK
Close:
    invoke ExitProcess, NULL
end start

Link: http://www.asm32.net/article_details.aspx?id=5234