Luckies "myIsDebuggerPresent" liefert immer true

[himitsu]

POP EAX würde das Result (welches ja in EAX liegt) überschreiben.

Delphi-Quellcode:

function MyIsDebuggerPresent: Boolean; 
var
  BeingDebugged: Boolean;
begin
  asm
    push eax
    push ebx
    mov eax, fs:[$18]
    mov ebx, [eax+$30]
    mov eax, [ebx+2]
    mov [BeingDebugged], al
    pop ebx
    pop eax
  end;
  Result := BeingDebugged;
end;

Delphi-Quellcode:

function MyIsDebuggerPresent: Boolean; assembler;
asm
  push ebx
  mov eax, fs:[$18]
  mov ebx, [eax+$30]
  mov eax, [ebx+2]
  pop ebx
end;

Delphi-Quellcode:

function MyIsDebuggerPresent: Boolean; assembler;
asm
  mov eax, fs:[$18]
  mov edx, [eax+$30]
  mov eax, [edx+2]
end;

function MyIsDebuggerPresent: Boolean; assembler;
asm
  mov eax, fs:[$18]
  mov eax, [eax+$30]
  mov eax, [eax+2]
end;