如何用Windbg调试禁止使用调试器的程序

1. 运行目标程序，用Windbg关联上该进程，或者直接从Windbg中运行该程序

2. 切换到0号线程：

~0s

3. 修改进程是否附加调试器的标志：

0:000> dd fs:18:30
0018:00000030 7ffd9000 00000000 00000000 00000000
0018:00000040 fbed29f8 00000000 00000000 00000000
0018:00000050 00000000 00000000 00000000 00000000
0018:00000060 00000000 00000000 00000000 00000000
0018:00000070 00000000 00000000 00000000 00000000
0018:00000080 00000000 00000000 00000000 00000000
0018:00000090 00000000 00000000 00000000 00000000
0018:000000a0 00000000 00000000 00000000 00000000
0:000> db 7ffd9000
7ffd9000 00 00 01 08 ff ff ff ff-00 00 37 00 00 5d a6 77

7ffd9010 d0 11 23 00 00 00 00 00-00 00 23 00 a0 54 a6
7ffd9020 00 00 00 00 00 00 00 00-00 00 00 00 60 40 3e 76
7ffd9030 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
7ffd9040 30 53 a6 77 ff ff 3f 00-00 00 00 00 00 00 6f 7f
7ffd9050 00 00 00 00 88 05 6f 7f-00 00 fa 7f 00 00 fa 7f
7ffd9060 24 00 fd 7f 02 00 00 00-00 04 00 00 00 00 00 00
7ffd9070 00 80 9b 07 6d e8 ff ff-00 00 10 00 00 20 00 00
0:000> eb 7ffd9002 0
0:000> db 7ffd9000
7ffd9000 00 00 00 08 ff ff ff ff-00 00 37 00 00 5d a6 77
7ffd9010 d0 11 23 00 00 00 00 00-00 00 23 00 a0 54 a6 77
7ffd9020 00 00 00 00 00 00 00 00-00 00 00 00 60 40 3e 76
7ffd9030 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
7ffd9040 30 53 a6 77 ff ff 3f 00-00 00 00 00 00 00 6f 7f
7ffd9050 00 00 00 00 88 05 6f 7f-00 00 fa 7f 00 00 fa 7f
7ffd9060 24 00 fd 7f 02 00 00 00-00 04 00 00 00 00 00 00
7ffd9070 00 80 9b 07 6d e8 ff ff-00 00 10 00 00 20 00 00

0:000> g