8) ntdll!RtlpBreakPointHeap()

---

; __stdcall RtlpBreakPointHeap(x) _RtlpBreakPointHeap@4 proc near

arg_0= dword ptr 4

mov eax, large fs:18h               ; +0x018 Self : Ptr32 _NT_TIB，指向_TEB
mov eax, [eax+30h]                  ; +0x030 ProcessEnvironmentBlock : Ptr32 _PEB
cmp byte ptr [eax+2], 0             ; +0x002 BeingDebugged : UChar
                                    ;
                                    ; if ( FALSE == _PEB.BeingDebugged )
                                    ; {
                                    ;     goto RtlpBreakPointHeap_exit
                                    ; }
jz  short RtlpBreakPointHeap_exit
mov eax, [esp+arg_0]                ; EAX现在等于第一形参
mov _RtlpHeapInvalidBreakPoint, 1
mov _RtlpHeapInvalidBadAddress, eax
call near ptr _DbgBreakPoint@0      ; from XP DDK
                                    ;
                                    ; /*
                                    ;  * breaks into the kernel debugger
                                    ;  */
                                    ; VOID NTAPI DbgBreakPoint
                                    ; (
                                    ;     VOID
                                    ; );
mov _RtlpHeapInvalidBreakPoint, 0

RtlpBreakPointHeap_exit: retn 4 _RtlpBreakPointHeap@4 endp

---

---

/ * 这是ntdll.dll中定义的两个全局变量 / extern BOOL RtlpHeapInvalidBreakPoint; extern PVOID RtlpHeapInvalidBadAddress;

void __stdcall RtlpBreakPointHeap ( PVOID addr ) { if ( _PEB.BeingDebugged ) { RtlpHeapInvalidBreakPoint = TRUE; RtlpHeapInvalidBadAddress = addr; / * from XP DDK * * breaks into the kernel debugger * * 如果在target上安装了kd一类的调试器，将"陷入"。 / DbgBreakPoint(); RtlpHeapInvalidBreakPoint = FALSE; } return; } / end of RtlpBreakPointHeap /

---