带有反调试代码的第三方库

Question

We are using a third party library for our program (desktop application written in c++), library is protected with anti-debug code, encryption/decryption layers, garbage code, triggered exceptions and other anti-debugging techniques which makes it impossible to work on debug mode (on Visual Studio 2010).

There are only two functions I use in the library, rest of the code is getting bigger and bigger but because I can not run it on debug mode it's getting harder and slower to develop. So my question is what could be a practical approach to separate this library from my application and work with debug support, but still be able to use these two functions, as we need them for our application.

Answer 1

如果仅使用受保护库中的少数函数，则可以使用与受保护库中相同的接口创建自己的库，并使用某些存根数据实现这些函数。

Answer 2

If you need to debug with the real behavior of your library (ie you cannot mock it up), I suggest you to encapsulate the library in a small executable that publish the two function through some kind of inter-process communication (ZeroMQ...).

In your software, implement a wrapper that publishes an interface that looks like the original library and calls the executable though your inter-process communication.

Since the library is in a distinct executable, it will not prevent you from debugging your program.