http://www.kernelmode.info/forum/viewto ... =99&p=6804
+ this script-kiddie code which shows most of principles.
Code: Select allunit AntiUnit;
// Information ~
// This unit is officially made by SaTaX
// You can contact me at satax@live.be
// August 2009 - > Thanks for some Opensc.ws Snippets (like the Assembler codes ^^.
// Please leave credits here if you use this unit.
// Thank You.
// Credits: SaTaX ~ Opensc.Ws !
interface
Uses
Windows,TlHelp32,SysUtils,Classes;
function processExists(exeFileName: string): Boolean;
function IsUsername(username: string): Boolean;
function ModuleCheck(comp: string) :Boolean;
function DebuggerPresent : boolean;
function InVMware: Boolean;
function IsInVPC: boolean; assembler;
Function CheckAnti: Boolean;
implementation
function processExists(exeFileName: string): Boolean;
var
ContinueLoop: BOOL;
FSnapshotHandle: THandle;
FProcessEntry32: TProcessEntry32;
begin
FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
FProcessEntry32.dwSize := SizeOf(FProcessEntry32);
ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32);
Result := False;
while Integer(ContinueLoop) <> 0 do
begin
if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile)) =
UpperCase(ExeFileName)) or (UpperCase(FProcessEntry32.szExeFile) =
UpperCase(ExeFileName))) then
begin
Result := True;
end;
ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32);
end;
CloseHandle(FSnapshotHandle);
end;
function IsUsername(username: string): Boolean;
var
szUserName : PChar;
dwUserNameSize : DWORD;
begin
szUserName := AllocMem(MAX_PATH);
dwUserNameSize := MAX_PATH;
GetUserName(szUserName,dwUserNameSize);
Result := false;
If szUserName = username Then
begin
Result := true;
end;
end;
function ModuleCheck(comp: string) :Boolean;
var
i:integer;
begin
result:=false;
for i:= 0 to 3 do
begin
if (GetModuleHandle(PChar(comp))<>0) then
result:=true;
end;
end;
function DebuggerPresent : boolean;
type
TDebugProc = function : boolean;
stdcall;
var
Kernel32: HMODULE;
DebugProc: TDebugProc;
begin
Result := False;
Kernel32 := GetModuleHandle('kernel32');
if Kernel32<>0 then
begin
@DebugProc := GetProcAddress(Kernel32, 'IsDebuggerPresent');
if Assigned(DebugProc) then
Result := DebugProc
end;
end;
function InVMware: Boolean;
asm
XOR EAX, EAX
PUSH OFFSET @@Handler
PUSH DWORD PTR FS:[EAX]
MOV DWORD PTR FS:[EAX], ESP
MOV EAX, 564D5868h
MOV EBX, 3c6cf712h
MOV ECX, 0Ah
MOV DX, 5658h
IN EAX, DX
MOV EAX, True
JMP @@NotHandle
@@Handler:
MOV EAX, [ESP+$C]
MOV TContext(EAX).EIP, OFFSET @@Handled
XOR EAX, EAX
RET
@@Handled:
XOR EAX, EAX
@@NotHandle:
XOR EBX, EBX
POP DWORD PTR FS:[EBX]
ADD ESP, 4
end;
function IsInVPC: boolean; assembler;
asm
push ebp
mov ecx, offset @@exception_handler
mov ebp, esp
push ebx
push ecx
push dword ptr fs:[0]
mov dword ptr fs:[0], esp
mov ebx, 0
mov eax, 1
db 00Fh, 03Fh, 007h, 00Bh
mov eax, dword ptr ss:[esp]
mov dword ptr fs:[0], eax
add esp, 8
test ebx, ebx
setz al
lea esp, dword ptr ss:[ebp-4]
mov ebx, dword ptr ss:[esp]
mov ebp, dword ptr ss:[esp+4]
add esp, 8
jmp @@ret
@@exception_handler:
mov ecx, [esp+0Ch]
mov dword ptr [ecx+0A4h], -1
add dword ptr [ecx+0B8h], 4
xor eax, eax
ret
@@ret:
end;
Function CheckAnti: Boolean;
Var
Path:String;
begin
result:=false;
Path := ExtractFilePath(ParamStr(0));
if (processexists('joeboxcontrol.exe')) //JoeBox
or (processexists('joeboxserver.exe')) //Joebox 2
or (processexists('wireshark.exe')) // WireShark
or (processexists('regmon.exe')) //Regmon
or (processexists('filemon.exe')) //FileMon
or (processexists('procmon.exe')) //ProcMon
or (processexists('VBoxService.exe')) //Vbox
or (modulecheck('SbieDll.dll')) //Sandboxie
or (modulecheck('api_log.dll')) //SunBelt
or (modulecheck('dir_watch.dll')) //Sulbelt's Sandbox
or (IsUsername('username')) //ThreadExpert
or (IsUsername('USER')) //Sandbox
or (IsUsername('user')) //Sandbox 2
or (IsUsername('currentuser')) //Normal
or (Pos('c:\insidetm',Path)<> 0) //Anubis
or (DirEctoryExists('C:\analysis')) // Sunbelt 3
or (DeBuggerPresent=true) //Debuggers
or (InVmWare=True) //VmWare
or (IsInVPC=True)
then
result:=true
end;
end.
Properly configured VM's with hardware support can't be detected by 99.9% ITW malware, so your developing has no sense. Everything already in a place.
