Files
chkp-aliaksandrt 010106480d KVM: CPU Hypervisor and Vendor IDs check has been implemented
Generic: BigRamAlloc has been added - tries to allocate big amount of RAM
Generic: UserInputActivity has been added - evasion which utilizes `GetLastInputInfo` API function
Generic: DiskEnum Registry Key chech has been added - checks `System\CurrentControlSet\Services\Disk\Enum` reg key for value `0`=`*virtual`
Generic: Sandbox-like filename check has been added - checks if current file has any of the following patterns in its path: `C:\SELF.EXE`, `.*self\.*`, `.*sample.*`, `.*sandbox.*`, `.*virus.*`, `.*malware.*`
Generic: Processes of AV and research tools check has been added - checks if any of the following processes are running: `avgui.exe`, `avastsvc.exe`, `avastui.exe`, `procmon.exe`, `procmon64.exe`, `procexp.exe`, `procexp64.exe`, `ollydbg.exe`, `windbg.exe`, `avp.exe`, `bdagent.exe`, `bdwtxag.exe`, `dwengine.exe`
Generic: Max Processes number check has been added (disabled)
Generic: Process with a long name check has been added
Hyper-V: CPU HypervisorID check has been added
Parallels: CPU HypervisorID check has been added
QEMU: QEMU DiskEnum Registry Key has been added
Sandboxie: Injected sbiedll module check has been added
VMware: VMWare DiskEnum Registry Key check has been added
Xen: CPU VendorID check has been added
Xen: CPU HypervisorID check has been added
Xen: DiskEnum Registry Key check has been added
Some build warnings have been fixed
2019-01-02 17:45:51 +03:00

33 lines
593 B
C++

#include "json.h"
json_tiny* json_tiny::load(const char *pfn) {
pt::ptree jroot;
try {
pt::read_json(pfn, jroot);
return new(std::nothrow) json_tiny(jroot);
}
catch (const pt::json_parser::json_parser_error &) {
return nullptr;
}
}
json_tiny* json_tiny::load(std::stringstream &ss) {
pt::ptree jroot;
try {
pt::read_json(ss, jroot);
return new(std::nothrow) json_tiny(jroot);
}
catch (const pt::json_parser::json_parser_error &) {
return nullptr;
}
}
bool json_tiny::dump(const json_tiny &, const char *pfn) {
// FIXME: implement do we need it???
return true;
}