mirror of
https://github.com/CheckPointSW/InviZzzible
synced 2026-06-08 10:35:43 +00:00
Alexey Bukhteyev
3e4e5a36f6
Vbox: added MAC address to be checked as means of detection VMware: added file names to be checked as means of detection VMware: added registry paths and values to be checked as means of detection VMware: added running processes to be checked as means of detection BOCHS: implementation of detection techniques using VEDetection interface Hyper-V: implementation of detection techniques using VEDetection interface JoeBox: implementation of detection techniques using VEDetection interface Parallels: implementation of detection techniques using VEDetection interface QEMU: implementation of detection techniques using VEDetection interface Sandboxie: implementation of detection techniques using VEDetection interface VirtualPC: implementation of detection techniques using VEDetection interface Wine: implementation of detection techniques using VEDetection interface Xen: implementation of detection techniques using VEDetection interface Miscellaneous sandboxes: implementation of detection techniques using VEDetection interface Added config for BOCHS evasions: checking registry Added config for Hyper-V evasions: checking registry, global objects in OS Added config for JoeBox evasions: checking registry, running processes Added config for Parallels evasions: checking filesystem, registry, firmware tables, running processes, global objects in OS Added config for QEMU evasions: checking registry, disk name Added config for Sandboxie evasions: checking registry, global objects in OS Added config for VirtualPC evasions: checking registry, firmware tables, disk name, running processes, global devices in OS Added config for Wine evasions: checking registry Added config for Xen evasions: checking registry, running processes Added config for miscellaneous VM and sandboxes evasions Generic: fixed bug in raw mouse activity check gitignore: updated
25 lines
446 B
C++
25 lines
446 B
C++
#ifndef _VIRTUALPC_H
|
|
#define _VIRTUALPC_H
|
|
|
|
#include "ve_detection.h"
|
|
|
|
namespace SandboxEvasion {
|
|
|
|
class VirtualPC : VEDetection {
|
|
public:
|
|
VirtualPC(const json_tiny &j) :
|
|
VEDetection(j) {
|
|
module_name = std::string("VIRTUALPC");
|
|
}
|
|
virtual ~VirtualPC() {}
|
|
|
|
static VEDetection* create_instance(const json_tiny &j);
|
|
|
|
// overriden
|
|
virtual void CheckAllCustom();
|
|
};
|
|
|
|
} // SandboxEvasion
|
|
|
|
#endif // ! _VIRTUALPC_H
|