008934a3b4
Initial work on the ATA IDENTIFY checks
...
Added the code needed to execute the ATA IDENTIFY command on a disk. Currently it dumps the data out via OutputDebugString.
2018-07-11 23:07:02 +01:00
7c5868b331
Merge pull request #119 from LordNoteworthy/disksize-ioctl-improvements
...
Improved disk size IOCTL checks
2018-07-11 19:03:01 +01:00
ccc56ed702
Improved disk size IOCTL checks
...
Previously we were only checking PhysicalDrive0 with the size IOCTL check, but on some systems PhysicalDrive0 might be associated with a single disk in a software RAID volume or an appliance boot volume. Such cases would be incorrectly flagged as a VM for being under 80GB in size. This new code instead finds the OS drive letter, maps that to a set of physical disks, then sums the sizes. If anything goes wrong it falls back to the old method of just checking PhysicalDrive0.
2018-07-11 19:01:58 +01:00
3bb254c11f
Fixed reading disk size with WMI
...
Turns out that uint64 values in WMI are not actually in the llval or ullval fields, but instead get put into bstrVal. I used _tcstoui64_l to parse this string as a UINT64 to fix #111 .
2018-07-11 03:53:02 +01:00
709e1fbeee
Tidied up message text
...
Made messages more consistent in terms of how API names were displayed and where colons were inserted into check descriptions.
2018-07-10 20:08:46 +01:00
8a2f1e89a8
Added CreateWaitableTimer and CreateTimerQueueTimer checks.
...
These are basic checks for now. They just see if the API calls succeed or fail. In future we should probably use a secondary timing check alongside it to get a better idea about time acceleration.
2018-07-10 19:08:41 +01:00
a2aa0dc0d0
Merge pull request #113 from PolariumLabs/XPSupport
...
XP Support
2018-06-21 18:14:16 +02:00
e31d023496
Call GetProcAddress to obtain pointers to EnumSystemFirmwareTables and GetSystemFirmwareTable since they aren't available on XP.
2018-06-17 18:28:13 +03:00
bbf020b39b
Currently executing test now shows before completion.
...
The text used to appear after the check completed, along with the status. Now the text shows when the test starts executing, and the status appears when the check completes. This provides better UX for long-running tests.
2018-05-28 20:47:38 +01:00
4b71d41bdf
Added power capabilities checks.
...
The GetPwrCapabilities API can be used to test for certain power capabilities of the system. Most VMs don't support CPU power states S1-S4 or thermal control
2018-05-28 20:27:51 +01:00
59558e864a
Merge pull request #109 from LordNoteworthy/Noteworthy
...
Noteworthy
2018-04-30 18:41:41 +02:00
95bdebf55e
Update Win32_Computersystem WMI anti-VM check (Model) to include Xen, (Manufacturer) to include VBox and Xen
2018-04-30 18:39:02 +02:00
8308255641
Added Anti-VM check using WMI (Select ProcessorId from Win32_Processor) used by (GravityRAT)
2018-04-30 13:12:24 +02:00
21a8da4ce6
Check if process have admin rights in MSAcpi_ThermalZoneTemperature check
2018-04-30 10:55:36 +02:00
b0e4be30e2
Merge pull request #108 from LordNoteworthy/Noteworthy
...
Noteworthy
2018-04-27 21:29:44 +02:00
a175d18320
Added Anti-VM check for current CPU temperature using WMI (Select CurrentTemperature from MSAcpi_ThermalZoneTemperature) used by (GravityRAT)
2018-04-27 21:26:42 +02:00
8cb2ffc1e6
Added Anti-VM check which look for MAC address (Paralles and Xen) used by (GravityRAT)
2018-04-27 13:06:46 +02:00
c8e52d9e91
Added Anti-VM check using WMI (Select Model/Manufacturer from Win32_ComputerSystem) used by (GravityRAT)
2018-04-27 11:34:07 +02:00
bf699607e4
Added Anti-VM check using WMI (Select SerialNumber from Win32_BIOS) used by (GravityRAT)
2018-04-27 10:44:50 +02:00
6628e55729
Added Hyper-V/VirtualPC anti-VM checks (GravityRAT)
2018-04-27 10:10:56 +02:00
213245f57d
Merge pull request #107 from LordNoteworthy/Noteworthy
...
Added firmware table checks SMBIOS and ACPI (Qemu)
2018-04-24 19:12:39 +02:00
9cec4b4d76
compile new binaries
2018-04-24 19:12:23 +02:00
135e50f313
Added firmware table checks SMBIOS and ACPI (Qemu)
2018-04-24 19:09:54 +02:00
cfa5422a6f
Merge pull request #106 from LordNoteworthy/Noteworthy
...
added qemu process check (qemu-ga.exe)
2018-04-24 04:55:40 +02:00
338857ebee
added qemu process check (qemu-ga.exe)
2018-04-23 20:26:06 +02:00
af9d45ea9c
Merge pull request #104 from LordNoteworthy/Noteworthy
...
Noteworthy
2018-03-14 21:54:41 +01:00
c5f3a5bcb0
compile new binaries
2018-03-14 21:52:08 +01:00
a329f854e9
add some macros to enable/disable category for checks to easy debugging
2018-03-14 21:47:50 +01:00
daf7077dc0
add anti-vm check for vmware using system firmware tables
2018-03-14 21:41:44 +01:00
3ffac7439a
Merge pull request #103 from LordNoteworthy/Noteworthy
...
Noteworthy
2018-02-28 20:32:10 +01:00
57b179752f
bump version to 0.73
2018-02-28 20:31:02 +01:00
98559d3fbb
GetSystemFirmwareTable should take (resultBufferSize) as an argument for the second call
2018-02-28 20:17:14 +01:00
fc694d07fe
Add more checks for VMware related processes
2018-02-28 20:09:27 +01:00
1179c52761
Add checks for VMware related files
2018-02-28 20:06:26 +01:00
9611c7d55f
add two regsitry key values check for VMWare
2018-02-28 19:48:25 +01:00
98b1ceb172
add more laoded dlls check: avghookx, avghooka, snxhk
2018-02-28 19:44:48 +01:00
b05361997d
Merge pull request #102 from gsuberland/write-watch
...
Vastly improved VirtualAlloc write watch tests
2018-01-30 05:06:57 +01:00
f8dd8c04f5
Vastly improved VirtualAlloc write watch tests, particularly in the API test cases.
2018-01-26 18:57:05 +00:00
859651e837
Merge pull request #101 from gsuberland/write-watch
...
Memory write watch anti-debug
2018-01-26 18:49:16 +01:00
d5e695c5d1
Merge pull request #100 from gsuberland/services
...
VM driver service checks
2018-01-26 15:01:34 +01:00
14b1a5dce5
Added memory write watching to readme.
2018-01-24 23:34:16 +00:00
ee92ff820b
Added driver services to readme
2018-01-24 22:48:08 +00:00
51685610f5
Add write watch debugger detection
...
Detects external memory accesses by debuggers and hooks using the
MEM_WRITE_WATCH feature of VirtualAlloc, using 4 different approaches.
2018-01-24 22:46:06 +00:00
660669dfd3
Add checks for VM related services.
...
Service checks are useful for identifying common VMs.
2018-01-24 21:20:29 +00:00
2835f8ca59
Actually return when DLL / API isn't found properly in timing check
...
Forgot to put returns in there, whoops.
2018-01-24 21:16:02 +00:00
49dbcaa46d
Fix nullref exception in timing.cpp
...
Previously we ignored cases where ntdll wasn't found or the EP for
NtDelayExecution wasn't found, but these can occur if the process is
sandboxed and the LoadLibrary / GetProcAddress calls are filtered. As
such it's worth checking for NULL and reporting the problem.
2018-01-24 21:13:40 +00:00
57b5511828
Merge remote-tracking branch 'refs/remotes/LordNoteworthy/master' into firmware-checks
2018-01-24 20:56:03 +00:00
9345ebf981
Merge pull request #96 from LordNoteworthy/Noteworthy
...
Noteworthy
2018-01-05 09:53:29 +01:00
439ca6ccd5
Bug fix: ascii_to_wide_str() wrong argument
2017-12-19 18:33:43 +01:00
2a0521f927
fix bug: array with duplicate strings
2017-12-19 17:24:57 +01:00
Graham Sutherland