Commit Graph

Select branches

Hide Pull Requests

Haimasker

ata-identify

feat/ayoubfaouzi

hook-checks

master

noteworthy

wudf-debugger-checks

#1

#10

#100

#101

#102

#103

#104

#106

#107

#108

#109

#11

#113

#116

#117

#119

#12

#122

#127

#13

#131

#135

#136

#137

#137

#138

#14

#143

#147

#148

#15

#150

#153

#158

#159

#16

#160

#161

#162

#163

#165

#166

#169

#17

#170

#171

#173

#174

#176

#177

#179

#18

#182

#183

#184

#19

#194

#196

#197

#199

#2

#20

#200

#204

#205

#206

#207

#208

#21

#210

#212

#215

#217

#219

#22

#220

#221

#224

#226

#23

#235

#236

#238

#239

#24

#240

#241

#243

#244

#245

#246

#248

#248

#25

#252

#253

#255

#26

#261

#262

#263

#264

#265

#267

#268

#269

#27

#270

#271

#273

#274

#275

#279

#28

#282

#284

#285

#286

#287

#288

#289

#29

#291

#292

#293

#294

#294

#295

#295

#298

#299

#3

#30

#300

#301

#302

#302

#303

#304

#305

#306

#308

#31

#310

#311

#32

#33

#35

#36

#37

#38

#39

#4

#40

#41

#42

#43

#44

#45

#46

#48

#5

#50

#51

#52

#53

#54

#55

#56

#58

#59

#6

#60

#61

#62

#63

#64

#65

#66

#67

#68

#7

#70

#71

#72

#73

#74

#75

#78

#8

#80

#81

#82

#83

#85

#88

#89

#9

#90

#91

#92

#96

#99

v1.0.0

v1.1.0

Mono Color

• 513d42e91c Bump AButler/upload-release-assets from 3.0 to 4.0 (#311) master dependabot[bot] 2026-06-02 15:58:09 +01:00
• 58d87cc837 Bump microsoft/setup-msbuild from 2.0.0 to 3.0.0 (#310) dependabot[bot] 2026-04-01 09:49:24 +01:00
• 68c6a2b903 Bump actions/upload-artifact from 6 to 7 (#308) dependabot[bot] 2026-03-01 15:40:57 +00:00
• 59be27488f Bump microsoft/setup-msbuild from 1.1.3 to 2.0.0 (#305) dependabot[bot] 2026-02-01 06:00:24 +01:00
• cb4e09a901 Bump actions/checkout from 2 to 6 (#304) dependabot[bot] 2026-02-01 05:59:58 +01:00
• 0d417859f8 Bump actions/upload-artifact from 4 to 6 (#303) dependabot[bot] 2026-02-01 05:59:42 +01:00
• 490f270897 Fix for VirtualBox checks: add VariantInit(&vtProp) to ensure safe VARIANT initialization (#301) Igor Korkin 2026-01-30 13:37:07 +03:00
• ad38d05ff9 format all header files feat/ayoubfaouzi Ayoub Faouzi 2026-01-27 12:47:54 +01:00
• c69803d4a4 format all cpp files Ayoub Faouzi 2026-01-27 12:43:48 +01:00
• 52835e985a fix gitattributes Ayoub Faouzi 2026-01-27 12:41:25 +01:00
• 2071476a7b chore: upgrade clang-format and editorconfig Ayoub Faouzi 2026-01-27 12:39:29 +01:00
• a3da959eb0 chore: update changelog, bump version Ayoub Faouzi 2026-01-27 12:11:38 +01:00
• 6d64536545 fix: Qemu ACPI firmware string check logic is backwards (#300) v1.1.0 Ayoub Faouzi 2026-01-26 19:02:49 +01:00
• bcff49773e Fix Windows license check: use WMI to get the detailed status (#298) Igor Korkin 2026-01-26 21:02:36 +03:00
• 04f04e45af fix: Qemu ACPI firmware string check logic is backwards Ayoub Faouzi 2026-01-26 18:44:33 +01:00
• 7e01b3029e ci: add dependabot workflow for automatically updating github actions (#299) Ayoub Faouzi 2026-01-26 18:38:32 +01:00
• f27424dcc0 Parametrized --sleep/--delay seconds. Added -h/--help. (#293) RazviOverflow 2025-07-14 12:30:40 +02:00
• aa9150da49 Add .clang-format file; fix ldt test for x64; remove an unused local variable (#292) Igor Korkin 2025-07-14 13:26:04 +03:00
• 494f421720 fix build warnings and apply code style (#291) Igor Korkin 2025-06-27 12:04:45 +03:00
• c060253474 Added some important analysis processes (#289) Zakariaa 2025-04-23 20:26:34 +01:00
• 9510abd979 Implement advanced ACPI scan for generic sandbox & QEMU (#288) dmfrpro 2025-04-21 22:59:55 +03:00
• 623b75227a Looking Glass, VirtualDisplayDriver & PCI VID scan VM detection methods (#287) dmfrpro 2025-04-14 03:16:26 +03:00
• 2b78990b04 Added goto cleanup and fixed conflict (#285) Zakariaa 2025-04-02 02:25:37 +00:00
• 0ff4088b14 Add check for WAET ACPI table presence (#284) dmfrpro 2025-04-01 23:11:49 +03:00
• 8808859d8c Fixed NtSystemDebugControl STATUS_NOT_IMPLEMENTED cases (#279) Asteria 2025-01-12 09:57:05 +09:00
• b4d1e5af16 Add ollyice.exe, dedup joeboxserver.exe (#275) xtex 2024-10-07 05:46:25 +08:00
• 680b623e8a Build and attach binaries on release (#274) v1.0.0 Patrick Evans 2024-09-21 20:00:22 -05:00
• 967afa0d78 Fix incorrect comparison when counting smbios tables (#271) CyberGreg05 2024-03-19 00:51:23 +03:00
• 3878b27e21 Working with a mounted flash drive (#270) CyberGreg05 2024-03-19 00:50:54 +03:00
• 1f7c4a6309 Checking the virtual machine through the number of SMBIOS tables (#267) CyberGreg05 2024-02-17 02:00:33 +03:00
• d028a0eba6 Spelling cleanup (#268) iamjplant 2024-02-16 17:25:22 -05:00
• 1879863556 Fix missing variable declaration in WaitForMultipleObjects check Graham Sutherland 2024-02-04 20:21:41 +00:00
• 0c22e74e36 Added WaitForMultipleObjects and Frida processes (#265) Fra-SM 2024-01-16 01:18:41 +01:00
• 0f31a3866b Add cheat engine for anti-analysis (#264) xmaple555 2023-10-30 17:35:17 +08:00
• 124f9c9f46 Update README.md (#262) Duncan Ogilvie 2023-09-06 22:49:43 +02:00
• 4532cb7ab1 Added Al-Khaser console parameters for test enabling (#261) Denis Melnikov 2023-08-25 14:19:47 +03:00
• f7aa921571 revert platform toolset to v143, and delete appveyor.yml Haimasker LordNoteworthy 2023-08-10 07:14:08 +10:00
• 701ccb792a Added Al-Khaser console parameters for test enabling Haimasker 2023-08-03 13:36:03 +03:00
• c7642a1672 Update timing.cpp (#255) SleekZ 2023-01-01 16:00:01 +11:00
• 0cf44d9b83 Update Al-khaser.cpp (#253) hasdhuahd 2022-12-07 17:28:04 +09:00
• 6cd41fa690 Add NtSystemDebugControl anti-dbg (#252) Stephen Eckels 2022-11-04 17:18:46 -04:00
• 926e611806 parent process hijacking (CreateProcess/ProcThreadAttribute) noteworthy LordNoteworthy 2022-01-07 21:41:43 +11:00
• bed03d2f84 Bugfix + new anti-disassembly technique (#245) Fulvio di Girolamo 2021-10-20 15:28:34 +02:00
• d3efb3f5d6 Merge pull request #246 from hasherezade/vs2019_fix Noteworthy 2021-10-17 11:00:55 +11:00
• da94a0a60b Bugfix: fixed building with VS2019 hasherezade 2021-10-15 01:37:37 -07:00
• be948e0813 Merge pull request #244 from LordNoteworthy/virtio Noteworthy 2021-09-14 14:44:04 +10:00
• f2b026a49c Add KVM virtio reg keys, files and dir and QEMU dirs LordNoteworthy 2021-09-14 14:38:22 +10:00
• 06d4a89e9e Add Hyper-V object checks. Graham Sutherland 2021-07-10 00:46:28 +01:00
• a4442a5648 Merge pull request #240 from graysuit/master Noteworthy 2021-07-06 20:56:08 +10:00
• 7f9bb0b15a This will build and upload binaries Gray Programmerz 2021-07-06 14:34:43 +05:00
• 66c0a8a429 Merge pull request #238 from LordNoteworthy/scan_for_modules_improvements Graham Sutherland 2021-06-13 01:55:27 +01:00
• d727738c85 Fix ScanForModules_MemoryWalk_Hidden and add new .NET structure scan. Graham Sutherland 2021-06-12 20:46:51 +01:00
• 7b78e61610 Merge pull request #236 from LordNoteworthy/parentprocess-improvement Noteworthy 2021-06-12 14:07:26 +10:00
• aafb419cbf Improve parent process check to avoid false positives. Graham Sutherland 2021-06-10 19:57:50 +01:00
• 8779645051 Merge pull request #235 from LordNoteworthy/threadhidefromdebugger-fix Graham Sutherland 2021-06-10 19:17:52 +01:00
• b6eaa5bce9 Bug fixes and new checks in ThreadHideFromDebugger. Graham Sutherland 2021-06-10 19:15:49 +01:00
• 06399c26a4 Merge pull request #226 from packmad/master Noteworthy 2021-02-12 13:19:07 +11:00
• df9f5b1cd4 Check for the lack of user input. packmad 2021-02-12 02:21:52 +01:00
• 2662b22430 Merge pull request #224 from SpriteOvO/patch-1 Noteworthy 2021-01-28 22:03:37 +11:00
• 437e1fc893 Fix wrong comment Sprite 2021-01-28 18:08:24 +08:00
• 1a6c5691d2 Patch int2d check on x86 to fix #223. Graham Sutherland 2021-01-26 20:28:52 +00:00
• 7f66e6f579 Patching int2d check to fix #223 Graham Sutherland 2021-01-26 20:27:55 +00:00
• 136de8393d Merge pull request #220 from recvfrom/master Noteworthy 2020-10-29 10:31:23 +11:00
• 771f0e26b7 Fix #191 - Add Anti-VM disk enum registry checks Andrew 2020-10-28 16:52:11 -04:00
• d7eda52cec Merge pull request #219 from recvfrom/master Noteworthy 2020-10-28 11:46:30 +11:00
• a2ace6e347 Address code-review feedback Andrew 2020-10-27 20:02:34 -04:00
• d950527599 Fix #189 - Add known hostname / username checks from malware Andrew 2020-10-26 23:17:16 -04:00
• f5bf05c58b Merge pull request #217 from rdzhaafar/LowFragmentationHeap_fix Noteworthy 2020-09-17 19:30:03 -07:00
• f5deafdc8a fixed a bug in LowFragmentationHeap test Rida Dzhaafar 2020-09-17 21:57:06 -04:00
• 27f1a2fb71 fixed a bug in LowFragmentationHeap Rida Dzhaafar 2020-09-17 20:02:01 -04:00
• 9fbe13a0e5 Merge pull request #215 from LordNoteworthy/Noteworthy Noteworthy 2020-08-31 16:00:07 -07:00
• cd4dc5cde9 New Anti-Debug: Low Fragmentation Heap Ayoub Faouzi 2020-08-12 09:50:46 +10:00
• 8c7a5f3786 Merge pull request #212 from LordNoteworthy/Noteworthy Noteworthy 2020-06-04 14:21:37 +10:00
• ad06d713e2 rename IsWindowsGenuine() to pirated_windows() LordNoteworthy 2020-06-04 14:19:36 +10:00
• c09c08becc Add Is Windows Genuine Check LordNoteworthy 2020-06-03 21:35:39 +10:00
• 5ff2a16b37 Merge pull request #210 from LordNoteworthy/Noteworthy Noteworthy 2020-04-24 08:31:28 +10:00
• d473e85e75 Improve GetOSDisplayString by adding Windows Server 2019 Ayoub Faouzi 2020-04-23 20:02:28 +10:00
• ede1e00a8d Merge pull request #208 from not-matthias/master Noteworthy 2020-04-15 18:53:00 +10:00
• 576bccde2a Changed the encoding of some files from UTF-16 to UTF-8 not-matthias 2020-04-10 15:29:25 +02:00
• f4c5ff2f72 Merge pull request #207 from gsuberland/master Graham Sutherland 2020-03-22 20:39:49 +00:00
• 340fc429d7 Resolved merge from master. Graham Sutherland 2020-03-22 20:18:09 +00:00
• cbcd9066b4 Made EnumProcessModulesEx available via the API class and made ScanForModules.cpp use it, see issue #198 for details. Graham Sutherland 2020-03-22 19:51:37 +00:00
• b287a7929d Added note to manifest file. Graham Sutherland 2020-03-22 19:49:02 +00:00
• 8b7202c0a9 Added manifest to fix OS detection issue. Graham Sutherland 2020-03-22 19:47:32 +00:00
• c2c78bfb4c Merge pull request #206 from LordNoteworthy/Noteworthy Noteworthy 2020-03-22 18:55:24 +11:00
• 5c1665109b Use Wow64DisableWow64FsRedirection/Wow64RevertWow64FsRedirection instead of Sysnative LordNoteworthy 2020-03-22 18:52:26 +11:00
• db9b49c78f Merge pull request #205 from LordNoteworthy/Noteworthy Noteworthy 2020-03-22 18:27:27 +11:00
• cbb02d539e fix wrong path names in vmware_files() and vbox_files() to adapt to wow64 fs redirection LordNoteworthy 2020-03-22 18:24:35 +11:00
• 0648108a02 Merge pull request #204 from LordNoteworthy/Noteworthy Noteworthy 2020-03-22 17:27:06 +11:00
• 2941c26bee Fix string comparaison in check_adapter_name() LordNoteworthy 2020-03-22 17:25:30 +11:00
• 654b2666f9 Merge pull request #200 from LordNoteworthy/Noteworthy Noteworthy 2020-02-03 15:40:42 +11:00
• d7fd5d825e add trap flag anti debug Ayoub Faouzi 2020-02-01 13:09:30 +11:00
• 6e66d448ea Merge pull request #199 from LordNoteworthy/Noteworthy Ayoub Faouzi 2020-01-27 22:08:03 +11:00
• ff71355a3b add generic anti-sandbox (checking for well file names like malware.exe) LordNoteworthy 2020-01-25 12:46:53 +11:00
• 8ff90a3979 Merge pull request #197 from Mattiwatti/debugobjecthandle Graham Sutherland 2020-01-07 20:38:03 +00:00
• 0b2627df6b ProcessDebugObject: add check with overlapping buffers Mattiwatti 2020-01-07 20:42:51 +01:00
• aa06a28003 ProcessDebugObject: fail if status is not STATUS_PORT_NOT_SET ProcessDebugObject: fail if status is STATUS_PORT_NOT_SET but an output handle was written regardless Mattiwatti 2020-01-07 20:29:15 +01:00
• 7a6c54d81e Merge pull request #194 from LordNoteworthy/Noteworthy Ayoub Faouzi 2019-10-17 06:30:18 +11:00
• bbb8d27ad7 added more anti-analysis tools LordNoteworthy 2019-10-15 09:15:54 +11:00
• d9caab600b add few anti-disassembly tricks LordNoteworthy 2019-10-15 09:02:29 +11:00