 hasherezade
|
3ee062b4d7
|
[REFACT] In AntiVm: replaced string conversion macro with a function
|
2024-12-05 12:12:10 -08:00 |
|
|
hasherezade
|
dddd88ecec
|
[REFACT] Moved instrumentation of CPUID into a separate function within AntiVm
|
2024-08-23 04:25:14 -07:00 |
|
|
hasherezade
|
4deda0a669
|
[REFACT] Refactored evasion callbacks after function
|
2024-08-12 10:40:31 -07:00 |
|
|
hasherezade
|
de74a70327
|
[FEATURE] Store function arguments in before callback
|
2024-08-12 07:12:56 -07:00 |
|
|
hasherezade
|
8dd296f8f9
|
[FEATURE] Moved FunctionData to EvasionWatch
|
2024-08-12 06:38:06 -07:00 |
|
|
hasherezade
|
a4a6b3cd53
|
[FEATURE] Added callbacks before and after in EvasionInfo
|
2024-08-12 06:24:18 -07:00 |
|
|
hasherezade
|
44b671561b
|
[FEATURE] Added bypass for AntiVm check based on SystemFirmwareTableInformation
|
2024-08-12 06:11:40 -07:00 |
|
|
hasherezade
|
28452b945a
|
[W-I-P] Monitor syscalls output
|
2024-08-12 05:56:18 -07:00 |
|
|
hasherezade
|
4f426e2213
|
[REFACT] Renamed functions to show installation point
|
2024-08-10 16:58:28 -07:00 |
|
|
hasherezade
|
529b472566
|
[FEATURE] Moved functions lists of AntiVm/AntiDbg into EvasionWatch
|
2024-08-10 16:39:31 -07:00 |
|
|
hasherezade
|
3312c1bfcd
|
[REFACT] Moved AntiDbg/AntiVm common parts to EvasionWatch
|
2024-08-09 12:57:27 -07:00 |
|
|
hasherezade
|
c8ee0fa225
|
[REFACT] In CPUID: one function to alter all registers
|
2024-08-09 08:00:15 -07:00 |
|
|
hasherezade
|
6d6afaaf63
|
[BUGFIX] In CPUID: change the value of EAX for hyperV
|
2024-08-08 18:06:51 -07:00 |
|
|
hasherezade
|
75770fe3f9
|
[REFACT] Refactored mapping CPUID value to thread
|
2024-08-08 16:26:45 -08:00 |
|
|
hasherezade
|
30a513ad9e
|
[FEATURE] Allow to clear hypervisor or emulate HyperV (may be useful for VMProtect tracing)
|
2024-08-08 16:08:17 -08:00 |
|
|
hasherezade
|
8a02539735
|
[FEATURE] In CPUID: show hypervisor bit res
|
2024-08-08 15:50:03 -07:00 |
|
|
hasherezade
|
004a181f5a
|
[FEATURE] In CPUID: commented out hypervisor bit change. Show what values were changed
|
2024-08-08 15:45:54 -07:00 |
|
|
hasherezade
|
6f86f4086d
|
[FEATURE] In CPUID: cleared hypervisor bit
|
2024-08-08 15:28:44 -07:00 |
|
|
hasherezade
|
70e0c9f4ce
|
[FEATURE] In CPUID: modified hypervisor feature
|
2024-08-08 21:58:02 -08:00 |
|
|
hasherezade
|
d9b492e9cb
|
[FEATURE] In CPUID: replace the vendor id
|
2024-08-08 13:37:12 -08:00 |
|
|
hasherezade
|
5608810793
|
[FEATURE] Show returned CPUID values
|
2024-08-08 07:47:14 -08:00 |
|
|
hasherezade
|
182759a66a
|
[FEATURE] Added detection of more CPUID-based checks
|
2024-08-08 07:48:39 -07:00 |
|
|
hasherezade
|
1ebe6f0ba5
|
[FEATURE] Added identification of CPUID-based antiVM checks
|
2023-08-27 14:55:30 -07:00 |
|
|
hasherezade
|
ab5b5f4391
|
[REFACT] Changed C cast to C++ style cast
|
2023-08-21 09:13:58 -07:00 |
|
|
hasherezade
|
699c038a82
|
[NOBIN] Normalized indentations
|
2023-08-17 15:22:43 -07:00 |
|
|
hasherezade
|
aac33b98ea
|
Rename Antivm.cpp to AntiVm.cpp
|
2023-08-17 02:15:08 +02:00 |
|