Статья Обход Virustotal

[Admin]

Обход Virustotal​

VirusTotal

VirusTotal

www.virustotal.com

Мы можем наблюдать самую главную надпись

Highlighted text

"Anti-Debug / Anti-VM"(теперь тут test)

"YES"

(т.е. мы спалили вирустотал и выдали об этом сообщение)

РАЗУМЕЕТСЯ, в коде для полноценного использования есть что ещё менять!

#include <windows.h>
#include <intrin.h>
#include <iphlpapi.h>
#include <tlhelp32.h>
#include <dxgi.h>
#include <string>
#include <winternl.h>

#pragma comment(lib, "iphlpapi.lib")
#pragma comment(lib, "dxgi.lib")
#pragma comment(lib, "ntdll.lib")


typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION {
    BOOLEAN KernelDebuggerEnabled;
    BOOLEAN KernelDebuggerNotPresent;
} SYSTEM_KERNEL_DEBUGGER_INFORMATION;


bool CheckHypervisorBit() {
    int cpuInfo[4];
    __cpuid(cpuInfo, 1);
    return (cpuInfo[2] >> 31) & 1;
}

bool CheckCPUIDVendor() {
    int cpuInfo[4];
    char vendor[13];

    __cpuid(cpuInfo, 0);
    memcpy(vendor + 0, &cpuInfo[1], 4);
    memcpy(vendor + 4, &cpuInfo[3], 4);
    memcpy(vendor + 8, &cpuInfo[2], 4);
    vendor[12] = 0;

    std::string v(vendor);
    return v.find("VMware") != std::string::npos ||
        v.find("KVM") != std::string::npos ||
        v.find("Xen") != std::string::npos ||
        v.find("VBox") != std::string::npos;
}

bool CheckBIOS() {
    HKEY hKey;
    char buf[512];
    DWORD size = sizeof(buf);

    if (RegOpenKeyA(HKEY_LOCAL_MACHINE,
        "HARDWARE\\DESCRIPTION\\System", &hKey) == ERROR_SUCCESS) {

        if (RegQueryValueExA(hKey, "SystemBiosVersion", NULL, NULL,
            (LPBYTE)buf, &size) == ERROR_SUCCESS) {

            std::string s(buf);
            RegCloseKey(hKey);

            return s.find("VMware") != std::string::npos ||
                s.find("innotek") != std::string::npos ||
                s.find("QEMU") != std::string::npos;
        }
        RegCloseKey(hKey);
    }
    return false;
}

bool CheckMAC() {
    IP_ADAPTER_INFO adapters[16];
    DWORD size = sizeof(adapters);

    if (GetAdaptersInfo(adapters, &size) != ERROR_SUCCESS)
        return false;

    for (PIP_ADAPTER_INFO p = adapters; p; p = p->Next) {
        BYTE* m = p->Address;
        if ((m[0] == 0x08 && m[1] == 0x00 && m[2] == 0x27) ||
            (m[0] == 0x00 && m[1] == 0x05 && m[2] == 0x69) ||
            (m[0] == 0x52 && m[1] == 0x54 && m[2] == 0x00))
            return true;
    }
    return false;
}

bool CheckVMDrivers() {
    const char* drivers[] = {
        "vmmouse.sys",
        "vmhgfs.sys",
        "VBoxMouse.sys",
        "VBoxGuest.sys"
    };

    char path[MAX_PATH];
    GetSystemDirectoryA(path, MAX_PATH);
    strcat_s(path, "\\drivers\\");

    for (auto d : drivers) {
        char full[MAX_PATH];
        strcpy_s(full, path);
        strcat_s(full, d);
        if (GetFileAttributesA(full) != INVALID_FILE_ATTRIBUTES)
            return true;
    }
    return false;
}

bool CheckVMProcesses() {
    const wchar_t* names[] = {
        L"vmtoolsd.exe",
        L"VBoxService.exe",
        L"VBoxTray.exe"
    };

    PROCESSENTRY32W pe{};
    pe.dwSize = sizeof(pe);

    HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (snap == INVALID_HANDLE_VALUE)
        return false;

    if (Process32FirstW(snap, &pe)) {
        do {
            for (auto n : names) {
                if (_wcsicmp(pe.szExeFile, n) == 0) {
                    CloseHandle(snap);
                    return true;
                }
            }
        } while (Process32NextW(snap, &pe));
    }

    CloseHandle(snap);
    return false;
}

bool CheckRDTSC() {
    unsigned __int64 t1 = __rdtsc();
    Sleep(10);
    unsigned __int64 t2 = __rdtsc();
    return (t2 - t1) < 100000;
}

bool CheckSleepDrift() {
    DWORD t1 = GetTickCount();
    Sleep(100);
    DWORD t2 = GetTickCount();
    return (t2 - t1) < 90;
}

bool CheckCPUCores() {
    SYSTEM_INFO si;
    GetSystemInfo(&si);
    return si.dwNumberOfProcessors <= 2;
}

bool CheckRAM() {
    MEMORYSTATUSEX ms{};
    ms.dwLength = sizeof(ms);
    GlobalMemoryStatusEx(&ms);
    return (ms.ullTotalPhys / (1024ULL * 1024 * 1024)) <= 4;
}

bool CheckGPU() {
    IDXGIFactory* factory = nullptr;
    IDXGIAdapter* adapter = nullptr;

    if (FAILED(CreateDXGIFactory(__uuidof(IDXGIFactory), (void**)&factory)))
        return false;

    if (FAILED(factory->EnumAdapters(0, &adapter))) {
        factory->Release();
        return true;
    }

    DXGI_ADAPTER_DESC desc{};
    adapter->GetDesc(&desc);

    std::wstring name(desc.Description);

    adapter->Release();
    factory->Release();

    return name.find(L"Microsoft Basic") != std::wstring::npos;
}

bool CheckSandboxArtifacts() {
    return GetFileAttributesA("C:\\agent\\agent.py") != INVALID_FILE_ATTRIBUTES ||
        GetFileAttributesA("C:\\sandbox") != INVALID_FILE_ATTRIBUTES;
}

bool CheckScreenResolution() {
    return GetSystemMetrics(SM_CXSCREEN) <= 1024 &&
        GetSystemMetrics(SM_CYSCREEN) <= 768;
}

bool CheckIsDebuggerPresent() {
    return IsDebuggerPresent();
}

bool CheckRemoteDebuggerPresentAPI() {
    BOOL dbg = FALSE;
    CheckRemoteDebuggerPresent(GetCurrentProcess(), &dbg);
    return dbg;
}

bool CheckPEBBeingDebugged() {
#ifdef _M_X64
    PBYTE peb = (PBYTE)__readgsqword(0x60);
#else
    PBYTE peb = (PBYTE)__readfsdword(0x30);
#endif
    return peb[2];
}

bool CheckNtDebugPort() {
    ULONG_PTR port = 0;
    return NT_SUCCESS(NtQueryInformationProcess(
        GetCurrentProcess(),
        (PROCESSINFOCLASS)7,
        &port,
        sizeof(port),
        nullptr)) && port;
}

bool CheckNtDebugFlags() {
    ULONG flags = 0;
    return NT_SUCCESS(NtQueryInformationProcess(
        GetCurrentProcess(),
        (PROCESSINFOCLASS)31,
        &flags,
        sizeof(flags),
        nullptr)) && flags == 0;
}

bool CheckNtDebugObject() {
    HANDLE h = nullptr;
    return NT_SUCCESS(NtQueryInformationProcess(
        GetCurrentProcess(),
        (PROCESSINFOCLASS)30,
        &h,
        sizeof(h),
        nullptr)) && h;
}

bool CheckHardwareBreakpoints() {
    CONTEXT ctx{};
    ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
    GetThreadContext(GetCurrentThread(), &ctx);
    return ctx.Dr0 || ctx.Dr1 || ctx.Dr2 || ctx.Dr3;
}

bool CheckTrapFlag() {
    CONTEXT ctx{};
    ctx.ContextFlags = CONTEXT_CONTROL;
    GetThreadContext(GetCurrentThread(), &ctx);
    return (ctx.EFlags & 0x100) != 0;
}

bool CheckOutputDebugString() {
    SetLastError(0);
    OutputDebugStringA("anti-debug");
    return GetLastError() != 0;
}

bool CheckTiming() {
    DWORD a = GetTickCount();
    for (volatile int i = 0; i < 1000000; i++);
    DWORD b = GetTickCount();
    return (b - a) > 50;
}

bool CheckKernelDebugger() {
    SYSTEM_KERNEL_DEBUGGER_INFORMATION info{};
    NtQuerySystemInformation(
        (SYSTEM_INFORMATION_CLASS)35,
        &info,
        sizeof(info),
        nullptr);
    return info.KernelDebuggerEnabled;
}


int main() {

    bool detected =
        // VM
        CheckHypervisorBit() ||
        CheckCPUIDVendor() ||
        CheckBIOS() ||
        CheckMAC() ||
        CheckVMDrivers() ||
        CheckVMProcesses() ||
        CheckRDTSC() ||
        CheckSleepDrift() ||
        CheckCPUCores() ||
        CheckRAM() ||
        CheckGPU() ||
        CheckSandboxArtifacts() ||
        CheckScreenResolution() ||

        // DEBUG
        CheckIsDebuggerPresent() ||
        CheckRemoteDebuggerPresentAPI() ||
        CheckPEBBeingDebugged() ||
        CheckNtDebugPort() ||
        CheckNtDebugFlags() ||
        CheckNtDebugObject() ||
        CheckHardwareBreakpoints() ||
        CheckTrapFlag() ||
        CheckOutputDebugString() ||
        CheckTiming() ||
        CheckKernelDebugger();

    MessageBoxA(
        nullptr,
        detected ? "YES" : "NO",
        "test",
        MB_OK | MB_ICONINFORMATION
    );

    return 0;
}