Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- //http://waleedassar.blogspot.com (@waleedassar)
- //The following code parses the SMBiosData retrieved from the Windows registry and searches for any structures of TYPE TYPE_INACTIVE (126, 0x7E). This is a sign of VirtualBox existence.
- #include "stdafx.h"
- #include "windows.h"
- #include "stdio.h"
- #define TYPE_BIOS 0x0 //e.g. Bios Brand and Version
- #define TYPE_SYSTEM 0x1 //System Manufacturer and Model
- #define TYPE_BASEBOARD 0x2
- #define TYPE_SYSTEM_ENCLOSURE 0x3
- #define TYPE_PROCESSOR 0x4
- #define TYPE_CACHE_INFO 0x7
- #define TYPE_SYSTEM_SLOTS 0x9
- #define TYPE_OEM_STRINGS 0xB
- #define TYPE_PHYSICAL_MEM_ARRAY 0x10
- #define TYPE_MEMORY_DEVICE 0x11
- #define TYPE_MEMORY_ARRAY_MAPPED_ADDRESS 0x13
- #define TYPE_SYSTEM_BOOT_INFORMATION 0x20
- #define TYPE_INACTIVE 0x7E //???? this one
- #define TYPE_END_OF_STRUCTURE 0x7F
- //----This structure is only need for parsing SMBiosData retrieved from Registry.
- //Not needed for parsing SMBiosData retrieved Via WMI
- struct BIOS_DATA_HEAD
- {
- unsigned char a1;
- unsigned char a2;
- unsigned char a3;
- unsigned char a4;
- unsigned long length;
- };
- struct HeadER
- {
- unsigned char Type; //0 for bios, 1 for system, and so on.
- unsigned char section_length;
- unsigned short handles;
- };
- void AllToUpper(char* str,unsigned long len)
- {
- for(unsigned long c=0;c<len;c++)
- {
- if(str[c]>='a' && str[c]<='z')
- {
- str[c]-=32;
- }
- }
- }
- void PrintType(unsigned char type)
- {
- printf("----------------------------------------\r\n");
- if(type==TYPE_BIOS) printf("Type: BIOS\r\n");
- else if(type==TYPE_SYSTEM) printf("Type: SYSTEM INFO\r\n");
- else if(type==TYPE_BASEBOARD) printf("Type: BASEBOARD\r\n");
- else if(type==TYPE_SYSTEM_ENCLOSURE) printf("Type: BIOS\r\n");
- else if(type==TYPE_PROCESSOR) printf("Type: PROCESSOR\r\n");
- else if(type==TYPE_CACHE_INFO) printf("Type: CACHE INFO\r\n");
- else if(type==TYPE_SYSTEM_SLOTS) printf("Type: SYSTEM SLOTS\r\n");
- else if(type==TYPE_OEM_STRINGS) printf("Type: OEM STRINGS\r\n");
- else if(type==TYPE_PHYSICAL_MEM_ARRAY) printf("Type: PHYSICAL MEMORY ARRAY\r\n");
- else if(type==TYPE_MEMORY_DEVICE) printf("Type: MEMORY DEVICE\r\n");
- else if(type==TYPE_MEMORY_ARRAY_MAPPED_ADDRESS) printf("Type: MEMORY ARRAY MAPPED ADDRESS\r\n");
- else if(type==TYPE_SYSTEM_BOOT_INFORMATION) printf("Type: SYSTEM BOOT INFORMATION\r\n");
- else if(type==TYPE_END_OF_STRUCTURE) printf("Type: END OF STRUCTURE\r\n");
- else printf("Type: %X\r\n",type);
- }
- //index 1 represents the first string
- char* PrintString(char* pString,unsigned long index)
- {
- index--;
- while(index)
- {
- unsigned long length=strlen(pString);
- pString+=(length+1);
- if(*pString==0)
- {
- printf("String is: Error retrieving string\r\n");
- return 0;
- }
- index--;
- }
- printf("String is: %s\r\n",pString);
- return pString;
- }
- unsigned char* ScanDataForString(unsigned char* data,unsigned long data_length,unsigned char* string2)
- {
- unsigned long string_length=strlen((char*)string2);
- for(unsigned long i=0;i<=(data_length-string_length);i++)
- {
- if(strncmp((char*)(&data[i]),(char*)string2,string_length)==0) return &data[i];
- }
- return 0;
- }
- int main(int argc, char* argv[])
- {
- HKEY hk=0;
- int ret=RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SYSTEM\\CurrentControlSet\\Services\\mssmbios\\data",0,KEY_ALL_ACCESS,&hk);
- if(ret==ERROR_SUCCESS)
- {
- unsigned long type=0;
- unsigned long length=0;
- ret=RegQueryValueEx(hk,"SMBiosData",0,&type,0,&length);
- if(ret==ERROR_SUCCESS)
- {
- if(length)
- {
- char* p=(char*)LocalAlloc(LMEM_ZEROINIT,length);
- if(p)
- {
- ret=RegQueryValueEx(hk,"SMBiosData",0,&type,(unsigned char*)p,&length);
- if(ret==ERROR_SUCCESS)
- {
- //--------------------------Only when parsing SMBiosData retrieved from Registry------------------
- unsigned long new_length=((BIOS_DATA_HEAD*)p)->length; //length-8
- p+=0x8;
- printf("Length is: %X\r\n",new_length);
- //------------------------------------------------------------------------------------------------
- unsigned long i=0;
- while(i<new_length)
- {
- unsigned char type=((HeadER*)(p+i))->Type;
- PrintType(type);
- unsigned char section_size=((HeadER*)(p+i))->section_length;
- printf("Section length is: %X\r\n",section_size);
- unsigned short handles=((HeadER*)(p+i))->handles;
- printf("Handle is: %X\r\n",handles);
- if(type==0x7F) break; //End-Of-Table
- if(type==TYPE_INACTIVE) //0x7E
- {
- PrintString(p+i+section_size,*(p+i+4)); //print Brand
- PrintString(p+i+section_size,*(p+i+5)); //print Version
- MessageBox(0,"VirtualBox detected","waliedassar",0);
- }
- //---Get End of Structure--------------
- unsigned char* pxp=(unsigned char*)p+i+section_size;
- while(*(unsigned short*)pxp!=0) pxp++;
- pxp++;
- pxp++;
- //-------------------------------------
- i=(pxp-((unsigned char*)p));
- }
- }
- LocalFree(p);
- }
- }
- }
- RegCloseKey(hk);
- }
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement