Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- void antiVM()
- {
- HKEY HK = 0;
- if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"HARDWARE\\ACPI\\DSDT\\VBOX__", 0, KEY_READ, &HK) == ERROR_SUCCESS)
- {
- ExitProcess(0);
- }
- HANDLE hF1 = CreateFile(L"\\\\.\\VBoxMiniRdrDN", GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0, OPEN_EXISTING, 0, 0);
- if (hF1 != INVALID_HANDLE_VALUE)
- {
- ExitProcess(0);
- }
- HMODULE hM1 = LoadLibrary(L"VBoxHook.dll");
- if (hM1)
- {
- ExitProcess(0);
- }
- HK = 0;
- if ((ERROR_SUCCESS == RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Oracle\\VirtualBox Guest Additions", 0, KEY_READ, &HK)) && HK)
- {
- RegCloseKey(HK);
- ExitProcess(0);
- }
- HK = 0;
- if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"HARDWARE\\DESCRIPTION\\System", 0, KEY_READ, &HK) == ERROR_SUCCESS)
- {
- unsigned long type = 0;
- unsigned long size = 0x100;
- char* systembiosversion = (char*)LocalAlloc(LMEM_ZEROINIT, size + 10);
- if (ERROR_SUCCESS == RegQueryValueEx(HK, L"SystemBiosVersion", 0, &type, (unsigned char*)systembiosversion, &size))
- {
- ToLower((unsigned char*)systembiosversion);
- if (type == REG_SZ || type == REG_MULTI_SZ)
- {
- if (strstr(systembiosversion, "vbox"))
- {
- ExitProcess(0);
- }
- }
- }
- LocalFree(systembiosversion);
- type = 0;
- size = 0x200;
- char* videobiosversion = (char*)LocalAlloc(LMEM_ZEROINIT, size + 10);
- if (ERROR_SUCCESS == RegQueryValueEx(HK, L"VideoBiosVersion", 0, &type, (unsigned char*)videobiosversion, &size))
- {
- if (type == REG_MULTI_SZ)
- {
- char* video = videobiosversion;
- while (*(unsigned char*)video)
- {
- ToLower((unsigned char*)video);
- if (strstr(video, "oracle") || strstr(video, "virtualbox"))
- {
- ExitProcess(0);
- }
- video = &video[strlen(video) + 1];
- }
- }
- }
- LocalFree(videobiosversion);
- RegCloseKey(HK);
- }
- HANDLE hxx = CreateFile(L"\\\\.\\pipe\\VBoxTrayIPC", GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, 0, 0);
- if (hxx != INVALID_HANDLE_VALUE)
- {
- CloseHandle(hxx);
- ExitProcess(0);
- }
- HWND hY1 = FindWindow(L"VBoxTrayToolWndClass", 0);
- HWND hY2 = FindWindow(0, L"VBoxTrayToolWnd");
- if (hY1 || hY2)
- {
- ExitProcess(0);
- }
- unsigned long x = 0;
- __asm
- {
- push offset Handler
- push dword ptr fs : [0x0]
- mov dword ptr fs : [0x0], esp
- pushad
- xor eax, eax
- xor ecx, ecx
- xor edx, edx
- xor ebx, ebx
- pushfd
- pop esi
- or esi, 0x100; Trap flag
- push esi
- popfd
- CPUID
- pushfd
- pop eax
- mov x, eax
- popad
- pop dword ptr fs : [0x0]
- pop eax
- }
- if (x & 0x100)
- {
- ExitProcess(0);
- }
- bool xy = 0;
- __asm
- {
- pushad
- pushfd
- pop eax
- or eax, 0x00200000
- push eax
- popfd
- pushfd
- pop eax
- and eax, 0x00200000
- jz CPUID_NOT_SUPPORTED; Are you still alive ?
- xor eax, eax
- xor edx, edx
- xor ecx, ecx
- xor ebx, ebx
- inc eax; processor info and feature bits
- cpuid
- test ecx, 0x80000000; Hypervisor present
- jnz Hypervisor
- mov x, 0
- jmp bye
- Hypervisor :
- mov x, 1
- jmp bye
- CPUID_NOT_SUPPORTED :
- mov x, 2
- bye :
- popad
- }
- if (xy == 1)
- {
- ExitProcess(0);
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement