search

MCRcortex / nekodetector

Nekoclient infection detector
MIT License
564 stars 41 forks source link

attempt to detect stage2 #13

Closed Huskydog9988 closed 1 year ago

Fox2Code commented 1 year ago

To detect stage 2, the windows check could also run on wine!

For wine the equivalent would be: /home/fox2code/.wine/drive_c/users/fox2code/AppData/Roaming

Where you replace fox2code by the username of whoever.

This code should work correcly on Linux to detect the appdata folder of the main wine instance. Paths.get(System.getProperty("user.home"), ".wine", "drive_c", "users", System.getProperty("user.name"), "AppData", "Roaming")

Huskydog9988 commented 1 year ago

For wine, are you assuming the program is running under it, or just detecting the existence of a compromised wine "machine"