search

brad-sp / cuckoomon-modified

Modified edition of cuckoomon
GNU General Public License v3.0
23 stars 15 forks source link

Additional AntiVM #13

Closed MerX1030 closed 9 years ago

MerX1030 commented 9 years ago

Could you add VBOX to the following code in misc.c: if (IoControlCode == IOCTL_STORAGE_QUERY_PROPERTY) { replace_string_in_buf(OutputBuffer, OutputBufferLength, "QEMU", "DELL"); replace_string_in_buf(OutputBuffer, OutputBufferLength, "VMware", "DELL__"); replace_string_in_buf(OutputBuffer, OutputBufferLength, "Virtual", "C300_BD"); replace_string_in_buf(OutputBuffer, OutputBufferLength, "VBOX", "DELL"); }

I got the following results using current version: DeviceIoControl DeviceHandle: 0x00000088 OutBuffer: {hexvalues}VBOX HARDDISK 1.0 VBOX HARDDISK{hexvalues} IoControlCode: IOCTL_STORAGE_QUERY_PROPERTY InBuffer: \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00

brad-sp commented 9 years ago

Done, thanks!

MerX1030 commented 9 years ago

Thanks!