VirtualBox tray tool window detection

pafish/main.c

@@ -231,6 +231,14 @@ int main(int argc, char *argv[])
     else {
         print_not_traced();
     }
+
+    printf("[*] Looking for VBox tray tool window ");
+    if (vbox_traywindow() == 0) {
+    }
+    else {
+        print_not_traced();
+    }
+
     
     /* VMware detection tricks */
     printf("\n[-] VMware detection\n");

pafish/vbox.c

@@ -286,3 +286,24 @@ int vbox_pipe() {
     return res;
 
 }
+
+/**
+* Checking for Tray window
+**/
+int vbox_traywindow() {
+    int res=1;
+    HWND h1;
+    HWND h2;
+
+    h1 = FindWindow("VBoxTrayToolWndClass", 0);
+    h2 = FindWindow(0, "VBoxTrayToolWnd");
+
+    if (h1 || h2){
+        write_log("VirtualBox Tray tool window detected");
+        print_traced();
+        write_trace("hi_virtualbox");
+        res = 0;
+        }
+ 
+    return res;
+}

pafish/vbox.h

@@ -22,4 +22,6 @@ int vbox_pseudodev();
 
 int vbox_pipe();
 
+int vbox_traywindow();
+
 #endif