From a6a04789159d262be9f435f6a7e8d6ca4c971e68 Mon Sep 17 00:00:00 2001 From: Alberto Ortega Date: Mon, 28 Dec 2015 16:26:18 +0100 Subject: [PATCH] Bump v056 --- CHANGELOG | 9 +++++++++ pafish.exe | Bin 75264 -> 75776 bytes pafish/Objects/MingW/pafish_private.rc | 4 ++-- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 49a0940..2c82f6f 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,4 +1,13 @@ +v056 + +- Added new checks + - IsNativeVhdBoot #46 + - OS uptime check #45 + +- Added a DNS request trace for each detection #43 +- Disabled check_hook_DeleteFileW_m1 because it causes FP in Win 8 + v055 - Added new checks diff --git a/pafish.exe b/pafish.exe index 975e64e1f98f0c7145eaae02c3f8d328d723b48b..4ea08c6f07107f28467665c595037182c6b11aba 100644 GIT binary patch delta 10868 zcmc(l4_H)H-pB8~US!ZoMg<)ZWxxv}0`gA;L7kKVR5VijmzcPLVYx^;_@~u|8gUs% z2t8)BS&vgbZ@!zmuP&@vx<*2x<(jXVkDIPpnR^X(mo`#X-RAwCd(K5bd!M)G>DhPc zH|Lz+`TTz8cmCdU2P;m=6=&qys^GJ8o}DM~&lSPHPk&Jg5@tc6Yl_%cCekuBnw(X)~3_OS}_jd81r zmfDvJ!lndNltB_9`Q)-VWq{T~BZ>ncn@OBBO58!_;d>`}2H$n{{~;X`qfgHegce!x z;-hY#C4ARf1Ksr60 zl=vh{i8*AKPoY>y{^e6Fc9O^XDlrl82j6A0t%5hO0Dhcp^6PDI52av&hlXi_ppH!! z1kY|#-?vU$oMXj zCJVyJrs{@B8ZpW9OOu>7;`R%R6~+m|vKHG7ZR`{{R7V=Md^F8BAg^}#0dd)GsB6d{ z{f3HBhh-YVpYa8uzrefU78Zn&UjoD+-OIi5`Wn5s~l?Jrt?DScyP~7;GHVB3omdb?T z^H5YDVZ&HP^NE^!hhp5u4fb$@Qk&+#gF?|fhNM-@X+BHkzF8X6fTG%$GksPwCWNK( ztBff?QT+nrK!e-DncbWj>&Vs|U82xY3dxGE9r>NyAPfaM(y1(!pB%681(d1b%u}4H z;!HDR_EF{u&K%{;8P4oY)%<+tpimZv4CSmb3rppiGz}_5Q4QzJR?h6<%zsbN7?m>L z)7e8WL)I`q$t;!MP1l$WD5{@wrh(Nt4CgpBBtwHj)&e@np*$35?>Deip2wI|l-bT1 zc^zX?St>unn5`(PrJOmznKsV6#+aD(R)?TY*Be{U92K!t{)$2SP*fv1^95&wr!`jg zGA15HRiccnETQ>Nu|4TXtYn;FE9WOoft{=zqRd&!H~@XgA>kLO#AchrpcoX@-%?0c z=F$9S?(_-98P;+B5?kT>DDw>CKce}0oWIO@mGcWGYC$A#0OOd|3$jB?gZNJdc_R z95r*Mo-t+zn3`V90w`%?pE0J6GEekknmKbjj%H*WqUAqwc7TL4_1Ls6)M&H3^!d?UdQxi`fSy z4f;x=#;BAj?ZxPAb%1f8_d(AAn%)aahLSo;Pu3hQrc7inW&>vkWA;);>ct57P(LZ- zG(RUOa~aQQ=;#PJXvQErQ3>d5iUuX4sJ=rXS(#7s+qppr;|zArd)XrGpv;zDOzI}) z(>+P^xdBCWSubY)CcY5fU{D8zru2fMDw(6hj444;9np)~#hH(|AIjYFK?l%FJ?Nax z%uniMEg(CJ>Ul>mNFT0T25D3CyIxEkcO*ZkIclViYA7QspVRy@&bKqp(8>7{#%o*j zQO-DY$o@+f-3|t6dvroCN6nmRWXv5D)ghFTmB=dO|0W}k9;cu{r`5_*c|#7$vZDFC z){}7>m&0`n?maNN@T8qSxYKpWn`QaP0QY@kdj<6CKd zT!v=b?y`mnY62_7Zb8L!l2(yG^Mm^cf|`**QU+&BbJB@paBz~j3HP@%xWl?^9o4qW z^ycKYb>N=mxq6J%7|^_oLqg#Cd~#~=NXgtpz8M_k$miyU+LKM%%`plc_zpKTPj|=A zS!w&Gbi@L0{kwV79e|lZnYIax>E2>DW+7!7DT6ELmPiyDSfPqm>_z@Qk&xd6bPE-h z2Ppjb|I*TZoZKBJ+J%1i@50;E@qqg|4(6kIAJ1fQV7KtxHu^H49!&e;abP~4ZHvMJ zpg0yNT_Z=(IE{_nT|4-NbtCToRC|)v%F2f{!UJ%Q38yoPn(E4q+YWY}cA`l!R8zB@~@(gqhEBi}GG4ZIT?8l0(#Oc*+T z#Ql(=?rw-R?p`0`x&Xe4v3L-pU{^dU**kQxxS#YjCkF37#;OB&b@@;}V*AK!^Qb}3 zkHbXT+T0kmMv?a6C~=!dNZI4ao96Lw@ufKt-$Q~j0~)v^v$ja-O7ZL?r9ttMrJ3vw z3X`&vNmI}mT51m(Ir5VvfxfE_a@$nubyBh*9HL9974xELVviST@=U znv21NSrS`jo;$ovdJ?j*)hZCJgY|myQt*tF8y3t?8#>tT+}OU-zw%@FLx&78^)JNVu3mazfIjxuK*oB-ErN zXam#J_-L2$ry((7D)AluSU?6}xC#$>{XmbEJTp8v`@$~mNHNgi)OP{;x$Y&bvSemx$Mfw_7On>9}^ITIQ? zn7PCfudUS{Fa}RDFwx*8! zw=ze;ER|cju{V3N@|dl}5f&`jwvv~TEZIul3R@sO98Cs>2Ssmyz1w!R#VYU7bB0rT z&e*BvOqObrAD$-Wkj9aLGU_`?eNiq%Boo$>scySRg;eJhs9yU6dp(xjT~&* zg9_Hb89isXqvwoD4XGKKAm!l)ypd7Tu6EKovQP?)LTCZh+Oe)ix89}a42^oucva7t zN#VdZRA?Q4DkecG%{Q= zZzIn|MoAa{N-7eg;-WCO+R+cM6SiSJ74SuBz)qoc4?&4Ky5cg5fNfD%Qlwv6e zpa+Ffe?&y%NTK`^@boxaNA`@$k|IZuwo#)U-$qi_fPEg>+K=s?dTsa6bIQ|vjGd}7 zt9c1E)YE!+s;)eN$AGg@(Ol~14*Uc;HyQ-H5s_^Lruw(x4uA(8H$BqRG#%mG*Y*^( zJ=fZ0%bM%xsaw`+Y<%M=olG*U|4P8_3y2hF5!K-gk=sHJiL zYCCyzbk@XoN8Ym|qu9ahDbx=Fgnz~t16!zX?P~2j_Y{)2=!eC6G@M8e(^g=j>Sw7&l8{6N%&PbGxm|tt7yt|g4=|!Q{7u0%#Z$N z@`u=m0xt1t3m#@&6_&U;eQ#3Z4zfNjHAK-yp00ISq08s)RCpBf$GF*2ND~PgJ6en( zGsea__yNs~Ca%VhXZ|}I{SP*Fy&JISFMQpmP4u{?$b@YS`U5k4A)y;gyJ8Grs{#>f z?W#g*ecd=G&V@q#i>=)UF-J9!CxRyrGBUO(A81h=RI}rQeE10?XJW3z;txIiK@eUsFR>> zq3Zs+dJqOkXbpk>L#pq9XC9jDCo3OO-9N6A6$v(JaxnQYVpRY0P_d`WXXLAdTz004 zDw&%&T6*zw9I1~;eP5u5g`edGc34az!;%z797<{enss)H*r{k$Xia8ErqN+#qn`IiutIeW~7W2}cqa1QYuAbaw0wo&Uhx+_oBJCZX+ zV>~>t8$^MiS zKb<{5{@$&$io}gic|fmA8bZy>#!ni20he9TrVgCjh7n?WoxC?bUW_IG7@t4*_dihk z0@;!}*QXA(wdBjxgb6kre_C87Iwp7>tf0Let7|P(i-FU$LAo|x>%+{nMbT;65U9BR zWa&A>96e_&M6TL)k$SvM&Zb3)ACTK=Z_X%#n$E-;mdaH$<+B|3=dQumC$2vpnG`qk ziQA)j)#mgZ`DVhbWDnw^z*r76-UXf*L=SEM9qjn=MjXK$*VcL?D#+^eB=H&YM*2i? z9r-GK?2rWm@l0=ya$Q)|RO`-E;t{kr@Cb>{SdqHBz$!Rzd+lMB7wtxGz$;q0RV=56 ztaUmzLM0Z5v)R0;DdA$Pgm>ksqC22+cL6z_k%T{YN)s0*Sa3?>M;mv6VoEAd0=$83 zbg{kf4Q!`ri#L#-!LH-gnTlC!IFD?d_(Br@b0wN-N0+>TE0`B=pb9HGGk&trsPRQw zjX@n)pFb%}4Eyx}ys*?d+cMt114DGj>NYvQ7M-_z*7~}QFPQ7d;mP4cj4z^1Y$Q(u zwQjV+liGg(`F8S@X;edpbeJG$4T(sr3ls&R#MdzxhHBLVSk;+|#Z`d6h$5cuo~{}N zLH!GP#=1welaUWTD3+1p2gCdX>RDEH*OBKR95G}CoKZt{4JH|0=u25{9cg;7uyB*d zD#X$+XQ!`!4ShRtcJ}wLnTt?7RE=q^tcKQ8#S0ZExF>E!>2NJodHpxV0zOP(_f!K; zD*wvcP&k{6&)(kTAf(+?k1ko_SV$0yFGcE{*Hq#p(iKmNJZuh@lWJbW)aL2Y?H-g@|4Yt z>-`p6g!moVZ;Kb3$>+9EaSsu*Ld8uaEGu;Am178aczZo4$qje7nw-rct_!YP+R)YVzb2=hUR&z_hwq&?L;W|^VrUOr@a6ia>;2KU zKfdPr)5m{x{qy51et&cQiLOA`Cs;)WP4@-rRKH`cGp?_1-f(^5YPwmZ7}GvkWpdlG z#{T*7wY1}_ebYWE@8fJ0(Qbm*(bcq8Ot{#+?7DFCW`dW#N%HWj*9g@|Mj;d-?er>R z!o_s7>;KCPY~aIK8p8ENMn5!PpOBX)ZqJjW_CrY(+6R@m#%Sd{=nEmUu2~Ns z2zocOKJ2-3;`Z4FF@^Ze4(qqHbm@xqtCz2iT}>ipllr%2y9}n1s){Y;tEn!#*q*=qu_vdlEHAZ3jTWYs z6hHPP)&GDMiC!3Hnznit9Ih#zS5h=((xUqHPaZXxpDbQgTD&4DQRrn=Ki>XTAE`FCe#E*FVqhu`*ZB}TWC!FF zq`m&(^;>)#`AgCH@GDUf-P63Ek#Es$S98jcGNp&6NTkT!^+MG!(D$&e|KS&$;g z8pvkIZpb^34S zf?$LMKtdpqka$QcWC~tCt)FOf7pFO%HbqCpLfScQ=Ja}t*%CB_x4Sb>x43nFhf4Zbqn nij~GbwYgTonrp>F|FT%`v*V>2zrKPGszjmhTW^Gm3;X;Jt(!Sn delta 9866 zcmc(l3s_Xwwa3pn9Q1$_K^Nw4sqI>GZ$O*`r9j-@V`G z_uYGvHEZv+e{1dcKKrOOC*_(GvTs||#n;B)A@Jv{5Ee8_lqLuZVMy5V>I|uL^^Olx zLt9M9_u>ET?65SAIYi5d+D<`e7k9)*jZLpC-%^S4?)mr$hb&}IiIY=`ks9(i1bavN zgJo+f*9d~ej)IMlX^^Gt6YkWb=51XL!4s}Mk}lI$fgAjL95MW zp}{56>A7rO@HA;@A$uvfRLo=F2A7L5?A{S-niKI5+gI!m{1MrRn=#Urbp zg{rKLMcJ%XzN+J1XT4jKy;Y4z2%~aqgRc`u(UxyUodduEa`N+a(mwP^U_gbh|8>y>WCyNS+j_&QG9xI;Cy5CiXppa<) z?~Z@nwbsWzZXIhNc#z!r^FvD#uZo^E5R(7jxNAcN`9sdpVt)cJbV9$^nB1T9ik%Ey!mZ zLMOPEQ+jfKpxA_<%32=WA4D-u^B6}kJXdprXdaJWpoa5$3sl|zk?Z8707DaIJ1W{-JJQc!I(CKag}k%fgBp5R2W)5Z$Rw?IXKhL8QT_} zmB-G~E2~CUi{VV0QKo#vnHdHX^DvkJMWA7KQ2ISe7pN{%F>+M#Iz!91IrN}Df{q!G z=^$s`=gd6@BRm3T4`(JLLviLBTHb6hmBiE-6~9dBJ2}5!=Ul4N!5ualtGAz^V#6Ww zhe)Szhh$`^0=uE*YNKb>#8`(h?VS0I!JH#zaHK%JA5o3;?LKXlRY+$nHAZD; z(xGLw0$FX}FeVU3o~ko@iP`qwFrjv0Tw7kKxNwuW(_eh z!QEm+?+=BBjL_Q#6aF}umSN077^$+g z)Acyj#MBcbtFKVHobxRPr?f-6$RROLcgS-CDj5dVz(~x`45piy>|x9RXWrp)YQdO? zF&kl|IDa&l7GnBjL7#t9phZ0#`kDu-19U=04=`K-#s?z>Dwz!}tL?<>9mWWFh}mc` z`qb18W6tVvT&irlSr4QA-PMNPvP z)028UxrZ2+tQH`zX+e6$>nVMh(&+J{2B>V~4lfnL0mmop>9%3a8O|It81ptTjl&oR zj5I3Kiu5?u#H`$CRQwuc=5dEM15~=X!_7v}L1G*RpXot*Yc3iptJ#!(*hp7V`T|F+{9PiR^csA7WcU-QThX#SIn(8XgK^qWl6sDXUH3EyT!lQ^B{{g7Dpju**Xm3dg??`zBaw%=IezZj7rVLO!9_Z`|K0ZuxcNTJ#aU z&M2{;L<|{4uamCs+UV=X7!u;KUK>^_(O7$Ekurd)sb$7Bw4Yx?AID{#tieyAR8~hq zX`zUXiKVecNkbjj75XjsvzdVr*SHRixM1N40NbznU;}7PVUH2wgDAT+(8WyA@zSA8HZ^)O(nUfeq`H3ti222 z+|rcEUX4z;CHtte4`zI}P@}Zv`22#K)tIv8GrUgP&qlMgZ6Gd0To@N1SWwJ@88ueS zQ7^jK=ib`4A*}8_L`0YPhmZrgW=mkZ^Kl5P-N%l^rliMPb=RZLFF?_!+IckcF03)H zBg;K7qN_F@+>C=hqud#9AO?G`?hB_zVi@I=Pni$SDO}y7^?l$IAnYdG6mdQyswGnmhMf~sqv$6$om7>Zz;%1qx+zZ328Oyra z+8Sn!5yz;35@WWSRhAb&Wthe~a!&!Cw(oZ9Ti3Xp_$UjU7%lvm7;I z>^>mWj$asB?yhI0>Jsra)|OEK@xGl4yv zG)HQl#D1AH$#oz=%4Y&8WiXI3S-10u;f_Gcye^Qk_yVbzwm{0-6G*A1r@5~!FOW(r z4W#U~Mk@HIBWv%|tSmW0`siu)T(V8Ntq)DKjR^ALG)-k+B^OGG$?WOON!F3D7^65L zkW!`wQl^`I?9oXJ#64_uR)Vz5$G)6olfL;9p~kTdSrN=(GbKC(xH*fjRRtRcLn?b= z#L}RJ-<-wP+e)PEDm!6Qt=c%+>Lwg_?ybE-RVq#t;$H+$r`a+Vo>D07OlB)mQsVAT zCRV{VPreXpY@$|u6X|DX6KhHt|NURUv7zo5PJDNVsz(T%F>ssU-l_iy?6z{A%7dc8)=0})mL(CghX zB~v=v$&O5!FTT&lq{oQC?1A(MmY+UF9E;Q(F^9FJ-!;Oz6RT_w3!iEcn^?-!#pX5~ zWOU86;)TPH{U%mF_4W~&M4n`yPtA@Ix`?4ADXTQ?S4X>9U^(`s(m*F`u&0O$J7`bO z8hT;KrXU)xg5G@kTRoM=&xs;lAubP|jMSS}!Gao4L5+5vb!23?B4e+AuvQR>6K9j5 z3NBF|`zUb|JrC^rq~P7dL|{d!TQQYg%u+`zMNVsG@zcku?Qdo3LN_B>Ydl?%;^Ub;i}(_8h*E6mhp zxF~OO*JGsl>u!I~km16F1=xsZjA|y42AfGU`@~gvMT7GwZ6JIP>kA#|7c9VZZYklbiRpuAEUI-n0xZ#(hG2Ba;0lJC+@vX$d8($E<3b zBiVMClx#~xz?2;+kb}F!bOd{EM)m^JkPyFT4cRk70_d~s#E{(g*r=QtI!uu*z7Jw9D6S(lGWtSmR|tEI&(8}iu5Zy zS{6=YfzQqw>U2iHY9%WMOt(e{taj?flvyiNSLp+x;T~{*Af;>$q)fF)H8?+{fZwwH zvuxsi_TjA87c|0*u*wUDmiLk7ll$t&S4KN9Unaa@2)FS0I;Ka}r?Q>Bm$xYERWyr$ zsT}CJ3M?H z=gi73pSM7@qtX6|T`Y7?MRv#$6mZ8VZ0q>^cC9dBkv9eB57aW#7^CE z>pZg1kVXrFUXcjhP@<}6%ChGS7>?S;o3N}4RI8^1e{qHO42|@@Nf5OEVykc6BNnru z{9D9@%$Xk_@)0#%R=b~L8}cWP_aPWLY7b$O5ruBh8=qsl^Gi!DO%7oS{kR84hHa-C zynA3&*!JaUN;8=;t#u8sHplQx4Km)@R^$$;Wb%jAP62#~U~j(S9uULoF2msNGCg+L z(!}m9m}9l#<3U@C_0#YMyoHAH{*|lmUe%@h=+NPUBnhlmumruxb=pk}yU?QE@CyxK z*h9{HsPqHp#;ZN~C4Ir8OXx}ObF8#*fq0nhD=ZUB*qEZ5@ujn*$RY-@`-_sqkD0H? zF79K8i{kK&`6+%Ym^e2svb_@xj_qruie&GU0@Uc8jSq>Lb7zWXwqfpcd{_NwZd@F3 z%^dUSJn9^PnN_H z?(P`RC4Ja(-rl?}?9EH=i*aGKk776vS@Glfhv%)7%cnl`{NdDJJpVX#Hstr7KhUc4 z{0%EdIdvYkFHok1^j-YB=d`EmVwq~nIsIU`w*qVGAE!Rgd27?{Ij5@@qnZqVL%yHa zrDrobR(f2QXvVPG(Tp>mw=Z7I@UQgfwpob(P-sR+&f8(`71*NsP3_zwq#7!d1<#ob z|G8U`G5)&KcWx9K%hRO%NiyC5qy?@AF%gvS=ekeVZ13WGT)*6`uW3MV-qC}kzxC(E4sqvF+13Fg8T1E*5(kQ5FNG}n!g1*56MkLL zn$h^axO15zX0niF@hoTA_SR#|wkhoH)f3Xn$}7q%%h!ItqI~n+KgbZ~ZrJc|o2-=& zuDQ3o%v!bS`|Izs7U)DF2=OQ{CSYn zGQaiGBNN4l5}al~gzSQ}LHZ!()+yCb1-r7+bJB4e5QL)q{9LQ8XwmW%>;Iw6_5W2d zuQ%?0=y7YQ`xTLGa9bj-J4me5y;#g_jeoXRbRFxUVKknWxAAW;ItAgQj(`RKsspxN zu=NbF)xRSMO|Uf`zREShR?;O1dxzK-o)CmG*owgho^`O9x?wkLdi#WG7_BgF90K}a zOM`985ZfNuvbuM~k9RpxQVdxQSr4J-ajsv0-V1pHatzV~8H9wsB?vK)EXY#GT1Yiy zCuA?A4e~DJ6UYE$H10$RkSs_c{zy`JkD=2uxS{N3pEVg7Gu{%&yk z?r*JnYE|&=kDeA=FZq5dvVA+tn99zwlTsy<8^gy5^Bnpzpr4lcc%965;I#QfYz=<) U`RyUWLNM&25Pa}8RlGCkUzpL$=Kufz diff --git a/pafish/Objects/MingW/pafish_private.rc b/pafish/Objects/MingW/pafish_private.rc index fe3330a..3cbad16 100644 --- a/pafish/Objects/MingW/pafish_private.rc +++ b/pafish/Objects/MingW/pafish_private.rc @@ -4,8 +4,8 @@ A ICON MOVEABLE PURE LOADONCALL DISCARDABLE "pafish.ico" 1 VERSIONINFO -FILEVERSION 0,5,5,1 -PRODUCTVERSION 0,5,5,1 +FILEVERSION 0,5,6,1 +PRODUCTVERSION 0,5,6,1 FILETYPE VFT_APP BEGIN BLOCK "StringFileInfo"