mirrors/pafish
1
0
Fork 0
mirror of https://github.com/a0rtega/pafish synced 2024-11-22 06:11:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

Add generic sandbox / dbg detection using rdtsc instruction

Browse Source
This commit is contained in:
Alberto Ortega 2015-03-13 13:34:59 +01:00
parent 638a7cd84e
commit ae8dc5842c
3 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pafish/gensandbox.c
View File

@ -2,6 +2,7 @@
#include <windows.h>
#include <winioctl.h>
#include <string.h>
#include <stdint.h>
#include "types.h"
#include "gensandbox.h"
@ -102,3 +103,11 @@ int gensandbox_sleep_patched() {
if ((GetTickCount() - time1) > 450 ) return FALSE;
else return TRUE;
}
int gensandbox_rdtsc() {
uint64_t ret, ret2;
asm volatile ( "rdtsc" : "=A"(ret) );
asm volatile ( "rdtsc" : "=A"(ret2) );
return (ret2 - ret) > 1000 ? TRUE : FALSE;
}

2
pafish/gensandbox.h
View File

@ -14,4 +14,6 @@ int gensandbox_drive_size2();
int gensandbox_sleep_patched();
int gensandbox_rdtsc();
#endif

8
pafish/main.c
View File

@ -125,6 +125,14 @@ int main(int argc, char *argv[])
}
else print_not_traced();
printf("[*] Checking the difference between CPU timestamp counters (rdtsc) ... ");
if (gensandbox_rdtsc() == TRUE) {
print_traced();
write_log("Sandbox traced by checking the difference between CPU timestamp counters (rdtsc)");
write_trace("hi_sandbox_rdtsc");
}
else print_not_traced();
/* Hooks detection tricks */
printf("\n[-] Hooks detection\n");
printf("[*] Checking function DeleteFileW method 1 ... ");