diff --git a/pafish/main.c b/pafish/main.c index 95697e2..9bb86e2 100644 --- a/pafish/main.c +++ b/pafish/main.c @@ -189,6 +189,16 @@ int main(int argc, char *argv[]) print_not_traced(); } + printf("[*] Reg key (HKLM\\HARDWARE\\ACPI\\DSDT\\VBOX__"); + if (vbox_reg_key5() == 0) { + write_log("VirtualBox traced using Reg key HKLM\\HARDWARE\\ACPI\\DSDT\\VBOX__"); + print_traced(); + write_trace("hi_virtualbox"); + } + else { + print_not_traced(); + } + if (vbox_sysfile1() == 0) { } else { diff --git a/pafish/vbox.c b/pafish/vbox.c index 1f63e97..cfad365 100644 --- a/pafish/vbox.c +++ b/pafish/vbox.c @@ -113,6 +113,26 @@ int vbox_reg_key4() { } } +/** +* ACPI Regkey detection +**/ +int vbox_reg_key5() { + HKEY regkey; + LONG retu; + char value[1024]; + int i; + DWORD size; + + size = sizeof(value); + retu = RegOpenKeyEx(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\DSDT\\VBOX__", 0, KEY_READ, ®key); + if (retu == ERROR_SUCCESS) { + return 0; + } + else { + return 1; + } +} + /** * VirtualBox Driver files in windows/system32 **/ diff --git a/pafish/vbox.h b/pafish/vbox.h index 1256eb6..44b9071 100644 --- a/pafish/vbox.h +++ b/pafish/vbox.h @@ -10,6 +10,8 @@ int vbox_reg_key3(); int vbox_reg_key4(); +int vbox_reg_key5(); + int vbox_sysfile1(); int vbox_sysfile2();