From e2ea0340b61360bb52718993b50d39ac139dc592 Mon Sep 17 00:00:00 2001
From: Thorsten Sick <thorsten.sick@avira.com>
Date: Mon, 17 Feb 2014 10:15:24 +0100
Subject: [PATCH] ACPI key added

---
 pafish/main.c | 10 ++++++++++
 pafish/vbox.c | 20 ++++++++++++++++++++
 pafish/vbox.h |  2 ++
 3 files changed, 32 insertions(+)

diff --git a/pafish/main.c b/pafish/main.c
index 95697e2..9bb86e2 100644
--- a/pafish/main.c
+++ b/pafish/main.c
@@ -189,6 +189,16 @@ int main(int argc, char *argv[])
         print_not_traced();
     }
 
+    printf("[*] Reg key (HKLM\\HARDWARE\\ACPI\\DSDT\\VBOX__");
+    if (vbox_reg_key5() == 0) {
+        write_log("VirtualBox traced using Reg key HKLM\\HARDWARE\\ACPI\\DSDT\\VBOX__");
+        print_traced();
+        write_trace("hi_virtualbox");
+    }
+    else {
+        print_not_traced();
+    }
+
     if (vbox_sysfile1() == 0) {        
     }
     else {
diff --git a/pafish/vbox.c b/pafish/vbox.c
index 1f63e97..cfad365 100644
--- a/pafish/vbox.c
+++ b/pafish/vbox.c
@@ -113,6 +113,26 @@ int vbox_reg_key4() {
     }
 }
 
+/**
+* ACPI Regkey detection
+**/
+int vbox_reg_key5() {
+    HKEY regkey;
+    LONG retu;
+    char value[1024];
+    int i;
+    DWORD size;
+    
+    size = sizeof(value);
+    retu = RegOpenKeyEx(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\DSDT\\VBOX__", 0, KEY_READ, &regkey);
+    if (retu == ERROR_SUCCESS) {
+        return 0;
+    }
+    else {
+        return 1;
+    }
+}
+
 /**
 * VirtualBox Driver files in windows/system32
 **/
diff --git a/pafish/vbox.h b/pafish/vbox.h
index 1256eb6..44b9071 100644
--- a/pafish/vbox.h
+++ b/pafish/vbox.h
@@ -10,6 +10,8 @@ int vbox_reg_key3();
 
 int vbox_reg_key4();
 
+int vbox_reg_key5();
+
 int vbox_sysfile1();
 
 int vbox_sysfile2();