Skip to content

Commit 03fca0f

Browse files
authored
Update README.md
1 parent c9dd637 commit 03fca0f

File tree

1 file changed

+11
-1
lines changed

1 file changed

+11
-1
lines changed

README.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ A C# Project which Contains some Anti-Cracking, anti memory injection techniques
1212

1313
* IsDebuggerPresent
1414

15+
* NtSetDebugFilterState
16+
17+
* Page Guard Breakpoints Detection
18+
1519
* NtQueryInformationProcess: ProcessDebugFlags, ProcessDebugPort, ProcessDebugObjectHandle
1620

1721
* NtClose: Invalid Handle, Protected Handle
@@ -61,22 +65,28 @@ A C# Project which Contains some Anti-Cracking, anti memory injection techniques
6165

6266
* Making Sandboxie Crash Your Application (this exploit no longer works, it's patched by sandboxie, that's what i get for making things public :), now it works only with older versions of sandboxie)
6367

68+
* Checking for devices created by VMs or Sandboxes
69+
6470
## Anti Dll Injection
6571
* Patching LoadLibraryA
6672

6773
* Patching LoadLibraryW
6874

6975
* Taking Advantage of Binary Image Signature Mitigation Policy to prevent injecting Non-Microsoft Binaries.
7076

77+
* Checking if any injected libraries are present (simple dlls path whitelist check)
78+
7179
## Other Detections
7280
* Detecting if Unsigned Drivers are Allowed to Load
7381

7482
* Detecting if Test-Signed Drivers are Allowed to Load
7583

7684
* Detecting if Kernel Debugging are Enabled on the System
7785

86+
* Detecting if Secure Boot are Enabled on the System
87+
7888
## Hooks Detection
79-
* Detecting Most Anti Anti-Debugging Hooking Methods on Common Anti-Debugging Functions by checking for Bad Instructions on Functions Addresses (Most Effective on x64), and it can also detect some sandboxes which uses hooking to monitor application behaviour/activity (like <a href="https://github.com/sandboxie-plus/Sandboxie">Sandboxie/Sandboxie Plus</a>, <a href="https://www.hybrid-analysis.com">Hybrid Analysis</a>, <a href="https://cuckoosandbox.org/">Cuckoo Sandbox</a>, and a lot of other online malware analysis websites/applications).
89+
* Detecting Most Anti Anti-Debugging Hooking Methods on Common Anti-Debugging Functions by checking for Bad Instructions on Functions Addresses (Most Effective on x64) and it detects user-mode anti anti-debuggers like scyllahide, and it can also detect some sandboxes which uses hooking to monitor application behaviour/activity (like <a href="https://github.com/sandboxie-plus/Sandboxie">Sandboxie/Sandboxie Plus</a>, <a href="https://www.hybrid-analysis.com">Hybrid Analysis</a>, <a href="https://cuckoosandbox.org/">Cuckoo Sandbox</a>, and a lot of other online malware analysis websites/applications).
8090

8191
# Notice
8292
This Project are created for educational purposes only, also this project are licensed under MIT License.

0 commit comments

Comments
 (0)