You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -61,22 +65,28 @@ A C# Project which Contains some Anti-Cracking, anti memory injection techniques
61
65
62
66
* Making Sandboxie Crash Your Application (this exploit no longer works, it's patched by sandboxie, that's what i get for making things public :), now it works only with older versions of sandboxie)
63
67
68
+
* Checking for devices created by VMs or Sandboxes
69
+
64
70
## Anti Dll Injection
65
71
* Patching LoadLibraryA
66
72
67
73
* Patching LoadLibraryW
68
74
69
75
* Taking Advantage of Binary Image Signature Mitigation Policy to prevent injecting Non-Microsoft Binaries.
70
76
77
+
* Checking if any injected libraries are present (simple dlls path whitelist check)
78
+
71
79
## Other Detections
72
80
* Detecting if Unsigned Drivers are Allowed to Load
73
81
74
82
* Detecting if Test-Signed Drivers are Allowed to Load
75
83
76
84
* Detecting if Kernel Debugging are Enabled on the System
77
85
86
+
* Detecting if Secure Boot are Enabled on the System
87
+
78
88
## Hooks Detection
79
-
* Detecting Most Anti Anti-Debugging Hooking Methods on Common Anti-Debugging Functions by checking for Bad Instructions on Functions Addresses (Most Effective on x64), and it can also detect some sandboxes which uses hooking to monitor application behaviour/activity (like <ahref="https://github.com/sandboxie-plus/Sandboxie">Sandboxie/Sandboxie Plus</a>, <ahref="https://www.hybrid-analysis.com">Hybrid Analysis</a>, <ahref="https://cuckoosandbox.org/">Cuckoo Sandbox</a>, and a lot of other online malware analysis websites/applications).
89
+
* Detecting Most Anti Anti-Debugging Hooking Methods on Common Anti-Debugging Functions by checking for Bad Instructions on Functions Addresses (Most Effective on x64) and it detects user-mode anti anti-debuggers like scyllahide, and it can also detect some sandboxes which uses hooking to monitor application behaviour/activity (like <ahref="https://github.com/sandboxie-plus/Sandboxie">Sandboxie/Sandboxie Plus</a>, <ahref="https://www.hybrid-analysis.com">Hybrid Analysis</a>, <ahref="https://cuckoosandbox.org/">Cuckoo Sandbox</a>, and a lot of other online malware analysis websites/applications).
80
90
81
91
# Notice
82
92
This Project are created for educational purposes only, also this project are licensed under MIT License.
0 commit comments