Skip to content

Commit 1486361

Browse files
AdvDebugAdvDebug
authored
Add files via upload
1 parent e3930b0 commit 1486361

7 files changed

+150
-37
lines changed

‎AntiCrack-DotNet/AntiDebug.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -389,4 +389,4 @@ public static bool PageGuardAntiDebug()
389389
return false;
390390
}
391391
}
392-
}
392+
}

‎AntiCrack-DotNet/AntiDllInjection.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -82,4 +82,4 @@ public static string SetDllLoadPolicy()
8282
return "Failed";
8383
}
8484
}
85-
}
85+
}

‎AntiCrack-DotNet/AntiVirtualization.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -315,4 +315,4 @@ public static bool CheckForQemu()
315315
return false;
316316
}
317317
}
318-
}
318+
}

‎AntiCrack-DotNet/HooksDetection.cs

+111-28
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
using System;
2-
using System.Collections.Generic;
3-
using System.Linq;
4-
using System.Text;
52
using System.Runtime.InteropServices;
63
using System.Diagnostics;
4+
using System.Reflection;
5+
using System.IO;
6+
using System.Net.Sockets;
77

88
namespace AntiCrack_DotNet
99
{
@@ -51,6 +51,20 @@ private static IntPtr LowLevelGetProcAddress(IntPtr hModule, string Function)
5151
return FunctionHandle;
5252
}
5353

54+
private static unsafe byte InternalReadByte(IntPtr ptr)
55+
{
56+
try
57+
{
58+
byte* ptr2 = (byte*)(void*)ptr;
59+
return *ptr2;
60+
}
61+
catch
62+
{
63+
64+
}
65+
return 0;
66+
}
67+
5468
public static bool DetectHooksOnCommonWinAPIFunctions(string ModuleName, string[] Functions)
5569
{
5670
string[] Libraries = { "kernel32.dll", "kernelbase.dll", "ntdll.dll", "user32.dll", "win32u.dll" };
@@ -72,9 +86,8 @@ public static bool DetectHooksOnCommonWinAPIFunctions(string ModuleName, string[
7286
foreach (string WinAPIFunction in CommonKernelLibFunctions)
7387
{
7488
IntPtr Function = LowLevelGetProcAddress(hModule, WinAPIFunction);
75-
byte[] FunctionBytes = new byte[1];
76-
Marshal.Copy(Function, FunctionBytes, 0, 1);
77-
if (FunctionBytes[0] == 0x90 || FunctionBytes[0] == 0xE9)
89+
byte FunctionByte = InternalReadByte(Function);
90+
if (FunctionByte == 0x90 || FunctionByte == 0xE9)
7891
{
7992
return true;
8093
}
@@ -93,9 +106,8 @@ public static bool DetectHooksOnCommonWinAPIFunctions(string ModuleName, string[
93106
foreach (string WinAPIFunction in CommonKernelLibFunctions)
94107
{
95108
IntPtr Function = LowLevelGetProcAddress(hModule, WinAPIFunction);
96-
byte[] FunctionBytes = new byte[1];
97-
Marshal.Copy(Function, FunctionBytes, 0, 1);
98-
if (FunctionBytes[0] == 255 || FunctionBytes[0] == 0x90 || FunctionBytes[0] == 0xE9)
109+
byte FunctionByte = InternalReadByte(Function);
110+
if (FunctionByte == 255 || FunctionByte == 0x90 || FunctionByte == 0xE9)
99111
{
100112
return true;
101113
}
@@ -114,9 +126,8 @@ public static bool DetectHooksOnCommonWinAPIFunctions(string ModuleName, string[
114126
foreach (string WinAPIFunction in CommonNtdllFunctions)
115127
{
116128
IntPtr Function = LowLevelGetProcAddress(hModule, WinAPIFunction);
117-
byte[] FunctionBytes = new byte[1];
118-
Marshal.Copy(Function, FunctionBytes, 0, 1);
119-
if (FunctionBytes[0] == 255 || FunctionBytes[0] == 0x90 || FunctionBytes[0] == 0xE9)
129+
byte FunctionByte = InternalReadByte(Function);
130+
if (FunctionByte == 255 || FunctionByte == 0x90 || FunctionByte == 0xE9)
120131
{
121132
return true;
122133
}
@@ -135,9 +146,8 @@ public static bool DetectHooksOnCommonWinAPIFunctions(string ModuleName, string[
135146
foreach (string WinAPIFunction in CommonUser32Functions)
136147
{
137148
IntPtr Function = LowLevelGetProcAddress(hModule, WinAPIFunction);
138-
byte[] FunctionBytes = new byte[1];
139-
Marshal.Copy(Function, FunctionBytes, 0, 1);
140-
if (FunctionBytes[0] == 0x90 || FunctionBytes[0] == 0xE9)
149+
byte FunctionByte = InternalReadByte(Function);
150+
if (FunctionByte == 0x90 || FunctionByte == 0xE9)
141151
{
142152
return true;
143153
}
@@ -156,9 +166,8 @@ public static bool DetectHooksOnCommonWinAPIFunctions(string ModuleName, string[
156166
foreach (string WinAPIFunction in CommonWin32uFunctions)
157167
{
158168
IntPtr Function = LowLevelGetProcAddress(hModule, WinAPIFunction);
159-
byte[] FunctionBytes = new byte[1];
160-
Marshal.Copy(Function, FunctionBytes, 0, 1);
161-
if (FunctionBytes[0] == 255 || FunctionBytes[0] == 0x90 || FunctionBytes[0] == 0xE9)
169+
byte FunctionByte = InternalReadByte(Function);
170+
if (FunctionByte == 255 || FunctionByte == 0x90 || FunctionByte == 0xE9)
162171
{
163172
return true;
164173
}
@@ -181,22 +190,21 @@ public static bool DetectHooksOnCommonWinAPIFunctions(string ModuleName, string[
181190
{
182191
IntPtr hModule = LowLevelGetModuleHandle(ModuleName);
183192
IntPtr Function = LowLevelGetProcAddress(hModule, WinAPIFunction);
184-
byte[] FunctionBytes = new byte[1];
185-
Marshal.Copy(Function, FunctionBytes, 0, 1);
186-
if (FunctionBytes[0] == 255 || FunctionBytes[0] == 0x90 || FunctionBytes[0] == 0xE9)
193+
byte FunctionByte = InternalReadByte(Function);
194+
if (FunctionByte == 255 || FunctionByte == 0x90 || FunctionByte == 0xE9)
187195
{
188196
return true;
189197
}
190198
}
191199
}
192200
catch
193201
{
202+
194203
}
195204
}
196205
return false;
197206
}
198207

199-
// Additional detection method
200208
public static bool DetectInlineHooks(string moduleName, string[] functions)
201209
{
202210
if (moduleName != null && functions != null)
@@ -205,11 +213,10 @@ public static bool DetectInlineHooks(string moduleName, string[] functions)
205213
{
206214
foreach (string function in functions)
207215
{
208-
IntPtr moduleHandle = LowLevelGetModuleHandle(moduleName);
209-
IntPtr functionHandle = LowLevelGetProcAddress(moduleHandle, function);
210-
byte[] functionBytes = new byte[1];
211-
Marshal.Copy(functionHandle, functionBytes, 0, 1);
212-
if (functionBytes[0] == 0xCC || functionBytes[0] == 0xE9)
216+
IntPtr hModule = LowLevelGetModuleHandle(moduleName);
217+
IntPtr Function = LowLevelGetProcAddress(hModule, function);
218+
byte FunctionByte = InternalReadByte(Function);
219+
if (FunctionByte == 255 || FunctionByte == 0x90 || FunctionByte == 0xE9)
213220
{
214221
return true;
215222
}
@@ -219,5 +226,81 @@ public static bool DetectInlineHooks(string moduleName, string[] functions)
219226
}
220227
return false;
221228
}
229+
230+
public static bool DetectCLRHooks()
231+
{
232+
if (IntPtr.Size == 4)
233+
{
234+
try
235+
{
236+
MethodInfo[] ProcessMethods = typeof(Process).GetMethods();
237+
MethodInfo[] AssemblyMethods = typeof(Assembly).GetMethods();
238+
MethodInfo[] FileMethods = typeof(File).GetMethods();
239+
MethodInfo[] SocketMethods = typeof(Socket).GetMethods();
240+
MethodInfo[] MarshalMethods = typeof(Marshal).GetMethods();
241+
MethodInfo[] StringMethods = typeof(string).GetMethods();
242+
foreach (MethodInfo ProcessMethod in ProcessMethods)
243+
{
244+
byte FirstByte = InternalReadByte(ProcessMethod.MethodHandle.GetFunctionPointer());
245+
if (FirstByte == 0xE9 || FirstByte == 255)
246+
{
247+
return true;
248+
}
249+
}
250+
251+
foreach (MethodInfo AssemblyMethod in AssemblyMethods)
252+
{
253+
byte FirstByte = InternalReadByte(AssemblyMethod.MethodHandle.GetFunctionPointer());
254+
if (FirstByte == 0xE9 || FirstByte == 255)
255+
return true;
256+
}
257+
258+
foreach (MethodInfo FileMethod in FileMethods)
259+
{
260+
byte FirstByte = InternalReadByte(FileMethod.MethodHandle.GetFunctionPointer());
261+
if (FirstByte == 0xE9 || FirstByte == 255)
262+
return true;
263+
}
264+
265+
foreach (MethodInfo SocketMethod in SocketMethods)
266+
{
267+
byte FirstByte = InternalReadByte(SocketMethod.MethodHandle.GetFunctionPointer());
268+
if (FirstByte == 0xE9 || FirstByte == 255)
269+
return true;
270+
}
271+
272+
foreach (MethodInfo MarshalMethod in MarshalMethods)
273+
{
274+
byte FirstByte = InternalReadByte(MarshalMethod.MethodHandle.GetFunctionPointer());
275+
if (FirstByte == 0xE9 || FirstByte == 255)
276+
return true;
277+
}
278+
279+
foreach (MethodInfo StringMethod in StringMethods)
280+
{
281+
byte FirstByte = InternalReadByte(StringMethod.MethodHandle.GetFunctionPointer());
282+
if (FirstByte == 0xE9 || FirstByte == 255)
283+
return true;
284+
}
285+
286+
Type[] AllTypes = Assembly.GetExecutingAssembly().GetTypes();
287+
foreach (Type type in AllTypes)
288+
{
289+
MethodInfo[] AllMethods = type.GetMethods();
290+
foreach (MethodInfo Method in AllMethods)
291+
{
292+
byte FirstByte = InternalReadByte(Method.MethodHandle.GetFunctionPointer());
293+
if (FirstByte == 0xE9 || FirstByte == 255)
294+
return true;
295+
}
296+
}
297+
}
298+
catch
299+
{
300+
301+
}
302+
}
303+
return false;
304+
}
222305
}
223-
}
306+
}

‎AntiCrack-DotNet/OtherChecks.cs

+28-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
using System;
2+
using System.Collections.Generic;
3+
using System.Linq;
4+
using System.Text;
5+
using System.Threading.Tasks;
26
using System.Runtime.InteropServices;
7+
using System.Reflection;
8+
using System.Windows.Forms;
9+
using System.Diagnostics;
10+
using System.Runtime.CompilerServices;
11+
using System.Threading;
12+
using System.Security;
313
using Microsoft.Win32;
414

515
namespace AntiCrack_DotNet
@@ -15,10 +25,14 @@ public class OtherChecks
1525
[DllImport("ntdll.dll", SetLastError = true)]
1626
private static extern uint NtQuerySystemInformation(uint SystemInformationClass, ref Structs.SYSTEM_SECUREBOOT_INFORMATION SystemInformation, uint SystemInformationLength, out uint ReturnLength);
1727

18-
private static uint SystemCodeIntegrityInformation = 0x67;
28+
[DllImport("QCall", CharSet = CharSet.Unicode)]
29+
[SecurityCritical]
30+
[SuppressUnmanagedCodeSecurity]
31+
private static extern void GetExecutingAssembly(uint stackMark, IntPtr retAssembly);
1932

2033
public static bool IsUnsignedDriversAllowed()
2134
{
35+
uint SystemCodeIntegrityInformation = 0x67;
2236
Structs.SYSTEM_CODEINTEGRITY_INFORMATION CodeIntegrityInfo = new Structs.SYSTEM_CODEINTEGRITY_INFORMATION();
2337
CodeIntegrityInfo.Length = (uint)Marshal.SizeOf(typeof(Structs.SYSTEM_CODEINTEGRITY_INFORMATION));
2438
uint ReturnLength = 0;
@@ -35,6 +49,7 @@ public static bool IsUnsignedDriversAllowed()
3549

3650
public static bool IsTestSignedDriversAllowed()
3751
{
52+
uint SystemCodeIntegrityInformation = 0x67;
3853
Structs.SYSTEM_CODEINTEGRITY_INFORMATION CodeIntegrityInfo = new Structs.SYSTEM_CODEINTEGRITY_INFORMATION();
3954
CodeIntegrityInfo.Length = (uint)Marshal.SizeOf(typeof(Structs.SYSTEM_CODEINTEGRITY_INFORMATION));
4055
uint ReturnLength = 0;
@@ -77,11 +92,12 @@ public static bool IsSecureBootEnabled()
7792
{
7893
if (!SecureBoot.SecureBootCapable)
7994
return false;
80-
if (!SecureBoot.SecureBootEnabled)
95+
if (SecureBoot.SecureBootEnabled)
8196
return true;
8297
}
8398
return false;
8499
}
100+
85101
public static bool IsVirtualizationBasedSecurityEnabled()
86102
{
87103
try
@@ -127,5 +143,14 @@ public static bool IsMemoryIntegrityEnabled()
127143
}
128144
return false;
129145
}
146+
147+
public static bool IsInovkedAssembly()
148+
{
149+
MethodInfo Method = typeof(Assembly).GetMethod("GetExecutingAssembly");
150+
Assembly GetCallingAssem = (Assembly)Method.Invoke(null, null);
151+
if (GetCallingAssem.Location != Application.ExecutablePath)
152+
return true;
153+
return false;
154+
}
130155
}
131-
}
156+
}

‎AntiCrack-DotNet/Program.cs

+7-2
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ private static void ExecuteAntiVirtualizationTricks()
105105
{
106106
ConsoleConfig.DisplayHeader("Executing Anti Virtualization Tricks");
107107
ConsoleConfig.DisplayResult("Checking For Triage: ", AntiVirtualization.TriageCheck(), "Checks if Triage is present through disk.");
108+
ConsoleConfig.DisplayResult("Checking For Qemu: ", AntiVirtualization.CheckForQemu(), "Checks if running under Qemu.");
108109
ConsoleConfig.DisplayResult("Checking For Sandboxie Module in Current Process: ", AntiVirtualization.IsSandboxiePresent(), "Checks if Sandboxie is present.");
109110
ConsoleConfig.DisplayResult("Checking For Comodo Sandbox Module in Current Process: ", AntiVirtualization.IsComodoSandboxPresent(), "Checks if Comodo Sandbox is present.");
110111
ConsoleConfig.DisplayResult("Checking For Cuckoo Sandbox Module in Current Process: ", AntiVirtualization.IsCuckooSandboxPresent(), "Checks if Cuckoo Sandbox is present.");
@@ -127,8 +128,8 @@ private static void ExecuteAntiVirtualizationTricks()
127128
private static void ExecuteAntiDllInjectionTricks()
128129
{
129130
ConsoleConfig.DisplayHeader("Executing Anti DLL Injection Tricks");
130-
ConsoleConfig.DisplayResult("Patching and Changing LoadLibraryA Page Protection To Prevent DLL Injection..... ", AntiDllInjection.PatchLoadLibraryA(), "Patches LoadLibraryA to prevent DLL injection.");
131-
ConsoleConfig.DisplayResult("Patching and Changing LoadLibraryW Page Protection To Prevent DLL Injection..... ", AntiDllInjection.PatchLoadLibraryW(), "Patches LoadLibraryW to prevent DLL injection.");
131+
ConsoleConfig.DisplayResult("Patching LoadLibraryA To Prevent DLL Injection..... ", AntiDllInjection.PatchLoadLibraryA(), "Patches LoadLibraryA to prevent DLL injection.");
132+
ConsoleConfig.DisplayResult("Patching LoadLibraryW To Prevent DLL Injection..... ", AntiDllInjection.PatchLoadLibraryW(), "Patches LoadLibraryW to prevent DLL injection.");
132133
ConsoleConfig.DisplayResult("Taking Advantage of Binary Image Signature Mitigation Policy to Prevent Non-Microsoft Binaries From Being Injected..... ", AntiDllInjection.BinaryImageSignatureMitigationAntiDllInjection(), "Enforces binary image signature mitigation policy.");
133134
ConsoleConfig.DisplayResult("Checking if any injected libraries are present (simple DLL path whitelist check): ", AntiDllInjection.IsInjectedLibrary(), "Checks for injected libraries.");
134135
ConsoleConfig.DisplayFooter();
@@ -141,13 +142,17 @@ private static void ExecuteOtherDetectionTricks()
141142
ConsoleConfig.DisplayResult("Detecting if Test-Signed Drivers are Allowed to Load: ", OtherChecks.IsTestSignedDriversAllowed(), "Checks if test-signed drivers are allowed.");
142143
ConsoleConfig.DisplayResult("Detecting if Kernel Debugging is Enabled on the System: ", OtherChecks.IsKernelDebuggingEnabled(), "Checks if kernel debugging is enabled.");
143144
ConsoleConfig.DisplayResult("Detecting if Secure Boot is Enabled on the System: ", OtherChecks.IsSecureBootEnabled(), "Checks if secure boot is enabled.");
145+
ConsoleConfig.DisplayResult("Detecting if Virtualization-Based Security is Enabled: ", OtherChecks.IsVirtualizationBasedSecurityEnabled(), "Checks if VBS is enabled.");
146+
ConsoleConfig.DisplayResult("Detecting if Memory Integrity Protection is Enabled: ", OtherChecks.IsMemoryIntegrityEnabled(), "Checks if Memory Integrity is enabled.");
147+
ConsoleConfig.DisplayResult("Detecting if the current assembly has been invoked by another one: ", OtherChecks.IsInovkedAssembly(), "Checks if assembly has been invoked.");
144148
ConsoleConfig.DisplayFooter();
145149
}
146150

147151
private static void ExecuteHooksDetectionTricks()
148152
{
149153
ConsoleConfig.DisplayHeader("Executing Hooks Detection Tricks");
150154
ConsoleConfig.DisplayResult("Detecting Hooks on Common WinAPI Functions by checking for Bad Instructions on Functions Addresses (Most Effective on x64): ", HooksDetection.DetectHooksOnCommonWinAPIFunctions(null, null), "Detects hooks on common WinAPI functions.");
155+
ConsoleConfig.DisplayResult("Detecting Hooks on CLR Functions (x86 only): ", HooksDetection.DetectCLRHooks(), "Detects hooks on CLR Functions.");
151156
ConsoleConfig.DisplayFooter();
152157
}
153158

‎AntiCrack-DotNet/Structs.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -102,4 +102,4 @@ public struct SYSTEM_INFO
102102
public ushort ProcessorRevision;
103103
}
104104
}
105-
}
105+
}

0 commit comments

Comments
 (0)