└── AntiVM ├── AntiVM.sln ├── AntiVM ├── AntiVM.cpp ├── AntiVM.vcxproj ├── AntiVM.vcxproj.filters ├── AntiVM.vcxproj.user ├── AntiVMClass.h └── x64 │ └── Debug │ ├── AntiVM.exe.recipe │ ├── AntiVM.ilk │ ├── AntiVM.log │ ├── AntiVM.obj │ ├── AntiVM.tlog │ ├── AntiVM.lastbuildstate │ ├── CL.command.1.tlog │ ├── CL.read.1.tlog │ ├── CL.write.1.tlog │ ├── Cl.items.tlog │ ├── link.command.1.tlog │ ├── link.read.2.tlog │ └── link.write.1.tlog │ ├── vc143.idb │ ├── vc143.pdb │ └── vcpkg.applocal.log └── x64 └── Debug ├── AntiVM.exe └── AntiVM.pdb /AntiVM/AntiVM.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.7.34221.43 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "AntiVM", "AntiVM\AntiVM.vcxproj", "{7A9A54CF-6CC7-4591-BE2C-AB6A0852186F}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {7A9A54CF-6CC7-4591-BE2C-AB6A0852186F}.Debug|x64.ActiveCfg = Debug|x64 17 | {7A9A54CF-6CC7-4591-BE2C-AB6A0852186F}.Debug|x64.Build.0 = Debug|x64 18 | {7A9A54CF-6CC7-4591-BE2C-AB6A0852186F}.Debug|x86.ActiveCfg = Debug|Win32 19 | {7A9A54CF-6CC7-4591-BE2C-AB6A0852186F}.Debug|x86.Build.0 = Debug|Win32 20 | {7A9A54CF-6CC7-4591-BE2C-AB6A0852186F}.Release|x64.ActiveCfg = Release|x64 21 | {7A9A54CF-6CC7-4591-BE2C-AB6A0852186F}.Release|x64.Build.0 = Release|x64 22 | {7A9A54CF-6CC7-4591-BE2C-AB6A0852186F}.Release|x86.ActiveCfg = Release|Win32 23 | {7A9A54CF-6CC7-4591-BE2C-AB6A0852186F}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {05B02259-4FCD-415F-9961-07FEA58681D1} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /AntiVM/AntiVM/AntiVM.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include "AntiVMClass.h" 3 | 4 | int main() 5 | { 6 | std::cout << "Hello World!\n"; 7 | AntiVM antiVM; 8 | antiVM = AntiVM(); 9 | } 10 | 11 | -------------------------------------------------------------------------------- /AntiVM/AntiVM/AntiVM.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 17.0 23 | Win32Proj 24 | {7a9a54cf-6cc7-4591-be2c-ab6a0852186f} 25 | AntiVM 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v143 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v143 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v143 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v143 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | Level3 76 | true 77 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 78 | true 79 | 80 | 81 | Console 82 | true 83 | 84 | 85 | 86 | 87 | Level3 88 | true 89 | true 90 | true 91 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 92 | true 93 | 94 | 95 | Console 96 | true 97 | true 98 | true 99 | 100 | 101 | 102 | 103 | Level3 104 | true 105 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 106 | true 107 | 108 | 109 | Console 110 | true 111 | 112 | 113 | 114 | 115 | Level3 116 | true 117 | true 118 | true 119 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 120 | true 121 | 122 | 123 | Console 124 | true 125 | true 126 | true 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | -------------------------------------------------------------------------------- /AntiVM/AntiVM/AntiVM.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | 23 | 24 | Header Files 25 | 26 | 27 | -------------------------------------------------------------------------------- /AntiVM/AntiVM/AntiVM.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /AntiVM/AntiVM/AntiVMClass.h: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | 9 | #pragma comment(lib, "ws2_32.lib") 10 | #pragma comment(lib, "iphlpapi.lib") 11 | #pragma comment(lib, "Mpr.lib") 12 | 13 | 14 | using namespace std; 15 | 16 | class AntiVM{ 17 | public: 18 | AntiVM() { 19 | const std::wstring vmwareSubKey = s2ws("SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000"); 20 | bool vmwareDriverDescCheck = CheckRegistryKey(HKEY_LOCAL_MACHINE, vmwareSubKey, s2ws("DriverDesc"), s2ws("VMware SCSI Controller")); 21 | bool vmwareProviderNameCheck = CheckRegistryKey(HKEY_LOCAL_MACHINE, vmwareSubKey, s2ws("ProviderName"), s2ws("VMware, Inc.")); 22 | 23 | // VirtualBox keys 24 | const std::wstring virtualboxSubKey = s2ws("SOFTWARE\\Oracle\\VirtualBox Guest Additions"); 25 | bool virtualboxCheck = CheckRegistryKeyExists(HKEY_LOCAL_MACHINE, virtualboxSubKey); 26 | 27 | 28 | if (vmwareProviderNameCheck || virtualboxCheck || vmwareDriverDescCheck) { 29 | exit(0); 30 | } 31 | 32 | checkProvider(); 33 | detectVMViaMac(); 34 | checkVirtualBoxSharedFolders(); 35 | int ram = getRam(); 36 | if (ram < 1024) { 37 | exit(0); 38 | } 39 | } 40 | 41 | private: 42 | bool x = false; 43 | int __cdecl Handler(EXCEPTION_RECORD* pRec, void* est, unsigned char* pContext, void* disp) 44 | { 45 | x = true; 46 | (*(unsigned long*)(pContext + 0xB8)) += 4; 47 | return ExceptionContinueExecution; 48 | } 49 | 50 | int getRam() { 51 | MEMORYSTATUSEX memInfo; 52 | memInfo.dwLength = sizeof(memInfo); 53 | GlobalMemoryStatusEx(&memInfo); 54 | return memInfo.ullTotalPhys / 1024 / 1024; 55 | } 56 | 57 | std::wstring s2ws(const std::string& str) { 58 | std::wstring_convert> converter; 59 | return converter.from_bytes(str); 60 | } 61 | 62 | bool CheckRegistryKey(HKEY hKeyRoot, const std::wstring& subKey, const std::wstring& valueName, const std::wstring& expectedValue) { 63 | HKEY hKey; 64 | if (RegOpenKeyExW(hKeyRoot, subKey.c_str(), 0, KEY_READ, &hKey) != ERROR_SUCCESS) { 65 | return false; 66 | } 67 | 68 | wchar_t value[256]; 69 | DWORD valueLength = sizeof(value); 70 | if (RegQueryValueExW(hKey, valueName.c_str(), nullptr, nullptr, (LPBYTE)value, &valueLength) != ERROR_SUCCESS) { 71 | RegCloseKey(hKey); 72 | return false; 73 | } 74 | 75 | RegCloseKey(hKey); 76 | 77 | return std::wstring(value, valueLength / sizeof(wchar_t) - 1) == expectedValue; 78 | } 79 | 80 | bool CheckRegistryKeyExists(HKEY hKeyRoot, const std::wstring& subKey) { 81 | HKEY hKey; 82 | if (RegOpenKeyExW(hKeyRoot, subKey.c_str(), 0, KEY_READ, &hKey) == ERROR_SUCCESS) { 83 | RegCloseKey(hKey); 84 | return true; 85 | } 86 | return false; 87 | } 88 | 89 | int checkProvider() { 90 | unsigned long pnsize = 0x1000; 91 | LPWSTR provider = (LPWSTR)LocalAlloc(LMEM_ZEROINIT, pnsize * sizeof(WCHAR)); 92 | int retv = WNetGetProviderName(WNNC_NET_RDR2SAMPLE, provider, &pnsize); 93 | if (retv == NO_ERROR) 94 | { 95 | if (lstrcmpi(provider, L"VirtualBox Shared Folders") == 0) 96 | { 97 | ExitProcess(9); 98 | } 99 | } 100 | return 0; 101 | } 102 | 103 | int detectVMViaMac() { 104 | WSADATA WSD; 105 | if (!WSAStartup(MAKEWORD(2, 2), &WSD)) 106 | { 107 | unsigned long tot_size = 0; 108 | int ret = GetAdaptersAddresses(AF_UNSPEC, GAA_FLAG_INCLUDE_PREFIX, 0, 0, &tot_size); 109 | if (ret == ERROR_BUFFER_OVERFLOW) 110 | { 111 | IP_ADAPTER_ADDRESSES* px = (IP_ADAPTER_ADDRESSES*)LocalAlloc(LMEM_ZEROINIT, tot_size); 112 | if (px) 113 | { 114 | ret = GetAdaptersAddresses(AF_UNSPEC, GAA_FLAG_INCLUDE_PREFIX, 0, px, &tot_size); 115 | IP_ADAPTER_ADDRESSES* pxx = px; 116 | //Traverse a singly-linked list 117 | for (pxx; pxx; pxx = pxx->Next) 118 | { 119 | if (pxx->PhysicalAddressLength == 0x6) 120 | { 121 | if (_wcsicmp(pxx->FriendlyName, L"VirtualBox Host-Only Network")) //We don't want to detect the HOST OS 122 | { 123 | char xx[0x6] = { 0 }; 124 | memcpy(xx, pxx->PhysicalAddress, 0x6); 125 | if (xx[0] == 0x08 && xx[1] == 0x00 && xx[2] == 0x27) //Cadmus Computer Systems Mac address 126 | { 127 | exit(0); 128 | } 129 | } 130 | } 131 | } 132 | LocalFree(px); 133 | } 134 | } 135 | WSACleanup(); 136 | } 137 | } 138 | 139 | int checkVirtualBoxSharedFolders() { 140 | for (WCHAR x = L'A'; x <= L'Z'; x++) { 141 | WCHAR drv[4] = { 0 }; 142 | drv[0] = x; 143 | drv[1] = L':'; 144 | drv[2] = L'\\'; 145 | 146 | if (DRIVE_REMOTE == GetDriveType(drv)) { 147 | WCHAR FSName[0x110] = { 0 }; 148 | if (GetVolumeInformation(drv, NULL, 0, NULL, NULL, NULL, FSName, 0x100)) { 149 | if (lstrcmpiW(L"VBoxSharedFolderFS", FSName) == 0) { 150 | exit(0); 151 | } 152 | else { 153 | wprintf(L"%s %s\r\n", drv, FSName); 154 | } 155 | } 156 | } 157 | } 158 | return 0; 159 | } 160 | 161 | 162 | 163 | }; -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.exe.recipe: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | V:\S12\Evasion\AntiVM\AntiVM\x64\Debug\AntiVM.exe 6 | 7 | 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.ilk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/AntiVM/x64/Debug/AntiVM.ilk -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.log: -------------------------------------------------------------------------------- 1 |  AntiVM.cpp 2 | V:\S12\Evasion\AntiVM\AntiVM\AntiVM\AntiVMClass.h(54,38): warning C4244: 'return': conversion from 'DWORDLONG' to 'int', possible loss of data 3 | V:\S12\Evasion\AntiVM\AntiVM\AntiVM\AntiVMClass.h(137): warning C4715: 'AntiVM::detectVMViaMac': not all control paths return a value 4 | AntiVM.vcxproj -> V:\S12\Evasion\AntiVM\AntiVM\x64\Debug\AntiVM.exe 5 | 'pwsh.exe' is not recognized as an internal or external command, 6 | operable program or batch file. 7 | -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.obj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/AntiVM/x64/Debug/AntiVM.obj -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.tlog/AntiVM.lastbuildstate: -------------------------------------------------------------------------------- 1 | PlatformToolSet=v143:VCToolArchitecture=Native64Bit:VCToolsVersion=14.37.32822:TargetPlatformVersion=10.0.22621.0:VcpkgTriplet=x64-windows: 2 | Debug|x64|V:\S12\Evasion\AntiVM\AntiVM\| 3 | -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.tlog/CL.command.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/AntiVM/x64/Debug/AntiVM.tlog/CL.command.1.tlog -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.tlog/CL.read.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/AntiVM/x64/Debug/AntiVM.tlog/CL.read.1.tlog -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.tlog/CL.write.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/AntiVM/x64/Debug/AntiVM.tlog/CL.write.1.tlog -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.tlog/Cl.items.tlog: -------------------------------------------------------------------------------- 1 | V:\S12\Evasion\AntiVM\AntiVM\AntiVM\AntiVM.cpp;V:\S12\Evasion\AntiVM\AntiVM\AntiVM\x64\Debug\AntiVM.obj 2 | -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.tlog/link.command.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/AntiVM/x64/Debug/AntiVM.tlog/link.command.1.tlog -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.tlog/link.read.2.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/AntiVM/x64/Debug/AntiVM.tlog/link.read.2.tlog -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/AntiVM.tlog/link.write.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/AntiVM/x64/Debug/AntiVM.tlog/link.write.1.tlog -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/vc143.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/AntiVM/x64/Debug/vc143.idb -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/vc143.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/AntiVM/x64/Debug/vc143.pdb -------------------------------------------------------------------------------- /AntiVM/AntiVM/x64/Debug/vcpkg.applocal.log: -------------------------------------------------------------------------------- 1 |  2 | -------------------------------------------------------------------------------- /AntiVM/x64/Debug/AntiVM.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/x64/Debug/AntiVM.exe -------------------------------------------------------------------------------- /AntiVM/x64/Debug/AntiVM.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S12cybersecurity/AntiVM/cf55efff0213a22ddabc9c8bc7e108af32b1226e/AntiVM/x64/Debug/AntiVM.pdb --------------------------------------------------------------------------------