Anti-Wireshark und Anti-VM Methoden

[G36KV]

Entstanden aus dem Thread: http://free-hack.com/video-tutorials...rk-modden.html

Credits: BlackBerry, Microsoft, istealer
Sprache: Mix aus C und C++, programmiert mit VS 2010

5 Anti-Wireshark Methoden
2 Anti-VM Methoden

werde wohl noch paar mehr adden, wenn ich Zeit hab... Wenn jemand noch welche hat einfach posten...

Includes und Prototypes weggekürzt so dass es in den Thread passt.

DWORD pid;

DWORD get_wireshark_1(void)
{
	HWND hwnd;
	pid = 0;

	if ((hwnd = FindWindow("gdkWindowToplevel", 0)))
	{
		GetWindowThreadProcessId(hwnd, &pid);
		return pid;
	}
	return 0;
}

DWORD get_wireshark_2(void)
{
	DWORD processes[100];
	DWORD szneeded1;
	DWORD szneeded2;
	HANDLE hProcess;
	HMODULE mods[100];
	char pname[50];
	DWORD i;
	DWORD j;

	if (!EnumProcesses(processes, sizeof(processes), &szneeded1))
		return 0;
	for(i = 0; i < (szneeded1 / sizeof(DWORD) ); i++)
	{
		if (!(hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, 0, processes[i])))
			continue;
		if (!(EnumProcessModules(hProcess, mods, sizeof(mods), &szneeded2)))
			continue;

		for(j = 0; j < (szneeded2 / sizeof(HMODULE)); j++)
		{
			if (GetModuleBaseName(hProcess, mods[j], pname, sizeof(pname) - 1))
			{
				if (!_stricmp(pname, "libwireshark.dll"))
				{
					pid = processes[i];
					return pid;
				}
			}
		}
	}
	return 0;
}

DWORD get_wireshark_3(void)
{
	pid = 0;
	EnumWindows((WNDENUMPROC)ShowAllWindows, 0);
	return pid;
}

DWORD get_wireshark_4(void) {
	HANDLE hProcessSnap;
	PROCESSENTRY32 pe32;
	pid = 0;
	hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
	pe32.dwSize = sizeof( PROCESSENTRY32 );
	Process32First( hProcessSnap, &pe32 );

	do {
		if (!_stricmp(pe32.szExeFile, "dumpcap.exe") || !_stricmp(pe32.szExeFile, "wireshark.exe"))
		{
			pid = pe32.th32ProcessID;
			break;
		}

	} while( Process32Next( hProcessSnap, &pe32 ) );

	CloseHandle( hProcessSnap );

	return pid;
}

void get_wireshark_5(void)
{
	char pfad[MAX_PATH];

	SHGetSpecialFolderPath(0,pfad, CSIDL_PROGRAM_FILES, FALSE);

	strcat_s(pfad, MAX_PATH, "\\Wireshark");

	if (GetFileAttributes(pfad) != INVALID_FILE_ATTRIBUTES)
	{
		printf("Wireshark found - Method 5\n");
	}
}

BOOL CALLBACK ShowAllWindows(HWND hwnd,LPARAM lParam)
{
	char pcWinTitle[256];
	GetWindowText(hwnd, pcWinTitle, 255);
	std::string s = pcWinTitle;
	if ((s.find("ireshark") != -1) || (s.find("Analyzer") != -1) || (s.find("Capturing") != -1))
	{
		GetWindowThreadProcessId(hwnd, &pid);
	}

	return true;
}

void vm_detect1(void)
{
	printf("\nVM Check 1: ");
	__asm {
			RDTSC
			xor		ecx, ecx
			add		ecx, eax
			RDTSC	
			sub		eax, ecx
			cmp		eax, 0xFF
			jg		C_Detected
			jmp		C_notDetected
	}
C_notDetected:
	printf("not ");
C_Detected:
	printf("detected\n");
}

//VMWare spezifisch
void vm_detect2(void)
{
	printf("\nVM Check 2: ");
	__try
	{

		__asm
		{
				mov    eax, 'VMXh'
				mov    ebx, 1337
				mov    ecx, 10
				mov    edx, 'VX'
				in     eax, dx
				cmp    ebx, 'VMXh'
				je C_Detected
				jmp C_notDetected
		}
C_notDetected:
		printf("not ");
C_Detected:
		printf("detected\n");
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		printf("not detected\n");
	}
}


int main(int argc, char *argv[])
{    
	printf("Wireshark Detection Checker\n\n");

	if (get_wireshark_1())
	{
		printf("Wireshark found - Method 1\nPID: %u\n\n",pid);
	}
	if (get_wireshark_2()) {
		printf("Wireshark found - Method 2\nPID: %u\n\n",pid);
	}
	if (get_wireshark_3()) {
		printf("Wireshark found - Method 3\nPID: %u\n\n",pid);
	}
	if (get_wireshark_4()) {
		printf("Wireshark found - Method 4\nPID: %u\n\n",pid);
	}
	get_wireshark_5();

	vm_detect1();
	vm_detect2();

	printf("\nCheck finished\n");

	getchar();
	return 0;
}

[G36KV]

Hab hier noch ne böse Methode:

void get_wireshark_6(void)
{
   LPVOID drivers[1024];
   DWORD cbNeeded;
   int cDrivers, i;

   if( EnumDeviceDrivers(drivers, sizeof(drivers), &cbNeeded) && cbNeeded < sizeof(drivers))
   { 
      char szDriver[1024];

      cDrivers = cbNeeded / sizeof(drivers[0]);
   
      for (i=0; i < cDrivers; i++ )
      {
         if(GetDeviceDriverBaseName(drivers[i], szDriver, sizeof(szDriver) / sizeof(szDriver[0])))
		 {
            if (!_stricmp("npf.sys", szDriver))
			{
				printf("Sniffer found - Method 6\n\n");
			}
		 }
      }
   }
   else printf("EnumDeviceDrivers failed; array size needed is %d\n", cbNeeded / sizeof(LPVOID));

}

[Mofo]

Könnte jemand evtl. vm_detect1 testen und den Wert von eax posten..
Selbst virtualisiert wächst das bei mir nicht annähernd über 255

[Saedelaere]

Wird unter Verwendung von CPU Virtualisierung auch nicht mehr funktionieren.