Merge pull request #5 from EvilBytecode/main

Update (TRIAGE DETECTION)
AdvDebug · Jun 6, 2024 · e3930b0 · e3930b0
2 parents 1d3fbb2 + c8c2ad1
commit e3930b0
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/AntiCrack-DotNet/AntiVirtualization.cs b/AntiCrack-DotNet/AntiVirtualization.cs
@@ -282,6 +282,22 @@ public static bool CheckForParallels()
             return false;
         }
 
+        public static bool TriageCheck()
+        {
+            using (var searcher = new ManagementObjectSearcher("SELECT * FROM Win32_DiskDrive"))
+            {
+                foreach (var item in searcher.Get())
+                {
+                    string model = item["Model"].ToString();
+                    if (model.Contains("DADY HARDDISK") || model.Contains("QEMU HARDDISK"))
+                    {
+                        return true;
+                    }
+                }
+            }
+            return false;
+        }
+
         public static bool CheckForQemu()
         {
             string[] BadDriversList = { "qemu-ga", "qemuwmi" };

diff --git a/AntiCrack-DotNet/Program.cs b/AntiCrack-DotNet/Program.cs
@@ -104,6 +104,7 @@ private static void ExecuteAntiDebuggingTricks()
         private static void ExecuteAntiVirtualizationTricks()
         {
             ConsoleConfig.DisplayHeader("Executing Anti Virtualization Tricks");
+            ConsoleConfig.DisplayResult("Checking For Triage: ", AntiVirtualization.TriageCheck(), "Checks if Triage is present through disk.");
             ConsoleConfig.DisplayResult("Checking For Sandboxie Module in Current Process: ", AntiVirtualization.IsSandboxiePresent(), "Checks if Sandboxie is present.");
             ConsoleConfig.DisplayResult("Checking For Comodo Sandbox Module in Current Process: ", AntiVirtualization.IsComodoSandboxPresent(), "Checks if Comodo Sandbox is present.");
             ConsoleConfig.DisplayResult("Checking For Cuckoo Sandbox Module in Current Process: ", AntiVirtualization.IsCuckooSandboxPresent(), "Checks if Cuckoo Sandbox is present.");