Skip to content

Commit badc174

Browse files
EvilBytecodeEvilBytecode
authored
Update main.go
ADDED CHECKS REPPETTIVE PROCESS
1 parent ab18d6d commit badc174

File tree

1 file changed

+73
-75
lines changed

1 file changed

+73
-75
lines changed

‎main.go

Lines changed: 73 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,121 +1,119 @@
1-
package main
1+
package AntiDebugVMAnalysis
22

33
import (
44
"log"
5-
5+
"os"
66
// AntiDebug
77
"github.com/EvilBytecode/GoDefender/AntiDebug/CheckBlacklistedWindowsNames"
88
"github.com/EvilBytecode/GoDefender/AntiDebug/InternetCheck"
99
"github.com/EvilBytecode/GoDefender/AntiDebug/IsDebuggerPresent"
1010
"github.com/EvilBytecode/GoDefender/AntiDebug/ParentAntiDebug"
11-
"github.com/EvilBytecode/GoDefender/AntiDebug/RunningProcesses"
1211
"github.com/EvilBytecode/GoDefender/AntiDebug/RemoteDebugger"
12+
"github.com/EvilBytecode/GoDefender/AntiDebug/RunningProcesses"
13+
"github.com/EvilBytecode/GoDefender/AntiDebug/UserAntiAntiDebug"
1314
"github.com/EvilBytecode/GoDefender/AntiDebug/pcuptime"
14-
1515
// AntiVirtualization
1616
"github.com/EvilBytecode/GoDefender/AntiVirtualization/KVMCheck"
1717
"github.com/EvilBytecode/GoDefender/AntiVirtualization/MonitorMetrics"
18-
"github.com/EvilBytecode/GoDefender/AntiVirtualization/RecentFileActivity"
1918
"github.com/EvilBytecode/GoDefender/AntiVirtualization/TriageDetection"
19+
"github.com/EvilBytecode/GoDefender/AntiVirtualization/USBCheck"
2020
"github.com/EvilBytecode/GoDefender/AntiVirtualization/UsernameCheck"
21-
"github.com/EvilBytecode/GoDefender/AntiVirtualization/VirtualboxDetection"
2221
"github.com/EvilBytecode/GoDefender/AntiVirtualization/VMWareDetection"
23-
"github.com/EvilBytecode/GoDefender/AntiVirtualization/USBCheck"
24-
25-
// ProcessRelatedTool
26-
//"github.com/EvilBytecode/GoDefender/Process/CriticalProcess"
22+
"github.com/EvilBytecode/GoDefender/AntiVirtualization/VirtualboxDetection"
23+
"github.com/EvilBytecode/GoDefender/AntiVirtualization/VMArtifacts"
24+
"github.com/EvilBytecode/GoDefender/AntiVirtualization/RepetitiveProcess"
25+
"github.com/EvilBytecode/GoDefender/AntiVirtualization/ParallelsCheck"
2726
)
2827

29-
func main() {
30-
// AntiDebug checks
31-
if connected, _ := InternetCheck.CheckConnection(); connected {
32-
log.Println("[DEBUG] Internet connection is present")
28+
func ThunderKitty() {
29+
30+
// lets just catch bunch of vms at beginning lol
31+
if usbPluggedIn, err := USBCheck.PluggedIn(); err != nil {
32+
os.Exit(-1)
33+
} else if usbPluggedIn {
34+
log.Println("[DEBUG] USB devices have been plugged in, check passed.")
3335
} else {
34-
log.Println("[DEBUG] Internet connection isn't present")
36+
os.Exit(-1)
3537
}
38+
if blacklistedUsernameDetected := UsernameCheck.CheckForBlacklistedNames(); blacklistedUsernameDetected {
39+
log.Println("[DEBUG] Blacklisted username detected")
40+
os.Exit(-1)
41+
}
42+
// lets make their job harder.
43+
HooksDetection.AntiAntiDebug()
3644

37-
if parentAntiDebugResult := ParentAntiDebug.ParentAntiDebug(); parentAntiDebugResult {
38-
log.Println("[DEBUG] ParentAntiDebug check failed")
39-
} else {
40-
log.Println("[DEBUG] ParentAntiDebug check passed")
45+
//
46+
// AntiVirtualization checks
47+
if vmwareDetected, _ := VMWareDetection.GraphicsCardCheck(); vmwareDetected {
48+
log.Println("[DEBUG] VMWare detected")
49+
os.Exit(-1)
4150
}
4251

43-
if runningProcessesCountDetected, _ := RunningProcesses.CheckRunningProcessesCount(50); runningProcessesCountDetected {
44-
log.Println("[DEBUG] Running processes count detected")
45-
} else {
46-
log.Println("[DEBUG] Running processes count passed")
52+
if virtualboxDetected, _ := VirtualboxDetection.GraphicsCardCheck(); virtualboxDetected {
53+
log.Println("[DEBUG] Virtualbox detected")
54+
os.Exit(-1)
4755
}
4856

49-
if pcUptimeDetected, _ := pcuptime.CheckUptime(1200); pcUptimeDetected {
50-
log.Println("[DEBUG] PC uptime detected")
51-
} else {
52-
log.Println("[DEBUG] PC uptime passed")
57+
if kvmDetected, _ := KVMCheck.CheckForKVM(); kvmDetected {
58+
log.Println("[DEBUG] KVM detected")
59+
os.Exit(-1)
60+
}
61+
62+
if triageDetected, _ := TriageDetection.TriageCheck(); triageDetected {
63+
log.Println("[DEBUG] Triage detected")
64+
os.Exit(-1)
65+
}
66+
67+
if isScreenSmall, _ := MonitorMetrics.IsScreenSmall(); isScreenSmall {
68+
log.Println("[DEBUG] Screen size is small")
69+
os.Exit(-1)
70+
}
71+
if VMArtifacts := VMArtifacts.VMArtifactsDetect(); VMArtifacts {
72+
log.Println("[DEBUG] VMArtifacts components detected. Exiting.")
73+
os.Exit(-1)
74+
}
75+
76+
if repetitiveproc, _ := RepetitiveProcess.Check(); repetitiveproc {
77+
log.Println("[DEBUG] RepetitiveProcess detected. Exiting")
78+
os.Exit(-1)
79+
}
80+
81+
if pararelcheck, _ := ParallelsCheck.CheckForParallels(); pararelcheck {
82+
log.Println("[DEBUG] Parallels detected. Exiting")
83+
os.Exit(-1)
5384
}
5485

5586
CheckBlacklistedWindowsNames.CheckBlacklistedWindows()
87+
5688
// Other AntiDebug checks
5789
if isDebuggerPresentResult := IsDebuggerPresent.IsDebuggerPresent1(); isDebuggerPresentResult {
5890
log.Println("[DEBUG] Debugger presence detected")
59-
} else {
60-
log.Println("[DEBUG] Debugger presence passed")
91+
os.Exit(-1)
6192
}
6293

6394
if remoteDebuggerDetected, _ := RemoteDebugger.RemoteDebugger(); remoteDebuggerDetected {
6495
log.Println("[DEBUG] Remote debugger detected")
65-
} else {
66-
log.Println("[DEBUG] Remote debugger passed")
67-
}
68-
//////////////////////////////////////////////////////
69-
70-
// AntiVirtualization checks
71-
if recentFileActivityDetected, _ := RecentFileActivity.RecentFileActivityCheck(); recentFileActivityDetected {
72-
log.Println("[DEBUG] Recent file activity detected")
73-
} else {
74-
log.Println("[DEBUG] Recent file activity passed")
96+
os.Exit(-1)
7597
}
7698

77-
if vmwareDetected, _ := VMWareDetection.GraphicsCardCheck(); vmwareDetected {
78-
log.Println("[DEBUG] VMWare detected")
79-
} else {
80-
log.Println("[DEBUG] VMWare passed")
99+
if connected, _ := InternetCheck.CheckConnection(); !connected {
100+
log.Println("[DEBUG] Internet connection check failed")
101+
os.Exit(-1)
81102
}
82103

83-
if virtualboxDetected, _ := VirtualboxDetection.GraphicsCardCheck(); virtualboxDetected {
84-
log.Println("[DEBUG] Virtualbox detected")
85-
} else {
86-
log.Println("[DEBUG] Virtualbox passed")
104+
if parentAntiDebugResult := ParentAntiDebug.ParentAntiDebug(); parentAntiDebugResult {
105+
log.Println("[DEBUG] ParentAntiDebug check failed")
106+
os.Exit(-1)
87107
}
88108

89-
if kvmDetected, _ := KVMCheck.CheckForKVM(); kvmDetected {
90-
log.Println("[DEBUG] KVM detected")
91-
} else {
92-
log.Println("[DEBUG] KVM passed")
109+
if runningProcessesCountDetected, _ := RunningProcesses.CheckRunningProcessesCount(50); runningProcessesCountDetected {
110+
log.Println("[DEBUG] Running processes count detected")
111+
os.Exit(-1)
93112
}
94113

95-
if blacklistedUsernameDetected := UsernameCheck.CheckForBlacklistedNames(); blacklistedUsernameDetected {
96-
log.Println("[DEBUG] Blacklisted username detected")
97-
} else {
98-
log.Println("[DEBUG] Blacklisted username passed")
114+
if pcUptimeDetected, _ := pcuptime.CheckUptime(1200); pcUptimeDetected {
115+
log.Println("[DEBUG] PC uptime detected")
116+
os.Exit(-1)
99117
}
100118

101-
if triageDetected, _ := TriageDetection.TriageCheck(); triageDetected {
102-
log.Println("[DEBUG] Triage detected")
103-
} else {
104-
log.Println("[DEBUG] Triage passed")
105-
}
106-
if isScreenSmall, _ := MonitorMetrics.IsScreenSmall(); isScreenSmall {
107-
log.Println("[DEBUG] Screen size is small")
108-
} else {
109-
log.Println("[DEBUG] Screen size is not small")
110-
}
111-
// USBCheck
112-
if usbPluggedIn, err := USBCheck.PluggedIn(); err != nil {
113-
log.Println("[DEBUG] Error checking USB devices:", err)
114-
} else if usbPluggedIn {
115-
log.Println("[DEBUG] USB devices have been plugged in, check passed.")
116-
} else {
117-
log.Println("[DEBUG] No USB devices detected")
118-
}
119-
120-
// updating this once v1.0.9 is out!
121119
}

0 commit comments

Comments
 (0)