Indetectables

Código: Seleccionar todo

//******************************************************************************
//Unit        : ANTIS
//Autor       : Fakedo0r .:[PD-TEAM]:.
//Fecha       : 04.04.2012
//Creditos    : Cobein
//Descripcion : Detecta [VirtualPC / VMWare / VirtualBox]
//              Detecta [Sandboxie / ThreatExpert / Anubis / CWSandbox / JoeBox]
//Uso         : Anti_End;
//******************************************************************************
unit ANTIS;
//******************************************************************************
//DECLARACION DE CLASES
//******************************************************************************
interface
uses
  Windows, ShlObj, Messages, SysUtils;
//******************************************************************************
//DECLARACION DE FUNCIONES / PROCEDIMIENTOS
//******************************************************************************
function InStr(iStart: Integer; sSource: String; sSourceToFind: String): Integer;
function TrimA(sCadena: String): String;
function IsVirtualPCPresent: Bool;
function IsInSandbox: Bool;
function Anti_End: Bool;
//******************************************************************************
//FUNCIONES / PROCEDIMIENTOS
//******************************************************************************
implementation
//******************************************************************************
//<--- MAQUINAS VIRTUALES [VirtualPC / VMWare / VirtualBox] --->
//******************************************************************************
function IsVirtualPCPresent: Bool;
const
  sArrVM    :array[0..2] of string = ('VIRTUAL','VMWARE','VBOX');
var
  hlKey     :HKEY;
  sBuffer   :String;
  i         :Integer;
  iRegType  :Integer;
  iDataSize :Integer;
begin
  IsVirtualPCPresent := False;
  iRegType := 1;

  if RegOpenKeyEx($80000002, Pchar('SYSTEM\ControlSet001\Services\Disk\Enum'), 0, $20019, hlKey) = 0 then
    if RegQueryValueEx(hlKey, '0', 0, @iRegType, nil, @iDataSize) = 0 then
      SetLength(sBuffer, iDataSize);
      RegQueryValueEx(hlKey, '0', 0, @iRegType, PByte(PChar(sBuffer)), @iDataSize);

      for I := 0 to 2 do
        if InStr(1, TrimA(sBuffer), sArrVM[i]) > 0 then
          IsVirtualPCPresent := True;


    RegCloseKey(hlKey);
end;
//******************************************************************************
//<--- SANDBOX [Sandboxie / ThreatExpert / Anubis / CWSandbox / JoeBox] --->
//******************************************************************************
function IsInSandbox: Bool;
const
  sArrSB      :array[0..2] of string = ('76487-337-8429955-22614',
                                        '76487-644-3177037-23510',
                                        '55274-640-2673064-23950');
  sArrDll     :array[0..1] of string = ('sbiedll.dll', 'dbghelp.dll');
var
  hlKey       :HKEY;
  sBuffer     :String;
  i           :Integer;
  hDll        :Integer;
  iRegType    :Integer;
  iDataSize   :Integer;
  hSnapShot   :Integer;
begin
  IsInSandbox := False;
  iRegType := 1;

  hDll := LoadLibrary(PChar(sArrDll[0]));

  if hDll <> 0 then
    IsInSandbox := True;

  FreeLibrary(hDll);

  hDll := LoadLibrary(PChar(sArrDll[1]));

  if hDll <> 0 then
    IsInSandbox := True;

  FreeLibrary(hDll);

  if RegOpenKeyEx($80000002, Pchar('Software\Microsoft\Windows\CurrentVersion'), 0, $20019, hlKey) = 0 then
    if RegQueryValueEx(hlKey, 'ProductId', 0, @iRegType, nil, @iDataSize) = 0 then
      SetLength(sBuffer, iDataSize);
      RegQueryValueEx(hlKey, 'ProductId', 0, @iRegType, PByte(PChar(sBuffer)), @iDataSize);

      for I := 0 to 2 do
        if InStr(1, TrimA(sBuffer), sArrSB[i]) > 0 then
          IsInSandbox := True;

    RegCloseKey(hlKey);
end;
//******************************************************************************
//<--- BUSCA CADENA DENTRO DE OTRA CADENA --->
//******************************************************************************
function InStr(iStart: Integer; sSource: String; sSourceToFind: String): integer;
begin
  Result := Pos(sSourceToFind, Copy(sSource, iStart, Length(sSource) - (iStart - 1)));
end;
//******************************************************************************
//<--- ELIMINA LOS ESPACIOS DE UNA CADENA --->
//******************************************************************************
function TrimA(sCadena: String): String;
begin
  Result := '';

  if sCadena = '' then Exit;

  while sCadena[1] = ' ' do
  begin
    Delete(sCadena, 1, 1);
    if sCadena='' then Exit;
  end;

  while sCadena[Length(sCadena)] = ' ' do
  begin
    Delete(sCadena,Length(sCadena),1);
    if sCadena  = '' then Exit;
  end;

  Result :=  sCadena;
end;
//******************************************************************************
//<--- CIERRA EL EJECUTABLE EN CASO DE TRUE  --->
//******************************************************************************
function Anti_End: Bool;
begin
  Anti_End := False;

  if IsVirtualPCPresent = True or IsInSandbox = True then
    ExitProcess(0);
end;

end.