2 ms·

AntiCrack-DotNet: Project to prevent malicious actions on your software

3 points by AdvDebug 2y ago

AdvDebug 2y ago
AntiCrack-DotNet is a project containing advanced techniques to prevent various malicious actions in your C# software, which is becoming more useful as AOT is being developed more and more. anti-debug techniques (with syscall support to avoid anti anti-debuggers like scyllahide): - NtUserGetForegroundWindow (looks for bad active window names to check if it's a known debugger) - Debugger.IsAttached - Hide Threads From Debugger - IsDebuggerPresent - PEB.BeingDebugged - PEB.NtGlobalFlag - NtSetDebugFilterState - Page Guard Breakpoints Detection - NtQueryInformationProcess: ProcessDebugFlags, ProcessDebugPort, ProcessDebugObjectHandle - NtClose: Invalid Handle, Protected Handle - Parent Process Checking (Checks if parent are explorer.exe or cmd.exe) - Detection of Hardware Breakpoints - FindWindow (looks for bad window names) - GetTickCount - OutputDebugString - Crashing Non-Managed Debuggers with a Debugger Breakpoint - OllyDbg Format String Exploit - Patching DbgUiRemoteBreakin and DbgBreakPoint (Anti-Debugger Attaching) Anti-Virtualization: - Detecting Any.run - Detecting Triage - Detecting Qemu. - Detecting Parallels. - Detecting Sandboxie - Detecting Comodo Container - Detecting Qihoo360 Sandbox - Detecting Cuckoo Sandbox - Detecting VirtualBox and VMware - Detecting HyperV - Detecting Emulation - Checking For Blacklisted Usernames - Detecting KVM - Detecting Wine - Checking For Known Bad VM File Locations - Checking For Known Bad Process Names - Checking For Ports on the system (useful if the VM or the sandbox have no ports connected) - Checking for devices created by VMs or Sandboxes - Checking if AVX x64/x86 instructions are properly implemented to see if we are in an emulator. - Checking for RDRAND x64/x86 instruction to see if it's properly implemented which could indicate an emulator. - Checking for flags manipulation (for x64 and x86) checks to see if it's correctly handled. Anti Injection: - Taking Advantage of Binary Image Signature Mitigation Policy to prevent injecting Non-Microsoft Binaries. - Checking if any injected libraries are present (simple dlls path whitelist check) - Thread Injection Detection - Using PEB to change the main module info of the program which is main module name and module base address at runtime. - Detecting process hollowing in our program by checking suspicious image base address. Other Detections: - Detecting if Unsigned Drivers are Allowed to Load - Detecting if Test-Signed Drivers are Allowed to Load - Detecting if Kernel Debugging are Enabled on the System - Detecting if Secure Boot are Enabled on the System - Detecting if Virtualization-Based Security is Enabled. - Detecting if Memory Integrity Protection is Enabled. - Detecting if the current assembly has been invoked. Hooks Detection: - Detecting Most Anti Anti-Debugging Hooking Methods on Common Anti-Debugging Functions by checking for Bad Instructions on Functions Addresses and it detects user-mode anti anti-debuggers like scyllahide, and it can also detect some sandboxes which uses hooking to monitor application behaviour/activity (like Sandboxie/Sandboxie Plus, Hybrid analysis, Cuckoo Sandbox, and a lot of other online malware analysis websites/applications). - Basic detection for stealthy page guard hooking. - Detecting CLR Functions Hooking (like harmony hooks).

3 points by AdvDebug 2y ago

AntiCrack-DotNet is a project containing advanced techniques to prevent various malicious actions in your C# software, which is becoming more useful as AOT is being developed more and more. anti-debug techniques (with syscall support to avoid anti anti-debuggers like scyllahide): - NtUserGetForegroundWindow (looks for bad active window names to check if it's a known debugger) - Debugger.IsAttached - Hide Threads From Debugger - IsDebuggerPresent - PEB.BeingDebugged - PEB.NtGlobalFlag - NtSetDebugFilterState - Page Guard Breakpoints Detection - NtQueryInformationProcess: ProcessDebugFlags, ProcessDebugPort, ProcessDebugObjectHandle - NtClose: Invalid Handle, Protected Handle - Parent Process Checking (Checks if parent are explorer.exe or cmd.exe) - Detection of Hardware Breakpoints - FindWindow (looks for bad window names) - GetTickCount - OutputDebugString - Crashing Non-Managed Debuggers with a Debugger Breakpoint - OllyDbg Format String Exploit - Patching DbgUiRemoteBreakin and DbgBreakPoint (Anti-Debugger Attaching) Anti-Virtualization: - Detecting Any.run - Detecting Triage - Detecting Qemu. - Detecting Parallels. - Detecting Sandboxie - Detecting Comodo Container - Detecting Qihoo360 Sandbox - Detecting Cuckoo Sandbox - Detecting VirtualBox and VMware - Detecting HyperV - Detecting Emulation - Checking For Blacklisted Usernames - Detecting KVM - Detecting Wine - Checking For Known Bad VM File Locations - Checking For Known Bad Process Names - Checking For Ports on the system (useful if the VM or the sandbox have no ports connected) - Checking for devices created by VMs or Sandboxes - Checking if AVX x64/x86 instructions are properly implemented to see if we are in an emulator. - Checking for RDRAND x64/x86 instruction to see if it's properly implemented which could indicate an emulator. - Checking for flags manipulation (for x64 and x86) checks to see if it's correctly handled. Anti Injection: - Taking Advantage of Binary Image Signature Mitigation Policy to prevent injecting Non-Microsoft Binaries. - Checking if any injected libraries are present (simple dlls path whitelist check) - Thread Injection Detection - Using PEB to change the main module info of the program which is main module name and module base address at runtime. - Detecting process hollowing in our program by checking suspicious image base address. Other Detections: - Detecting if Unsigned Drivers are Allowed to Load - Detecting if Test-Signed Drivers are Allowed to Load - Detecting if Kernel Debugging are Enabled on the System - Detecting if Secure Boot are Enabled on the System - Detecting if Virtualization-Based Security is Enabled. - Detecting if Memory Integrity Protection is Enabled. - Detecting if the current assembly has been invoked. Hooks Detection: - Detecting Most Anti Anti-Debugging Hooking Methods on Common Anti-Debugging Functions by checking for Bad Instructions on Functions Addresses and it detects user-mode anti anti-debuggers like scyllahide, and it can also detect some sandboxes which uses hooking to monitor application behaviour/activity (like Sandboxie/Sandboxie Plus, Hybrid analysis, Cuckoo Sandbox, and a lot of other online malware analysis websites/applications). - Basic detection for stealthy page guard hooking. - Detecting CLR Functions Hooking (like harmony hooks).