Evasion Techniques

https://evasions.checkpoint.com
Admin
Evasion Techniques is a comprehensive resource documenting evasion methods and anti-debug techniques...
Tokens:74,714
Snippets:501
Trust Score:10
Update:10 months ago
Show doc for...
Tokens:
Raw
### Start Process using WMI in C++

Source: https://evasions.checkpoint.com/src/Evasions/techniques/wmi

This C++ code snippet demonstrates how to initialize COM, connect to WMI, and use the `Win32_Process` class's `Create` method to start a new process. This method bypasses typical `CreateProcessInternalW` hooking mechanisms used by sandboxes. It requires COM initialization and WMI interfaces.

```cpp
// Initialize COM
CoInitializeEx(NULL, COINIT_MULTITHREADED);

//  Set general COM security levels
hres = CoInitializeSecurity(NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_DEFAULT, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, 0, NULL);
if (FAILED(hres) && hres != RPC_E_TOO_LATE)
    break;

// create an instance of WbemLocator
CoCreateInstance(CLSID_WbemLocator, NULL, CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID*)&wbemLocator);
wbemLocator->ConnectServer(CComBSTR("ROOT\CIMV2"), NULL, NULL, NULL, 0, NULL, NULL, &wbemServices);

// get Win32_Process object
wbemServices->GetObject(CComBSTR("Win32_Process"), 0, NULL, &oWin32Process, &callResult);
wbemServices->GetObject(CComBSTR("Win32_ProcessStartup"), 0, NULL, &oWin32ProcessStartup, &callResult);
oWin32Process->GetMethod(CComBSTR("Create"), 0, &oMethCreate, &oMethCreateSignature);
oMethCreate->SpawnInstance(0, &instWin32Process);
oWin32ProcessStartup->SpawnInstance(0, &instWin32ProcessStartup);
// set startup information for process
instWin32ProcessStartup->Put(CComBSTR("CreateFlags"), 0, &varCreateFlags, 0);
instWin32Process->Put(CComBSTR("CommandLine"), 0, &varCmdLine, 0);
instWin32Process->Put(CComBSTR("CurrentDirectory"), 0, &varCurDir, 0);
CComVariant varStartupInfo(instWin32ProcessStartup);
instWin32Process->Put(CComBSTR("ProcessStartupInformation"), 0, &varStartupInfo, 0);
wbemServices->ExecMethod(CComBSTR("Win32_Process"), CComBSTR("Create"), 0, NULL, instWin32Process, &pOutParams, &callResult);

```

--------------------------------

### Count Installed Software (PowerShell)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/human-like-behavior

This PowerShell command retrieves installed software information from the registry and counts the number of entries. A low count might suggest a virtual environment lacking typical user-installed applications.

```powershell
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Format-Table -AutoSize | Measure-Object -Line
```

--------------------------------

### Check for Low Total RAM (C++)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/generic-os-queries

Checks if the total physical RAM on the system is below a specified threshold (1GB in this example). It uses `GlobalMemoryStatusEx` to retrieve memory information. This is a common technique to detect resource-constrained environments like virtual machines.

```cpp
BOOL memory_space() {
    DWORDLONG ullMinRam = (1024LL * (1024LL * (1024LL * 1LL))); // 1GB
    
    MEMORYSTATUSEX statex = {0};
    statex.dwLength = sizeof(statex);
    GlobalMemoryStatusEx(&statex); // calls NtQuerySystemInformation
    
    return (statex.ullTotalPhys < ullMinRam) ? TRUE : FALSE;
}
```

--------------------------------

### Create Non-Standard Button for User Interaction Evasion (C++)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/human-like-behavior

This C++ code demonstrates how to create a GUI element that looks like a button but uses a 'static' class name and a custom caption. This technique aims to evade sandboxes that automatically detect and click standard buttons like 'Install' or 'Next'. The extended style flags are used to give it a button-like appearance.

```cpp
   // we use extended style flags to make a static look like a button
   HWND hButton = CreateWindowExW(
       WS_EX_DLGMODALFRAME | WS_EX_WINDOWEDGE,  // extended style flags
       TEXT("static"),         // class "static" instead of "button"
       TEXT("Real next"),      // caption different from “Install” or “Next”
       WS_VISIBLE | WS_CHILD | WS_GROUP | SS_CENTER,  // usual style flags
       10, 10, 80, 25,         // arbitrary position and size, may be any
       hWnd,                   // parent window
       NULL,                   // no menu
       NULL,                   // a handle to the instance of the module to be associated with the window
       NULL);                  // pointer to custom value is not required
```

--------------------------------

### Get System Uptime using WMI (VB)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/wmi

This code snippet retrieves the system's last boot time and calculates the system uptime in minutes using WMI in Visual Basic. It queries the Win32_OperatingSystem class to obtain the `LastBootUpTime` property. The `WMIDateStringToDate` function is a helper to convert the WMI date format to a standard date format for calculations. Anomalies in system uptime can indicate a virtual machine restored from a snapshot or other sandbox environments.

```vbscript
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\" & strComputer & "\root\cimv2")
Set colOperatingSystems = objWMIService.ExecQuery ("Select * from Win32_OperatingSystem")

For Each objOS in colOperatingSystems
    dtmBootup = objOS.LastBootUpTime
    dtmLastBootUpTime = WMIDateStringToDate(dtmBootup)
    dtmSystemUptime = DateDiff("n", dtmLastBootUpTime, Now)
    Wscript.Echo "System uptime minutes: " & dtmSystemUptime 
Next

Function WMIDateStringToDate(dtm)
    WMIDateStringToDate =  CDate(Mid(dtm, 5, 2) & "/" & _
        Mid(dtm, 7, 2) & "/" & Left(dtm, 4) & " " & Mid (dtm, 9, 2) & ":" & _
        Mid(dtm, 11, 2) & ":" & Mid(dtm, 13, 2))
End Function

```

--------------------------------

### Patch Return Address Breakpoint (INT3) with NOP in C/C++

Source: https://evasions.checkpoint.com/src/Anti-Debug/techniques/process-memory

This C/C++ code demonstrates how to detect and patch a software breakpoint (`0xCC`) at the return address of a function. It uses `_ReturnAddress()` to get the return address, checks if it's a breakpoint, and if so, attempts to overwrite it with a `NOP` (`0x90`) instruction using `VirtualProtect` to change memory permissions. The function requires no specific input but relies on the Windows API.

```cpp
#include <intrin.h>
#pragma intrinsic(_ReturnAddress)

void foo()
{
    // ...
    
    PVOID pRetAddress = _ReturnAddress();
    if (*(PBYTE)pRetAddress == 0xCC) // int 3
    {
        DWORD dwOldProtect;
        if (VirtualProtect(pRetAddress, 1, PAGE_EXECUTE_READWRITE, &dwOldProtect))
        {
            *(PBYTE)pRetAddress = 0x90; // nop
            VirtualProtect(pRetAddress, 1, dwOldProtect, &dwOldProtect);
        }
    }
    
    // ...
}
```

--------------------------------

### Get Network Adapter Last Reset Time (VB)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/wmi

This Visual Basic code sample checks the last reset time of network adapters using WMI. It queries the `Win32_NetworkAdapter` class to retrieve the `TimeOfLastReset` property. The `WMIDateStringToDate` function (assumed to be defined as in the previous example) is used to convert the WMI date format. A significantly old last reset time for network adapters can suggest that the system is a virtual machine restored from a snapshot.

```vbscript
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\" & strComputer & "\root\cimv2")
Set colOperatingSystems = objWMIService.ExecQuery ("Select * from Win32_NetworkAdapter")

For Each objOS in colNetworkAdapters
    dtmLastReset = objOS.TimeOfLastReset
    dtmLastResetTime = WMIDateStringToDate(dtmLastReset)  'WMIDateStringToDate function from the previous example
    dtmAdapterUptime = DateDiff("n", dtmLastResetTime, Now)
    Wscript.Echo "Adapter uptime minutes: " & dtmAdapterUptime 
Next

```

--------------------------------

### Check system last boot time discrepancy (C/C++)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/timing

This function checks for sandbox detection by comparing the system's last boot time obtained through WMI and the NtQuerySystemInformation API. A significant difference between these two values, especially if they indicate vastly different uptimes, suggests the system might be running within a sandbox that uses snapshots. The comparison is made in seconds.

```c
bool check_last_boot_time()
{
    SYSTEM_TIME_OF_DAY_INFORMATION  SysTimeInfo;
    LARGE_INTEGER LastBootTime;
    
    NtQuerySystemInformation(SystemTimeOfDayInformation, &SysTimeInfo, sizeof(SysTimeInfo), 0);
    LastBootTime = wmi_Get_LastBootTime();
    return (wmi_LastBootTime.QuadPart - SysTimeInfo.BootTime.QuadPart) / 10000000 != 0; // 0 seconds
}

```

--------------------------------

### Check for Executable Files in Disk Root (C)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/filesystem

This C function checks for the existence of specific executable files ('sample.exe', 'malware.exe') in the root directory of all logical drives. It correctly handles WOW64 file system redirection on 64-bit systems by temporarily disabling it before calling `GetFileAttributes`. The function returns TRUE if any of the specified files are found, and FALSE otherwise.

```c
int pafish_exists_file(char * filename) {
    DWORD res = INVALID_FILE_ATTRIBUTES;
    if (pafish_iswow64() == TRUE) {
        void *old = NULL;
        // Disable redirection immediately prior to calling GetFileAttributes.
        if (pafish_disable_wow64_fs_redirection(&old) ) {
            res = GetFileAttributes(filename);
            // Ignoring MSDN recommendation of exiting if this call fails.
            pafish_revertwow64_fs_redirection(old);
        }
    }
    else {
        res = GetFileAttributes(filename);
    }
    return (res != INVALID_FILE_ATTRIBUTES) ? TRUE : FALSE;
}

int gensandbox_common_names() {
    DWORD dwSize = MAX_PATH;
    char szLogicalDrives[MAX_PATH] = {0};
    DWORD dwResult = GetLogicalDriveStrings(dwSize,szLogicalDrives);
    BOOL exists;

    if (dwResult > 0 && dwResult <= MAX_PATH)
    {
        char* szSingleDrive = szLogicalDrives;
        char filename[MAX_PATH] = {0};
        while(*szSingleDrive)
        {
            if (GetDriveType(szSingleDrive) != DRIVE_REMOVABLE ) {
                snprintf(filename, MAX_PATH, "%ssample.exe",szSingleDrive);
                exists = pafish_exists_file(filename);
                if (exists) return TRUE;
                
                snprintf(filename, MAX_PATH, "%smalware.exe",szSingleDrive);
                exists = pafish_exists_file(filename);
                if (exists) return TRUE;
            }

            szSingleDrive += strlen(szSingleDrive) + 1;
        }
    }

    return FALSE;
}
```

--------------------------------

### Check Registry Key Existence in C

Source: https://evasions.checkpoint.com/src/Evasions/techniques/registry

This C code snippet provides a function to check if a specified registry key exists. It handles both 32-bit and 64-bit Windows environments by using `KEY_WOW64_64KEY` flag when necessary. The function `pafish_exists_regkey` takes a registry hive and a key path as input and returns TRUE if the key exists, FALSE otherwise. It is a crucial component for detecting suspicious system configurations.

```c
/* sample of usage: see detection of VirtualBox in the table below to check registry path */
int vbox_reg_key7() {
    return pafish_exists_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\FADT\\VBOX__");
}

/* code is taken from "pafish" project, see references on the parent page */
int pafish_exists_regkey(HKEY hKey, char * regkey_s) {
    HKEY regkey;
    LONG ret;

    /* regkey_s == "HARDWARE\\ACPI\\FADT\\VBOX__"; */
    if (pafish_iswow64()) {
        ret = RegOpenKeyEx(hKey, regkey_s, 0, KEY_READ | KEY_WOW64_64KEY, &regkey);
    }
    else {
        ret = RegOpenKeyEx(hKey, regkey_s, 0, KEY_READ, &regkey);
    }

    if (ret == ERROR_SUCCESS) {
        RegCloseKey(regkey);
        return TRUE;
    }
    else
        return FALSE;
}
```

--------------------------------

### Check System Uptime with NtQuerySystemInformation

Source: https://evasions.checkpoint.com/src/Evasions/techniques/generic-os-queries

Determines if the system uptime is less than a defined minimum (12 minutes) by querying system time information. It uses `NtQuerySystemInformation` to retrieve boot time and current time. The function returns a boolean value. This method relies on specific system structures and may be less portable.

```c
BOOL uptime_check2()
{
    SYSTEM_TIME_OF_DAY_INFORMATION  SysTimeInfo;
    ULONGLONG uptime_minutes;
    NtQuerySystemInformation(SystemTimeOfDayInformation, &SysTimeInfo, sizeof(SysTimeInfo), 0);
    uptime_minutes = (SysTimeInfo.CurrentTime.QuadPart - SysTimeInfo.BootTime.QuadPart) / (60 * 1000 * 10000);
    return uptime_minutes < MIN_UPTIME_MINUTES;
}
```

--------------------------------

### Detect Debugger with OpenProcess()

Source: https://evasions.checkpoint.com/src/Anti-Debug/techniques/object-handles

This C/C++ code snippet uses the kernel32!OpenProcess() function to check for debugger presence by attempting to get a handle to the csrss.exe process. The call succeeds only if the user has administrative privileges and debug privileges, which may be present when a debugger is attached.

```c++
typedef DWORD (WINAPI *TCsrGetProcessId)(VOID);

bool Check()
{
    HMODULE hNtdll = LoadLibraryA("ntdll.dll");
    if (!hNtdll)
        return false;
    
    TCsrGetProcessId pfnCsrGetProcessId = (TCsrGetProcessId)GetProcAddress(hNtdll, "CsrGetProcessId");
    if (!pfnCsrGetProcessId)
        return false;

    HANDLE hCsr = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pfnCsrGetProcessId());
    if (hCsr != NULL)
    {
        CloseHandle(hCsr);
        return true;
    }
    else
        return false;
}
```

--------------------------------

### Detect Debugger with INT 2D Assembly Instruction (C/C++)

Source: https://evasions.checkpoint.com/src/Anti-Debug/techniques/assembly

Employs the INT 2D instruction to detect debuggers. This instruction raises an EXCEPTION_BREAKPOINT and may increment EIP. The example includes a NOP instruction to mitigate potential execution skips if the debugger handles the exception.

```c++
bool IsDebugged()
{
    __try
    {
        __asm xor eax, eax;
        __asm int 0x2d;
        __asm nop;
        return true;
    }
    __except(EXCEPTION_EXECUTE_HANDLER)
    {
        return false;
    }
}
```

--------------------------------

### Initialize SYSTEM_FIRMWARE_TABLE_INFORMATION for Raw Firmware Table (Windows Vista+)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/firmware-tables

Initializes the SYSTEM_FIRMWARE_TABLE_INFORMATION structure for retrieving raw firmware tables on Windows Vista and later. This involves setting the Action, ProviderSignature, TableID, and TableBufferLength fields before calling NtQuerySystemInformation.

```c
SYSTEM_FIRMWARE_TABLE_INFORMATION *sfti = 
    (PSYSTEM_FIRMWARE_TABLE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, Length);
sfti->Action = SystemFirmwareTable_Get;  // 1
sfti->ProviderSignature = 'FIRM';
sfti->TableID = 0xC0000;
sfti->TableBufferLength = Length;
```

--------------------------------

### Hide Control Flow with Structured Exception Handlers (C/C++)

Source: https://evasions.checkpoint.com/src/Anti-Debug/techniques/exceptions

This C/C++ example demonstrates hiding program control flow by chaining Structured Exception Handlers (SEH). Each handler triggers another exception, eventually leading to the intended malicious or hidden procedure.

```c
#include <Windows.h>

void MaliciousEntry()
{
    // ...
}

void Trampoline2()
{
    __try
    {
        __asm int 3;
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        MaliciousEntry();
    }
}

void Trampoline1()
{
    __try 
    {
        __asm int 3;
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        Trampoline2();
    }
}

int main(void)
{
    __try
    {
        __asm int 3;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {}
    {
        Trampoline1();
    }

    return 0;
}
```

--------------------------------

### Check Physical Display Adapter (C++)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/hardware

This C++ code snippet checks for the presence and details of physical display adapters by using the IDirect3D9 interface. It loads the 'd3d9.dll' library, obtains a pointer to the `Direct3DCreate9` function, and then uses `GetAdapterIdentifier` to retrieve information such as VendorId, DeviceId, Driver, and Description. This method is effective on Windows XP and later versions and can help differentiate between physical machines and virtual environments by analyzing the adapter details.

```cpp
#include <d3d9.h>

// https://github.com/qt/qtbase/blob/dev/src/plugins/platforms/windows/qwindowsopengltester.cpp#L124

void detect() {
    typedef IDirect3D9* (WINAPI* PtrDirect3DCreate9)(UINT);

    HMODULE d3d9lib = ::LoadLibraryA("d3d9");
    if (!d3d9lib)
        return;

    PtrDirect3DCreate9 direct3DCreate9 = (PtrDirect3DCreate9)GetProcAddress(d3d9lib, "Direct3DCreate9");
    if (!direct3DCreate9)
        return;

    IDirect3D9* direct3D9 = direct3DCreate9(D3D_SDK_VERSION);
    if (!direct3D9)
        return;

    D3DADAPTER_IDENTIFIER9 adapterIdentifier;
    const HRESULT hr = direct3D9->GetAdapterIdentifier(0, 0, &adapterIdentifier);
    direct3D9->Release();

    if (SUCCEEDED(hr)) {
        printf("VendorId:    0x%x\n", adapterIdentifier.VendorId);
        printf("DeviceId:    0x%x\n", adapterIdentifier.DeviceId);
        printf("Driver:      %s\n", adapterIdentifier.Driver);
        printf("Description: %s\n", adapterIdentifier.Description);
    }
}
```

--------------------------------

### Retrieve BIOS Serial Number using WMI (PowerShell)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/wmi

This PowerShell command retrieves the SerialNumber property from the Win32_BIOS WMI class. It is a concise way to get system identification information. No external dependencies are required beyond PowerShell execution. The output is the system's BIOS serial number.

```powershell
(Get-CimInstance -ClassName Win32_BIOS -Property SerialNumber).SerialNumber
```

--------------------------------

### Get Tick Count from KUSER_SHARED_DATA in C++

Source: https://evasions.checkpoint.com/src/Evasions/techniques/timing

This C++ code snippet shows how to obtain the tick count directly from the `KUSER_SHARED_DATA` structure, bypassing potential hooks on `GetTickCount`. By defining macros to access `SharedUserData->TickCountMultiplier` and `SharedUserData->TickCount.LowPart`, it calculates a custom tick count, which can then be used to detect sleep skipping.

```c++
#define KI_USER_SHARED_DATA         0x7FFE0000
#define SharedUserData  ((KUSER_SHARED_DATA * const) KI_USER_SHARED_DATA)
#define MyGetTickCount() ((DWORD)((SharedUserData->TickCountMultiplier * (ULONGLONG)SharedUserData->TickCount.LowPart) >> 24))

// ...
StartingTick = MyGetTickCount();
Sleep(Timeout);
TimeElapsedMs = MyGetTickCount() - StartingTick;

printf("Requested delay: %d, elapsed time: %d\n", Timeout, TimeElapsedMs);

if (abs((LONG)(TimeElapsedMs - Timeout)) > Timeout / 2)
    printf("Sleep-skipping DETECTED!\n");

```

--------------------------------

### Check Processor Count Using System Information (C)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/generic-os-queries

This function checks if the number of processors is less than 2 using the GetSystemInfo function. It's a common method to detect low-resource environments. The input is implicit via system calls, and the output is a boolean indicating if the processor count is low.

```c
int gensandbox_one_cpu_GetSystemInfo() {
    SYSTEM_INFO si;
    GetSystemInfo(&si);
    return si.dwNumberOfProcessors < 2 ? TRUE : FALSE;
}
```

--------------------------------

### Parallel Delays with Waitable Timers in C++

Source: https://evasions.checkpoint.com/src/Evasions/techniques/timing

This C++ code sample demonstrates how to create parallel delays using `CreateWaitableTimer` and `SetWaitableTimer`. It measures the elapsed time to detect if the sandbox skips `Sleep` calls, which results in a significantly larger elapsed time than the requested timeout. Dependencies include Windows API functions.

```c++
DWORD StartingTick, TimeElapsedMs;
LARGE_INTEGER DueTime;
HANDLE hTimer = NULL;
TIMER_BASIC_INFORMATION TimerInformation;
ULONG ReturnLength;

hTimer = CreateWaitableTimer(NULL, TRUE, NULL);
DueTime.QuadPart = Timeout * (-10000LL);

StartingTick = GetTickCount();
SetWaitableTimer(hTimer, &DueTime, 0, NULL, NULL, 0);
do
{
    Sleep(Timeout/10);
    NtQueryTimer(hTimer, TimerBasicInformation, &TimerInformation, sizeof(TIMER_BASIC_INFORMATION), &ReturnLength);
} while (!TimerInformation.TimerState);

CloseHandle(hTimer);

TimeElapsedMs = GetTickCount() - StartingTick;
printf("Requested delay: %d, elapsed time: %d\n", Timeout, TimeElapsedMs);

if (abs((LONG)(TimeElapsedMs - Timeout)) > Timeout / 2)
    printf("Sleep-skipping DETECTED!\n");

```

--------------------------------

### Read Heap Flags using RtlQueryProcessDebugInformation in C/C++

Source: https://evasions.checkpoint.com/src/Anti-Debug/techniques/debug-flags

This C/C++ code snippet demonstrates using `ntdll!RtlQueryProcessDebugInformation()` to get heap flags. It initializes a debug buffer and calls the function with `PDI_HEAPS` and `PDI_HEAP_BLOCKS` flags. It then checks the heap flags similarly to `RtlQueryProcessHeapInformation`, returning true if the heap is not growable.

```C/C++
bool Check()
{
    ntdll::PDEBUG_BUFFER pDebugBuffer = ntdll::RtlCreateQueryDebugBuffer(0, FALSE);
    if (!SUCCEEDED(ntdll::RtlQueryProcessDebugInformation(GetCurrentProcessId(), ntdll::PDI_HEAPS | ntdll::PDI_HEAP_BLOCKS, pDebugBuffer)))
        return false;

    ULONG dwFlags = ((ntdll::PRTL_PROCESS_HEAPS)pDebugBuffer->HeapInformation)->Heaps[0].Flags;
    return dwFlags & ~HEAP_GROWABLE;
}
```

--------------------------------

### Detect Process Debugging using ProcessDebugPort (x86 Assembly)

Source: https://evasions.checkpoint.com/src/Anti-Debug/techniques/debug-flags

Implements the ProcessDebugPort detection method using x86 assembly. It calls NtQueryInformationProcess with appropriate arguments and checks if the returned debug port value is -1, indicating a debugger is attached. The example also includes a jump to 'being_debugged' if a debugger is detected.

```assembly
    lea eax, [dwReturned]
    push eax ; ReturnLength
    push 4   ; ProcessInformationLength
    lea ecx, [dwProcessDebugPort]
    push ecx ; ProcessInformation
    push 7   ; ProcessInformationClass
    push -1  ; ProcessHandle
    call NtQueryInformationProcess
    inc dword ptr [dwProcessDebugPort]
    jz being_debugged
    ...
being_debugged:
    push -1
    call ExitProcess 
```

--------------------------------

### Calculate CPU Core Ratio for Evasion Detection

Source: https://evasions.checkpoint.com/src/MacOS/macos

This command calculates the ratio between logical and physical CPU cores. It's presented as a malware-specific signature to reduce false positives when detecting evasion techniques, as this calculation is less likely to be used for legitimate system information gathering.

```shell
echo $(($(`sysctl -n hw.logicalcpu`/`sysctl -n hw.physicalcpu`)))
```

--------------------------------

### Check for Specific Virtual Devices in C++

Source: https://evasions.checkpoint.com/src/Evasions/techniques/global-os-objects

This C++ function attempts to open specific virtual devices, which are indicative of a virtual environment or sandbox. It utilizes the `NtCreateFile` Windows API function to interact with device paths. The function returns true if the device can be successfully opened, suggesting the presence of a virtualized environment.

```cpp
// usage sample:
HANDLE hDummy = NULL;
supOpenDevice(L"\\Device\Null", GENERIC_READ, &hDummy); // sample values from the table below


BOOL supOpenDevice(
    _In_ LPWSTR lpDeviceName,
    _In_ ACCESS_MASK DesiredAccess,
    _Out_opt_ PHANDLE phDevice)
{
    OBJECT_ATTRIBUTES attr;
    IO_STATUS_BLOCK iost;
    UNICODE_STRING uDevName;
    HANDLE hDevice;
    NTSTATUS Status;

    if (phDevice) {
        *phDevice = NULL;
    }
    if (lpDeviceName == NULL) {
        return FALSE;
    }

    hDevice = NULL;
    RtlSecureZeroMemory(&uDevName, sizeof(uDevName));
    RtlInitUnicodeString(&uDevName, lpDeviceName);
    InitializeObjectAttributes(&attr, &uDevName, OBJ_CASE_INSENSITIVE, 0, NULL);

    Status = NtCreateFile(&hDevice, DesiredAccess, &attr, &iost, NULL, 0,
        0, FILE_OPEN, 0, NULL, 0);
    if (NT_SUCCESS(Status)) {
        if (phDevice != NULL) {
            *phDevice = hDevice;
        }
    }

    return NT_SUCCESS(Status);
}
```

--------------------------------

### Detect User Clicks with Mouse Hooks (C++)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/hooks

This code snippet demonstrates how to use `SetWindowsHookExA/W` to install a low-level mouse hook. The `mouseHookProc` callback function monitors mouse events. If specific button down or up events are detected, it indicates user interaction, and the hook is removed. This is used to differentiate between a real user and a virtual environment.

```cpp
HHOOK g_hhkMouseHook = NULL;

LRESULT CALLBACK mouseHookProc(int nCode, WPARAM wParam, LPARAM lParam)
{
  switch (wParam)
  {
  case WM_MOUSEMOVE:
    // ...
    break;
  case WM_NCLBUTTONDOWN:
    // ...
    break;
  case WM_LBUTTONUP:
    UnhookWindowsHookEx(g_hhkMouseHook);
    CallMaliciousCode();
    ExitProcess(0);
  }
  return CallNextHookEx(g_hhkMouseHook, nCode, wParam, lParam);
}

g_hhkMouseHook = SetWindowsHookEx(WH_MOUSE_LL, mouseHookProc, GetModuleHandleA(NULL), NULL);
```

--------------------------------

### Get CPU Vendor ID String via CPUID (Assembly)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/cpu

This assembly function retrieves the CPU vendor ID string using the CPUID instruction. It saves and restores non-volatile registers, nullifies output registers, calls CPUID with EAX set to 0x40000000, and then stores the vendor string parts from EBX, ECX, and EDX into the provided buffer.

```assembly
__declspec(naked) void get_cpuid_vendor(char *vendor_id) {
  __asm {
    ; save non-volatile register
    push ebx

    ; nullify output registers
    xor ebx, ebx
    xor ecx, ecx
    xor edx, edx

    ; call cpuid with argument in EAX
    mov eax, 0x40000000
    cpuid

    ; store vendor_id ptr to destination
    mov edi, vendor_id

    ; move string parts to destination
    mov eax, ebx  ; part 1 of 3 from EBX
    stosd
    mov eax, ecx  ; part 2 of 3 from ECX
    stosd
    mov eax, edx  ; part 3 of 3 from EDX
    stosd

    ; restore saved non-volatile register
    pop ebx

    ; return from function
    retn
  }
}
```

--------------------------------

### Check Hard Disk Size using WMI (C++)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/wmi

This C++ function utilizes WMI to check the size of logical disks. It queries 'Win32_LogicalDisk' and compares the 'Size' property against a predefined minimum (80GB). Dependencies include WMI COM interfaces. It returns a boolean indicating if any disk is smaller than the threshold.

```cpp
/*
Check hard disk size using WMI
*/
BOOL disk_size_wmi()
{
  IWbemServices *pSvc = NULL;
  IWbemLocator *pLoc = NULL;
  IEnumWbemClassObject *pEnumerator = NULL;
  BOOL bStatus = FALSE;
  HRESULT hRes;
  BOOL bFound = FALSE;
  INT64 minHardDiskSize = (80LL * (1024LL * (1024LL * (1024LL))));

  // Init WMI
  bStatus = InitWMI(&pSvc, &pLoc);
  if (bStatus)
  {
    // If success, execute the desired query
    bStatus = ExecWMIQuery(&pSvc, &pLoc, &pEnumerator, _T("SELECT * FROM Win32_LogicalDisk"));
    if (bStatus)
    {
      // Get the data from the query
      IWbemClassObject *pclsObj = NULL;
      ULONG uReturn = 0;
      VARIANT vtProp;

      // Iterate over our enumator
      while (pEnumerator)
      {
        hRes = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn);
        if (0 == uReturn)
          break;

        // Get the value of the Name property
        hRes = pclsObj->Get(_T("Size"), 0, &vtProp, 0, 0);
        if (V_VT(&vtProp) != VT_NULL) {

          // Do our comparaison
          if (vtProp.llVal < minHardDiskSize) { // Less than 80GB
            bFound = TRUE; break;
          }

          // release the current result object
          VariantClear(&vtProp);
          pclsObj->Release();
        }
      }

      // Cleanup
      pEnumerator->Release();
      pSvc->Release();
      pLoc->Release();
      CoUninitialize();
    }
  }

  return bFound;
}
```

--------------------------------

### Schedule Task using WMI (VB)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/wmi

This code sample demonstrates how to schedule a new task using the Win32_ScheduledJob WMI class in Visual Basic. It's important to note that the Win32_ScheduledJob class is deprecated in Windows 8 and later, and its functionality may be limited without specific registry configurations. The function `Create` is used to schedule the execution of 'malware.exe' at a specific time.

```vbscript
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=Impersonate}!\" & strComputer & "\root\cimv2") 
Set objSWbemDateTime = CreateObject("WbemScripting.SWbemDateTime")
objSWbemDateTime.SetVarDate(DateAdd("n", 1, Now()))
Set objNewJob = objWMIService.Get("Win32_ScheduledJob")
errJobCreate = objNewJob.Create("malware.exe", objSWbemDateTime.Value, False, , , True, "MaliciousJob") 

```

--------------------------------

### Check Executable Path for Sandbox Strings (C)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/filesystem

This function checks the full path of the current executable for specific strings commonly found in sandbox or virtualized environments, such as \\SAMPLE, \\VIRUS, or SANDBOX. It uses `GetModuleFileName` to retrieve the executable path, converts it to uppercase for case-insensitive comparison, and then uses `strstr` to search for the blacklisted strings. Returns TRUE if any of the strings are found, indicating a potential sandbox environment.

```c
int gensandbox_path() {
    char path[500];
    size_t i;
    DWORD pathsize = sizeof(path);

    GetModuleFileName(NULL, path, pathsize);

    for (i = 0; i < strlen(path); i++) { /* case-insensitive */
        path[i] = toupper(path[i]);
    }

    // some sample values from the table
    if (strstr(path, "\\SAMPLE") != NULL) {
        return TRUE;
    }
    if (strstr(path, "\\VIRUS") != NULL) {
        return TRUE;
    }
    if (strstr(path, "SANDBOX") != NULL) {
        return TRUE;
    }

    return FALSE;
}
```

--------------------------------

### Parent Process Check via NtQueryInformationProcess (C/C++)

Source: https://evasions.checkpoint.com/src/Anti-Debug/techniques/misc

This method verifies if the current process is directly executed by the explorer.exe shell. It retrieves the shell window handle, its process ID, and then uses NtQueryInformationProcess to get the parent process ID. If the parent process ID does not match explorer.exe's PID, it suggests the process might be debugged or launched unusually. Dependencies include user32.dll and ntdll.dll.

```cpp
bool IsDebugged()
{
    HWND hExplorerWnd = GetShellWindow();
    if (!hExplorerWnd)
        return false;

    DWORD dwExplorerProcessId;
    GetWindowThreadProcessId(hExplorerWnd, &dwExplorerProcessId);

    ntdll::PROCESS_BASIC_INFORMATION ProcessInfo;
    NTSTATUS status = ntdll::NtQueryInformationProcess(
        GetCurrentProcess(),
        ntdll::PROCESS_INFORMATION_CLASS::ProcessBasicInformation,
        &ProcessInfo,
        sizeof(ProcessInfo),
        NULL);
    if (!NT_SUCCESS(status))
        return false;

    return (DWORD)ProcessInfo.InheritedFromUniqueProcessId != dwExplorerProcessId;
}
```

--------------------------------

### VM Detection using POPF and CPUID (C/C++)

Source: https://evasions.checkpoint.com/src/Anti-Debug/techniques/assembly

This C/C++ function detects virtual machines by examining the behavior of the `cpuid` instruction after setting the trap flag using `popfd`. In a physical machine, a single-step exception occurs. In a VM, a VM exit happens, leading to an illegal instruction exception due to delayed trap flag handling. This technique leverages differences in CPU instruction execution between physical and virtual environments.

```c
bool IsDebugged()
{
__try
    {
    __asm
        {
            pushfd
            popfd
            cpuid
            C7 B2
        }
    return true;
    }
__except(GetExceptionCode() == EXCEPTION_SINGLE_STEP
? EXCEPTION_EXECUTE_HANDLER
: EXCEPTION_CONTINUE_EXECUTION)
    {
        return false;
    }
}
```

--------------------------------

### Parent Process Check via CreateToolhelp32Snapshot (C/C++)

Source: https://evasions.checkpoint.com/src/Anti-Debug/techniques/misc

This technique identifies the parent process using kernel32!CreateToolhelp32Snapshot and kernel32!Process32Next. It first retrieves the current process's parent PID and then iterates through all running processes to find the parent's executable name. If the parent is not 'explorer.exe', it flags the process as potentially debugged. Dependencies include kernel32.dll.

```cpp
DWORD GetParentProcessId(DWORD dwCurrentProcessId)
{
    DWORD dwParentProcessId = -1;
    PROCESSENTRY32W ProcessEntry = { 0 };
    ProcessEntry.dwSize = sizeof(PROCESSENTRY32W);

    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if(Process32FirstW(hSnapshot, &ProcessEntry))
    {
        do
        {
            if (ProcessEntry.th32ProcessID == dwCurrentProcessId)
            {
                dwParentProcessId = ProcessEntry.th32ParentProcessID;
                break;
            }
        } while(Process32NextW(hSnapshot, &ProcessEntry));
    }

    CloseHandle(hSnapshot);
    return dwParentProcessId;
}

bool IsDebugged()
{
    bool bDebugged = false;
    DWORD dwParentProcessId = GetParentProcessId(GetCurrentProcessId());

    PROCESSENTRY32 ProcessEntry = { 0 };
    ProcessEntry.dwSize = sizeof(PROCESSENTRY32W);

    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if(Process32First(hSnapshot, &ProcessEntry))
    {
        do
        {
            if ((ProcessEntry.th32ProcessID == dwParentProcessId) &&
                (strcmp(ProcessEntry.szExeFile, "explorer.exe"))) // Note: strcmp returns 0 for equal strings
            {
                bDebugged = true;
                break;
            }
        } while(Process32Next(hSnapshot, &ProcessEntry));
    }

    CloseHandle(hSnapshot);
    return bDebugged;
}
```

--------------------------------

### Retrieve Raw Firmware Table using NtQuerySystemInformation (Windows Vista+)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/firmware-tables

Retrieves the raw firmware table by calling NtQuerySystemInformation with the SystemFirmwareTableInformation class and a pre-initialized SYSTEM_FIRMWARE_TABLE_INFORMATION structure. This is used on Windows Vista and later.

```c
NtQuerySystemInformation(
    SystemFirmwareTableInformation,  // 76 
    sfti,
    Length,
    &Length);
```

--------------------------------

### Check for Virtual Registry in Sandboxie using NtQueryObject

Source: https://evasions.checkpoint.com/src/Evasions/techniques/global-os-objects

This method detects the presence of a virtual registry in Sandboxie by querying the object name information for the registry key '\REGISTRY\USER' using `NtQueryObject`. If the returned name does not match, it suggests a Sandboxie environment.

```c
NtQueryObject(
    hUserKey,
    ObjectNameInformation,
    oni, // OBJECT_NAME_INFORMATION object
    Size,
    NULL
);
```

--------------------------------

### Gather System Hardware Information using sysctl and ioreg

Source: https://evasions.checkpoint.com/src/MacOS/macos

These commands are used to gather various hardware details such as model, CPU information, and memory size. While useful for system information, they can also be employed by malware for evasion techniques.

```shell
sysctl -n hw.model
```

```shell
sysctl -n hw.logicalcpu
```

```shell
sysctl -n hw.physicalcpu
```

```shell
sysctl -n hw.memsize
```

```shell
ioreg -rd1 -c IOPlatformExpertDevice
```

```shell
ioreg -rd1 -c IOUSBHostDevice
```

```shell
ioreg -l
```

```shell
system_profiler SPHardwareDataType
```

--------------------------------

### Detect VMware and VirtualBox VM Environments

Source: https://evasions.checkpoint.com/src/Evasions/techniques/registry

This section lists registry keys commonly found in systems running VMware or VirtualBox. These keys can be queried by security software to identify virtualized environments. This information is useful for detecting potential sandboxes or evasion attempts.

```registry
HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation | SystemProductName | VIRTUALBOX
VMware | HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 | Identifier | VMWARE
HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0 | Identifier | VMWARE
HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0 | Identifier | VMWARE
HKLM\HARDWARE\Description\System | SystemBiosVersion | VMWARE
HKLM\HARDWARE\Description\System | SystemBiosVersion | INTEL - 6040000
HKLM\HARDWARE\Description\System | VideoBiosVersion | VMWARE
HKLM\HARDWARE\Description\System\BIOS | SystemProductName | VMware
HKLM\SYSTEM\ControlSet001\Services\Disk\Enum | 0 | VMware
HKLM\SYSTEM\ControlSet001\Services\Disk\Enum | 1 | VMware
HKLM\SYSTEM\ControlSet001\Services\Disk\Enum | DeviceDesc | VMware
HKLM\SYSTEM\ControlSet001\Services\Disk\Enum | FriendlyName | VMware
HKLM\SYSTEM\ControlSet002\Services\Disk\Enum | DeviceDesc | VMware
HKLM\SYSTEM\ControlSet002\Services\Disk\Enum | FriendlyName | VMware
HKLM\SYSTEM\ControlSet003\Services\Disk\Enum | DeviceDesc | VMware
HKLM\SYSTEM\ControlSet003\Services\Disk\Enum | FriendlyName | VMware
HKCR\Installer\Products | ProductName | vmware tools
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall | DisplayName | vmware tools
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall | DisplayName | vmware tools
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall | DisplayName | vmware tools
HKLM\SYSTEM\ControlSet001\Control\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 | CoInstallers32 | *vmx*
HKLM\SYSTEM\ControlSet001\Control\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 | DriverDesc | VMware*
HKLM\SYSTEM\ControlSet001\Control\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 | InfSection | vmx*
HKLM\SYSTEM\ControlSet001\Control\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 | ProviderName | VMware*
HKLM\SYSTEM\ControlSet001\Control\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings | Device Description | VMware*
HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation | SystemProductName | VMWARE
HKLM\SYSTEM\CurrentControlSet\Control\Video\\{GUID}\Video | Service | vm3dmp
HKLM\SYSTEM\CurrentControlSet\Control\Video\\{GUID}\Video | Service | vmx_svga
HKLM\SYSTEM\CurrentControlSet\Control\Video\\{GUID}\0000 | Device Description | VMware SVGA*
Xen | HKLM\HARDWARE\Description\System\BIOS | SystemProductName | Xen
```

--------------------------------

### Check HDD Name Using Windows API

Source: https://evasions.checkpoint.com/src/Evasions/techniques/hardware

This C++ code snippet uses Windows API functions (SetupDiGetClassDevs, SetupDiEnumDeviceInfo, SetupDiGetDeviceRegistryProperty) to retrieve the friendly name of a Hard Disk Drive (HDD). It's used to detect if the HDD name matches known virtual machine identifiers.

```cpp
hDevs = SetupDiGetClassDevs(
    &guid,  // GUID_DEVCLASS(DEVINTERFACE)_DISKDRIVE
    NULL,
    NULL,
    DIGCF_PRESENT);

SetupDiEnumDeviceInfo(
    hDevsInfo,
    0,
    &devinfo);  // PSP_DEVINFO_DATA

SetupDiGetDeviceRegistryProperty(
    hDevs,
    &devinfo,
    SPDRP_FRIENDLYNAME,
    &dword_1,
    szFriendlyName,  // HDD name will be here
    dFriendlyNameSize,
    &dword_2);
```

--------------------------------

### Initialize SYSTEM_FIRMWARE_TABLE_INFORMATION for SMBIOS Firmware Table (Windows Vista+)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/firmware-tables

Initializes the SYSTEM_FIRMWARE_TABLE_INFORMATION structure for retrieving SMBIOS firmware tables on Windows Vista and later. This involves setting specific values for Action, ProviderSignature ('RSMB'), TableID, and TableBufferLength.

```c
SYSTEM_FIRMWARE_TABLE_INFORMATION *sfti = 
    (PSYSTEM_FIRMWARE_TABLE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, Length);
sfti->Action = SystemFirmwareTable_Get; // 1
sfti->ProviderSignature = 'RSMB';
sfti->TableID = 0;
sfti->TableBufferLength = Length;
```

--------------------------------

### Check File Existence in C++

Source: https://evasions.checkpoint.com/src/Evasions/techniques/filesystem

This C++ function, `is_FileExists`, determines if a given file path exists and is not a directory. The `vmware_files` function iterates through a predefined list of VMware blacklisted files, constructing their full paths using the Windows directory and checking their existence.

```cpp
BOOL is_FileExists(TCHAR* szPath)
{
    DWORD dwAttrib = GetFileAttributes(szPath);
    return (dwAttrib != INVALID_FILE_ATTRIBUTES) && !(dwAttrib & FILE_ATTRIBUTE_DIRECTORY);
}

/*
Check against some of VMware blacklisted files
*/
VOID vmware_files()
{
    /* Array of strings of blacklisted paths */
    TCHAR* szPaths[] = {
        _T("system32\drivers\vmmouse.sys"),
        _T("system32\drivers\vmhgfs.sys"),
    };
    
    /* Getting Windows Directory */
    WORD dwlength = sizeof(szPaths) / sizeof(szPaths[0]);
    TCHAR szWinDir[MAX_PATH] = _T("");
    TCHAR szPath[MAX_PATH] = _T("");
    GetWindowsDirectory(szWinDir, MAX_PATH);
    
    /* Check one by one */
    for (int i = 0; i < dwlength; i++)
    {
        PathCombine(szPath, szWinDir, szPaths[i]);
        TCHAR msg[256] = _T("");
        _stprintf_s(msg, sizeof(msg) / sizeof(TCHAR), _T("Checking file %s: "), szPath);
        if (is_FileExists(szPath))
            print_results(TRUE, msg);
        else
            print_results(FALSE, msg);
    }
}
```

--------------------------------

### Query Process Image Name (C)

Source: https://evasions.checkpoint.com/src/Evasions/techniques/filesystem

This C code snippet demonstrates how to retrieve the full path of a process's executable using the `QueryFullProcessImageName` Windows API function. It requires a handle to the target process, obtained via `OpenProcess`, and specifies the process ID. The function populates a buffer with the executable path. Note: This code requires a valid PID and appropriate process permissions.

```c
DWORD PID = 1337; // process ID of the target process
HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, PID);
DWORD value = MAX_PATH;
char buffer[MAX_PATH];
QueryFullProcessImageName(hProcess, 0, buffer, &value);
printf("EXE Path: %s\n", buffer);
```
Tokens:
Raw