Antilysis

https://docs.rs/antilysis/0.2.2
Admin
A Windows library that detects analysis environments such as VMs, sandboxes, and debuggers to...
Tokens:20,799
Snippets:239
Trust Score:9.1
Update:5 months ago
Show doc for...
Tokens:
Raw
### Example Usage in Test File

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html

This example demonstrates how to call comparaison_known_mac_addr within a larger test or application context, printing the result.

```rust
6fn main() {
   println!("Processes: {}", antilysis::processes());
   println!("Sandbox: {}", antilysis::sandbox().unwrap());
   println!("VM files: {}", antilysis::vm_file_detected());
   println!("Debugger: {}", antilysis::is_debugger_present());
   println!("Detected: {}", antilysis::detected().unwrap());
   println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

   println!("Attempt at hiding thread...");
   antilysis::attempt_hide_thread();
   println!("Done");

   antilysis::wait_for_left_clicks(2);
   println!("Left click");
}
```

--------------------------------

### Example Usage in test.rs

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html?search=u32+-%3E+bool

This example demonstrates how to call comparaison_known_mac_addr within a larger test suite, printing the result along with other antilysis detections.

```rust
fn main() {
   println!("Processes: {}", antilysis::processes());
   println!("Sandbox: {}", antilysis::sandbox().unwrap());
   println!("VM files: {}", antilysis::vm_file_detected());
   println!("Debugger: {}", antilysis::is_debugger_present());
   println!("Detected: {}", antilysis::detected().unwrap());
   println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

   println!("Attempt at hiding thread...");
   antilysis::attempt_hide_thread();
   println!("Done");

   antilysis::wait_for_left_clicks(2);
   println!("Left click");
}
```

--------------------------------

### Usage Example for comparaison_known_mac_addr

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html?search=std%3A%3Avec

This example shows how to use the comparaison_known_mac_addr function and exit the process with status code 0 if a VM is detected. It requires importing the std::process module.

```rust
use std::process;

match antilysis::comparaison_known_mac_addr(){
    Some(true) => process::exit(0),
    _ => {}
}
```

--------------------------------

### Example Calling a Documented Function in Rust

Source: https://docs.rs/antilysis/0.2.2/scrape-examples-help.html

This example demonstrates how to call a documented function from another crate. Ensure the crate is correctly referenced.

```rust
// examples/ex.rs
fn main() {
  a_crate::a_func();
}
```

--------------------------------

### Full Example of Antilysis Functions

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.detected.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

This example demonstrates the usage of various antilysis functions, including detected(), processes(), sandbox(), vm_file_detected(), is_debugger_present(), comparaison_known_mac_addr(), and attempt_hide_thread().

```rust
fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}
```

--------------------------------

### Example Search Patterns (Rust)

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=

Illustrates common search patterns that can be performed within the Antilysis library.

```rust
std::vec
```

```rust
u32 -> bool
```

```rust
Option<T>, (T -> U) -> Option<U>
```

--------------------------------

### Rust Option Map Example

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Demonstrates how to use the `map` method on an `Option<T>` to apply a function `T -> U` and return an `Option<U>`. This is useful for transforming values that may or may not be present.

```rust
let maybe_number = Some(5);
let maybe_string = maybe_number.map(|n| n.to_string());

assert_eq!(maybe_string, Some("5".to_string()));

let no_number: Option<i32> = None;
let no_string = no_number.map(|n: i32| n.to_string());

assert_eq!(no_string, None);
```

--------------------------------

### Check for Analysis Environment (Rust)

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.detected.html?search=

Use this function to determine if the current environment might be an analysis or virtual machine setup. It aggregates results from various detection mechanisms.

```rust
pub fn detected() -> Option<bool>
```

```rust
use std::process;
 
match antilysis::detected(){
    Some(true) => process::exit(0),
    _ => {}
}
```

--------------------------------

### Check for Sandbox Artifacts

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.sandbox.html?search=

Use this function to determine if common sandbox artifacts are present. It returns Some(true) if found, otherwise None or Some(false). The example shows how to exit the process if a sandbox is detected.

```rust
use std::process;
 
match antilysis::sandbox(){
    Some(true) => process::exit(0),
    _ => {}
}
```

--------------------------------

### Public Function Declaration in Rust

Source: https://docs.rs/antilysis/0.2.2/scrape-examples-help.html

This is an example of a public function declaration in Rust. It serves as a target for scraped examples.

```rust
// src/lib.rs
pub fn a_func() {}
```

--------------------------------

### Check for Sandbox Artifacts

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.sandbox.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Use this function to determine if the current environment is a sandbox. It returns Some(true) if a sandbox artifact is detected, otherwise None or Some(false). The example shows how to exit the process if a sandbox is detected.

```rust
use std::process;

match antilysis::sandbox(){
    Some(true) => process::exit(0),
    _ => {}
}
```

--------------------------------

### Detect VM Files (Rust)

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=

Scans for the presence of common virtual machine disk image files. Returns true if any are found, indicating a potential VM environment.

```Rust
if antilysis::vm_file_detected() {
    println!("VM file detected!");
}
```

--------------------------------

### Implement MAC Address Comparison for VM Detection

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=u32+-%3E+bool

Retrieves network adapter information and compares the MAC addresses against known prefixes for VMware and Virtual Box. Requires Windows API calls.

```rust
pub fn comparaison_known_mac_addr() -> Option<bool> {
    let known_mac_addr: Vec<[u8; 6]> = vec![
        [0x00, 0x05, 0x69, 0x00, 0x00, 0x00], // 00:05:69 Vmware
        [0x00, 0x0C, 0x29, 0x00, 0x00, 0x00], // 00:0C:29 Vmware
        [0x00, 0x1C, 0x14, 0x00, 0x00, 0x00], // 00:1C:14 Vmware
        [0x00, 0x50, 0x56, 0x00, 0x00, 0x00], // 00:50:56 Vmware
        [0x08, 0x00, 0x27, 0x00, 0x00, 0x00], // 08:00:27 Virtual Box
    ];

    unsafe {
        let mut out_buf_len: ULONG = 0;
        GetAdaptersAddresses(AF_UNSPEC.try_into().ok()?, GAA_FLAG_INCLUDE_ALL_INTERFACES, ptr::null_mut(), ptr::null_mut(), &mut out_buf_len);
        let mut buffer: Vec<u8> = vec![0; out_buf_len as usize];
        let adapters_ptr: *mut IP_ADAPTER_ADDRESSES = buffer.as_mut_ptr() as *mut IP_ADAPTER_ADDRESSES;
        let result = GetAdaptersAddresses(AF_UNSPEC.try_into().ok()?, GAA_FLAG_INCLUDE_ALL_INTERFACES, ptr::null_mut(), adapters_ptr, &mut out_buf_len);
        if result == 0 {
            let mut current_adapter = adapters_ptr;
            while !current_adapter.is_null() {
                let adapter = &*current_adapter;
                for i in 0..known_mac_addr.len() {
                    if (known_mac_addr[i][0] == adapter.PhysicalAddress[0]) &&
                    (known_mac_addr[i][1] == adapter.PhysicalAddress[1]) &&
                    (known_mac_addr[i][2] == adapter.PhysicalAddress[2]) {
                        return Some(true);
                    }
                }
                current_adapter = adapter.Next;
            }
        } else {
            return Some(false);
        }
        return Some(false);
    }
}

```

--------------------------------

### Implement VM MAC Address Comparison

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=

Retrieves network adapter information and checks if any MAC addresses match known VMware or Virtual Box prefixes.

```rust
pub fn comparaison_known_mac_addr() -> Option<bool> {
    let known_mac_addr: Vec<[u8; 6]> = vec![
        [0x00, 0x05, 0x69, 0x00, 0x00, 0x00], // 00:05:69 Vmware
        [0x00, 0x0C, 0x29, 0x00, 0x00, 0x00], // 00:0C:29 Vmware
        [0x00, 0x1C, 0x14, 0x00, 0x00, 0x00], // 00:1C:14 Vmware
        [0x00, 0x50, 0x56, 0x00, 0x00, 0x00], // 00:50:56 Vmware
        [0x08, 0x00, 0x27, 0x00, 0x00, 0x00], // 08:00:27 Virtual Box
    ];

    unsafe {
        let mut out_buf_len: ULONG = 0;
        GetAdaptersAddresses(AF_UNSPEC.try_into().ok()?, GAA_FLAG_INCLUDE_ALL_INTERFACES, ptr::null_mut(), ptr::null_mut(), &mut out_buf_len);
        let mut buffer: Vec<u8> = vec![0; out_buf_len as usize];
        let adapters_ptr: *mut IP_ADAPTER_ADDRESSES = buffer.as_mut_ptr() as *mut IP_ADAPTER_ADDRESSES;
        let result = GetAdaptersAddresses(AF_UNSPEC.try_into().ok()?, GAA_FLAG_INCLUDE_ALL_INTERFACES, ptr::null_mut(), adapters_ptr, &mut out_buf_len);
        if result == 0 {
            let mut current_adapter = adapters_ptr;
            while !current_adapter.is_null() {
                let adapter = &*current_adapter;
                for i in 0..known_mac_addr.len() {
                    if (known_mac_addr[i][0] == adapter.PhysicalAddress[0]) &&
                    (known_mac_addr[i][1] == adapter.PhysicalAddress[1]) &&
                    (known_mac_addr[i][2] == adapter.PhysicalAddress[2]) {
                        return Some(true);
                    }
                }
                current_adapter = adapter.Next;
            }
        } else {
            return Some(false);
        }
        return Some(false);
    }
}
```

--------------------------------

### Implement VM File Detection

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=

Scans for specific file paths associated with Virtual Box and VMware. Returns true if any VM files are detected.

```rust
pub fn vm_file_detected() -> bool{
    let file_paths = vec![
        "C:\\windows\\System32\\Drivers\\Vmmouse.sys",
        "C:\\windows\\System32\\Drivers\\vm3dgl.dll",
        "C:\\windows\\System32\\Drivers\\vmdum.dll",
        "C:\\windows\\System32\\Drivers\\vm3dver.dll",
        "C:\\windows\\System32\\Drivers\\vmtray.dll",
        "C:\\windows\\System32\\Drivers\\VMToolsHook.dll",
        "C:\\windows\\System32\\Drivers\\vmmousever.dll",
        "C:\\windows\\System32\\Drivers\\vmhgfs.dll",
        "C:\\windows\\System32\\Drivers\\vmGuestLib.dll",
        "C:\\windows\\System32\\Drivers\\VmGuestLibJava.dll",
        "C:\\windows\\System32\\Drivers\\VBoxMouse.sys",
        "C:\\windows\\System32\\Drivers\\VBoxGuest.sys",
        "C:\\windows\\System32\\Drivers\\VBoxSF.sys",
        "C:\\windows\\System32\\Drivers\\VBoxVideo.sys",
        "C:\\windows\\System32\\vboxdisp.dll",
        "C:\\windows\\System32\\vboxhook.dll",
        "C:\\windows\\System32\\vboxmrxnp.dll",
        "C:\\windows\\System32\\vboxogl.dll",
        "C:\\windows\\System32\\vboxoglarrayspu.dll",
        "C:\\windows\\System32\\vboxoglcrutil.dll",
        "C:\\windows\\System32\\vboxoglerrorspu.dll",
        "C:\\windows\\System32\\vboxoglfeedbackspu.dll",
        "C:\\windows\\System32\\vboxoglpackspu.dll",
        "C:\\windows\\System32\\vboxoglpassthroughspu.dll",
        "C:\\windows\\System32\\vboxservice.exe",
        "C:\\windows\\System32\\vboxtray.exe",
        "C:\\windows\\System32\\VBoxControl.exe",
    ];
    for path in file_paths { if Path::new(path).exists() { return true; } } 
    return false;
}
```

--------------------------------

### Run antilysis functions

Source: https://docs.rs/antilysis/0.2.2/src/test/test.rs.html

This snippet shows how to call various functions from the antilysis library to detect anti-analysis and anti-debugging measures. It prints the results of process detection, sandbox detection, VM file detection, debugger presence, general detection, and known MAC address comparison. It also demonstrates attempting to hide a thread and waiting for user clicks.

```rust
1extern crate antilysis;

// This file is used to create a binary that will test the library's function.
// The binary is meant to be compiled, then executed in different environments and under different conditions.

fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}
```

--------------------------------

### Basic Usage of wait_for_left_clicks

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.wait_for_left_clicks.html

Demonstrates the basic usage of the wait_for_left_clicks function, requiring one left click to proceed.

```rust
antilysis::wait_for_left_clicks(1);
```

--------------------------------

### sandbox()

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html

Attempts to detect common sandbox artifacts by checking the operating system version and hostname.

```APIDOC
## sandbox()

### Description
Returns `Some(true)` if the operating system version starts with '0' or if the hostname is 'john-pc', indicating a potential sandbox environment. Returns `Some(false)` otherwise. Returns `None` if the OS version or hostname cannot be determined.

### Returns
- `Option<bool>`: `Some(true)` if a sandbox is detected, `Some(false)` otherwise, or `None` if detection could not be performed.
```

--------------------------------

### Compare MAC Address (Rust)

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=

Checks if the system's network adapter MAC address matches a known list of virtual machine MAC addresses. Returns Some(true) if a match is found, Some(false) otherwise, or None if information cannot be retrieved.

```Rust
match antilysis::comparaison_known_mac_addr(){
    Some(true) => println!("Known VM MAC address detected!"),
    _ => {}
}
```

--------------------------------

### sandbox()

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Returns whether or not any common sandbox artifact is present. This check is based on OS version and hostname.

```APIDOC
## sandbox()

### Description
Detects common sandbox artifacts by examining the operating system version and hostname. Returns `Some(true)` if a sandbox is likely present, `Some(false)` otherwise. Returns `None` if system information cannot be retrieved.

### Returns
- `Option<bool>`: `Some(true)` if sandbox indicators are found, `Some(false)` otherwise, or `None` if system information is unavailable.
```

--------------------------------

### processes()

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html

Checks for the presence of known analysis tools, virtual machine processes, and debuggers by iterating through running processes.

```APIDOC
## processes()

### Description
Returns `true` if any process name matches a list of known analyzers, VM guest tools, or debuggers. Otherwise, returns `false`.

### Returns
- `bool`: `true` if suspicious processes are found, `false` otherwise.
```

--------------------------------

### Check for VM Files

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.vm_file_detected.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Returns whether or not any VM specific files (Virtual Box and Vmware) are present. Use this to detect if the current environment is a virtual machine.

```rust
pub fn vm_file_detected() -> bool
```

```rust
use std::process;

if antilysis::vm_file_detected() {
    process::exit(0);
}
```

--------------------------------

### Check for VM MAC Addresses (Virtual Box/VMware)

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html?search=

Returns an Option<bool> indicating if the MAC addresses suggest a VM running Virtual Box or VMware. Use this to detect potential sandbox environments.

```rust
pub fn comparaison_known_mac_addr() -> Option<bool>
```

```rust
use std::process;

match antilysis::comparaison_known_mac_addr(){
    Some(true) => process::exit(0),
    _ => {}
}
```

--------------------------------

### Detect VM Files

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html

Checks for the presence of common virtual machine driver files. If any are found, it indicates a VM environment.

```rust
use std::process;

if antilysis::vm_file_detected(){
    process::exit(0);
}
```

--------------------------------

### Compare Known MAC Addresses for VM Detection

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=std%3A%3Avec

Compares network adapter MAC addresses against a list of known VM MAC addresses. Returns Some(true) if a match is found, indicating a VM.

```rust
use std::process;

match antilysis::comparaison_known_mac_addr(){
    Some(true) => process::exit(0),
    _ => {}
}

```

--------------------------------

### detected()

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.detected.html

Returns whether or not any sign of analysis environment is present. Is true if one of the following is true: processes(), is_debugger_present(), comparaison_known_mac_addr(), vm_file_detected(), sandbox().

```APIDOC
## Function detected

### Summary
```rust
pub fn detected() -> Option<bool>
```

### Description
Returns whether or not any sign of analysis environment is present. Is true if one of the following is true: processes(), is_debugger_present(), comparaison_known_mac_addr(), vm_file_detected(), sandbox().

### Use
```rust
use std::process;
 
match antilysis::detected(){
    Some(true) => process::exit(0),
    _ => {}
}
```

### Examples found in repository?
examples/test.rs (line 11)
```rust
fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}
```
```

--------------------------------

### sandbox

Source: https://docs.rs/antilysis/0.2.2/antilysis?search=

Detects common sandbox artifacts.

```APIDOC
## Function: sandbox

### Description
Returns whether or not any common sandbox artifact is present.

### Usage
```rust
let sandbox_present = antilysis::sandbox();
```
```

--------------------------------

### sandbox

Source: https://docs.rs/antilysis/0.2.2/antilysis/index.html

Detects common sandbox artifacts.

```APIDOC
## Function: sandbox

### Description
Returns whether or not any common sandbox artifact is present.

### Signature
```rust
fn sandbox() -> bool
```

### Returns
`true` if sandbox artifacts are detected, `false` otherwise.
```

--------------------------------

### sandbox() -> Option<bool>

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.sandbox.html?search=u32+-%3E+bool

This function checks for the presence of common sandbox artifacts. It returns `Some(true)` if a sandbox is detected, `Some(false)` if no sandbox is detected, and `None` if the detection could not be performed.

```APIDOC
## sandbox

### Description
Returns whether or not any common sandbox artifact is present.

### Signature
`pub fn sandbox() -> Option<bool>`

### Use
```rust
use std::process;

match antilysis::sandbox(){
    Some(true) => process::exit(0),
    _ => {}
}
```

### Example from repository
`examples/test.rs` (line 8):
```rust
fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}
```
```

--------------------------------

### sandbox

Source: https://docs.rs/antilysis/0.2.2/antilysis/index.html?search=

Checks for common sandbox artifacts.

```APIDOC
## Function: sandbox

### Description
Returns whether or not any common sandbox artifact is present.

### Signature
`fn sandbox() -> bool`

### Returns
`bool`: Returns `true` if sandbox artifacts are detected, `false` otherwise.
```

--------------------------------

### Check for Virtual Box or VMware MAC Addresses

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html

Returns an Option<bool> indicating if the MAC addresses suggest a Virtual Box or VMware VM. Use this to determine if the environment is virtualized.

```rust
pub fn comparaison_known_mac_addr() -> Option<bool>
```

```rust
use std::process;
 
match antilysis::comparaison_known_mac_addr(){
    Some(true) => process::exit(0),
    _ => {}
}
```

--------------------------------

### comparaison_known_mac_addr

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Compares the MAC addresses of network adapters against a list of known MAC address prefixes for Virtual Box and VMware.

```APIDOC
## comparaison_known_mac_addr

### Description
Returns if the MAC addresses indicate a VM running with Virtual Box or VMware. This function iterates through network adapters and checks their MAC addresses against a predefined list of VM-specific prefixes.

### Function Signature
`pub fn comparaison_known_mac_addr() -> Option<bool>`

### Return Value
- `Some(true)` if a VM MAC address is detected.
- `Some(false)` if no VM MAC address is detected or an error occurs during adapter retrieval.
- `None` if an error occurs during the initial adapter address retrieval.

### Usage Example
```rust
use std::process;

match antilysis::comparaison_known_mac_addr() {
    Some(true) => process::exit(0),
    _ => {}
}
```
```

--------------------------------

### comparaison_known_mac_addr

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html?search=u32+-%3E+bool

Returns an Option<bool> indicating if the MAC addresses suggest a Virtual Box or VMware VM. `Some(true)` means a VM is detected, `Some(false)` or `None` means no VM detected or unable to determine.

```APIDOC
## comparaison_known_mac_addr

### Description
Returns if the mac addresses indicates a VM running with Virtual Box or VMware.

### Signature
```rust
pub fn comparaison_known_mac_addr() -> Option<bool>
```

### Usage Example
```rust
use std::process;

match antilysis::comparaison_known_mac_addr() {
    Some(true) => process::exit(0), // VM detected
    _ => {} // No VM detected or unable to determine
}
```
```

--------------------------------

### processes() -> bool

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.processes.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Returns whether or not suspicious processes have been found. Includes analyzers (wireshark, process explorer, etc…), VM guest processes, and debuggers.

```APIDOC
## processes()

### Description
Returns whether or not suspicious processes have been found. Includes analyzers (wireshark, process explorer, etc…), VM guest processes, and debuggers.

### Signature
`pub fn processes() -> bool`

### Usage Example
```rust
use std::process;

if antilysis::processes() {
    process::exit(0);
}
```
```

--------------------------------

### Check for Virtual Box or VMware MAC Addresses

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html?search=std%3A%3Avec

Returns Some(true) if the MAC addresses indicate a VM running with Virtual Box or VMware. Otherwise, returns Some(false) or None. Use this to detect virtualization environments.

```rust
pub fn comparaison_known_mac_addr() -> Option<bool>
```

--------------------------------

### processes()

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.processes.html?search=std%3A%3Avec

Checks for suspicious processes including analyzers, VM guest processes, and debuggers. Returns `true` if suspicious processes are found, `false` otherwise.

```APIDOC
## processes()

### Description
Returns whether or not suspicious processes have been found. Includes analyzers (wireshark, process explorer, etc…), VM guest processes, and debuggers processes.

### Function Signature
`pub fn processes() -> bool`

### Usage Example
```rust
use std::process;

if antilysis::processes() {
    process::exit(0);
}
```

### Related Examples
```rust
fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}
```
```

--------------------------------

### comparaison_known_mac_addr

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html?search=

Returns an Option<bool> indicating if the MAC addresses suggest a Virtual Box or VMware VM. Returns Some(true) if a VM is detected, Some(false) otherwise, and None if the check cannot be performed.

```APIDOC
## comparaison_known_mac_addr

### Description
Returns if the mac addresses indicates a VM running with Virtual Box or VMware.

### Signature
```rust
pub fn comparaison_known_mac_addr() -> Option<bool>
```

### Usage Example
```rust
use std::process;

match antilysis::comparaison_known_mac_addr() {
    Some(true) => process::exit(0), // VM detected
    _ => {} // No VM detected or check failed
}
```

### Repository Example
```rust
fn main() {
    // ... other antilysis calls ...
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());
    // ... other antilysis calls ...
}
```
```

--------------------------------

### Check for VirtualBox or VMware MAC Addresses

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html?search=u32+-%3E+bool

This function returns Some(true) if the MAC addresses are indicative of VirtualBox or VMware, otherwise it returns Some(false) or None. Use this to detect virtualization.

```rust
pub fn comparaison_known_mac_addr() -> Option<bool>
```

```rust
use std::process;
 
 match antilysis::comparaison_known_mac_addr(){
    Some(true) => process::exit(0),
    _ => {}
}
```

--------------------------------

### sandbox

Source: https://docs.rs/antilysis/0.2.2/antilysis

Returns whether or not any common sandbox artifact is present.

```APIDOC
## Function: sandbox

### Description
Returns whether or not any common sandbox artifact is present.

### Signature
```rust
fn sandbox() -> bool
```
```

--------------------------------

### detected()

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html

Returns whether or not any sign of analysis environment is present. This is determined by checking for suspicious processes, sandbox artifacts, active debuggers, or known MAC address patterns.

```APIDOC
## detected()

### Description
Returns `Some(true)` if any analysis environment is detected, otherwise `Some(false)`. Returns `None` if underlying checks fail (e.g., OS version or host name cannot be determined).

### Returns
- `Option<bool>`: `Some(true)` if analysis is detected, `Some(false)` otherwise, or `None` if detection could not be performed.
```

--------------------------------

### comparaison_known_mac_addr

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html

Compares the MAC addresses of network adapters against a list of known MAC address prefixes used by Virtual Box and VMware. This helps in identifying if the system is running within a virtualized environment.

```APIDOC
## comparaison_known_mac_addr

### Description
Retrieves network adapter information and checks if any MAC addresses match known prefixes for Virtual Box and VMware. This is another method to detect a virtual machine environment.

### Function Signature
`pub fn comparaison_known_mac_addr() -> Option<bool>`

### Returns
- `Some(true)` if a VM-indicating MAC address is found.
- `Some(false)` if no VM-indicating MAC address is found or if an error occurs during adapter retrieval.
- `None` if there's an issue converting the address family.
```

--------------------------------

### detected()

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=u32+-%3E+bool

Returns whether or not any sign of analysis environment is present. This is determined by checking for suspicious processes, sandbox artifacts, debugger presence, known MAC addresses, or VM files.

```APIDOC
## detected()

### Description
Returns `Some(true)` if any analysis environment indicators are detected, otherwise `Some(false)`. Returns `None` if an underlying check fails (e.g., sandbox detection). The checks include `processes()`, `sandbox()`, `is_debugger_present()`, `comparaison_known_mac_addr()`, and `vm_file_detected()`.

### Returns
- `Option<bool>`: `Some(true)` if analysis is detected, `Some(false)` if not, `None` if an error occurred during checks.
```

--------------------------------

### sandbox

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.sandbox.html?search=

Returns whether or not any common sandbox artifact is present. It returns an Option<bool> where Some(true) indicates a sandbox artifact is detected.

```APIDOC
## sandbox

### Description
Returns whether or not any common sandbox artifact is present.

### Signature
```rust
pub fn sandbox() -> Option<bool>
```

### Usage
```rust
use std::process;

match antilysis::sandbox() {
    Some(true) => process::exit(0),
    _ => {}
}
```

### Example from repository
```rust
fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}
```
```

--------------------------------

### sandbox

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.sandbox.html

Returns whether or not any common sandbox artifact is present. It returns an Option<bool> where Some(true) indicates a sandbox artifact was detected.

```APIDOC
## sandbox

### Description
Returns whether or not any common sandbox artifact is present.

### Signature
```rust
pub fn sandbox() -> Option<bool>
```

### Use
```rust
use std::process;

match antilysis::sandbox() {
    Some(true) => process::exit(0),
    _ => {}
}
```

### Example Usage in Repository
```rust
fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}
```
```

--------------------------------

### processes()

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.processes.html?search=u32+-%3E+bool

Returns whether or not suspicious processes have been found. This includes analyzers (wireshark, process explorer, etc.), VM guest processes, and debuggers.

```APIDOC
## processes()

### Description
Returns whether or not suspicious processes have been found. Includes analyzers (wireshark, process explorer, etc…) VM guest processes and debuggers processes.

### Signature
```rust
pub fn processes() -> bool
```

### Usage Example
```rust
use std::process;

if antilysis::processes() {
    process::exit(0);
}
```
```

--------------------------------

### detected()

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Returns whether or not any sign of analysis environment is present. This function checks for suspicious processes, sandbox artifacts, debugger presence, MAC address anomalies, and VM file indicators.

```APIDOC
## detected()

### Description
Returns `Some(true)` if any analysis environment indicators are detected, otherwise `Some(false)`. Returns `None` if an error occurs during checks.

### Returns
- `Option<bool>`: `Some(true)` if analysis is detected, `Some(false)` otherwise, or `None` if an error occurred.
```

--------------------------------

### Check for Suspicious Processes (Rust)

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.processes.html?search=

Returns whether or not suspicious processes have been found. Includes analyzers (wireshark, process explorer, etc…), VM guest processes, and debuggers. Use this function to determine if the environment is potentially malicious or compromised.

```rust
pub fn processes() -> bool
```

```rust
use std::process;

if antilysis::processes() {
    process::exit(0);
}
```

--------------------------------

### sandbox

Source: https://docs.rs/antilysis/0.2.2/antilysis/index.html?search=u32+-%3E+bool

Detects the presence of common sandbox artifacts.

```APIDOC
## Function: sandbox

### Description
Returns whether or not any common sandbox artifact is present.

### Signature
```rust
fn sandbox() -> bool
```

### Returns
`bool` - `true` if sandbox artifacts are detected, `false` otherwise.
```

--------------------------------

### comparaison_known_mac_addr

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html

Returns `Some(true)` if the MAC addresses indicate a VM running Virtual Box or VMware, otherwise `Some(false)` or `None` if detection fails. It's useful for anti-analysis techniques.

```APIDOC
## comparaison_known_mac_addr

### Description
Returns if the mac addresses indicates a VM running with Virtual Box or VMware.

### Signature
```rust
pub fn comparaison_known_mac_addr() -> Option<bool>
```

### Usage Example
```rust
use std::process;

match antilysis::comparaison_known_mac_addr() {
    Some(true) => process::exit(0), // VM detected
    _ => {} // Not a VM or detection failed
}
```

### Repository Example
```rust
fn main() {
    // ... other antilysis calls ...
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());
    // ... other antilysis calls ...
}
```
```

--------------------------------

### comparaison_known_mac_addr

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.comparaison_known_mac_addr.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Returns `Some(true)` if the MAC addresses indicate a VM running with Virtual Box or VMware, otherwise `Some(false)` or `None`.

```APIDOC
## comparaison_known_mac_addr

### Description
Returns if the mac addresses indicates a VM running with Virtual Box or VMware.

### Signature
```rust
pub fn comparaison_known_mac_addr() -> Option<bool>
```

### Use
```rust
use std::process;

match antilysis::comparaison_known_mac_addr() {
    Some(true) => process::exit(0),
    _ => {}
}
```

### Examples found in repository?
examples/test.rs (line 12)
```rust
fn main() {
    // ... other println statements ...
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());
    // ... other code ...
}
```
```

--------------------------------

### sandbox

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.sandbox.html?search=std%3A%3Avec

Returns whether or not any common sandbox artifact is present. This function returns an Option<bool>.

```APIDOC
## sandbox

### Description
Returns whether or not any common sandbox artifact is present.

### Signature
`pub fn sandbox() -> Option<bool>`

### Usage
```rust
use std::process;

match antilysis::sandbox() {
    Some(true) => process::exit(0),
    _ => {}
}
```

### Example from Repository
```rust
// examples/test.rs (line 8)
println!("Sandbox: {}", antilysis::sandbox().unwrap());
```
```

--------------------------------

### Detect VM Specific Files

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=std%3A%3Avec

Scans for the presence of files commonly associated with VirtualBox and VMware. Exits the process if VM files are detected.

```rust
use std::process;

if antilysis::vm_file_detected(){
    process::exit(0);
}

```

--------------------------------

### Detect Sandbox Artifacts

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html

Identifies common sandbox indicators based on Windows version or hostname. Returns None if OS version or hostname cannot be determined.

```rust
match antilysis::sandbox(){
    Some(true) => process::exit(0),
    _ => {}
}
```

--------------------------------

### Check for VM Files using antilysis::vm_file_detected

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.vm_file_detected.html?search=

Returns whether or not any VM specific files (Virtual Box and Vmware) are present. Use this to detect if the current environment is a virtual machine.

```rust
pub fn vm_file_detected() -> bool
```

```rust
use std::process;

if antilysis::vm_file_detected(){
    process::exit(0);
}
```

```rust
fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}
```

--------------------------------

### antilysis::detected()

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.detected.html?search=

Returns whether or not any sign of analysis environment is present. It is true if any of the following conditions are met: processes(), is_debugger_present(), comparaison_known_mac_addr(), vm_file_detected(), or sandbox().

```APIDOC
## Function detected

### Signature
```rust
pub fn detected() -> Option<bool>
```

### Description
Returns whether or not any sign of analysis environment is present. Is true if one of the following is true: processes(), is_debugger_present(), comparaison_known_mac_addr(), vm_file_detected(), sandbox().

### Use
```rust
use std::process;

match antilysis::detected() {
    Some(true) => process::exit(0),
    _ => {}
}
```

### Example from repository
```rust
fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}
```
```

--------------------------------

### Check for VM Files

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.vm_file_detected.html

Call this function to determine if VM-specific files are present. It returns a boolean value.

```rust
use std::process;

if antilysis::vm_file_detected() {
    process::exit(0);
}
```

--------------------------------

### sandbox

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.sandbox.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Returns whether or not any common sandbox artifact is present. This function returns an Option<bool> where Some(true) indicates a sandbox artifact was detected.

```APIDOC
## sandbox()

### Description
Returns whether or not any common sandbox artifact is present.

### Returns
- `Option<bool>`: `Some(true)` if a sandbox artifact is detected, `None` or `Some(false)` otherwise.

### Usage
```rust
use std::process;

match antilysis::sandbox() {
    Some(true) => process::exit(0), // Exit if sandbox detected
    _ => {} // Continue if no sandbox detected or result is None
}
```
```

--------------------------------

### Check for Analysis Environment (Rust)

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.detected.html

Use this snippet to determine if an analysis environment is detected. It handles the Option<bool> return value, exiting the process if an environment is found.

```rust
use std::process;
 
match antilysis::detected(){
    Some(true) => process::exit(0),
    _ => {}
}
```

--------------------------------

### Detect Suspicious Processes

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html

Checks for the presence of known analysis tools, VM guest processes, or debuggers. Exit if any are found.

```rust
use std::process;

if antilysis::processes(){
    process::exit(0);
}
```

--------------------------------

### detected

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.detected.html?search=Option%3CT%3E%2C+%28T+-%3E+U%29+-%3E+Option%3CU%3E

Returns whether or not any sign of analysis environment is present. Is true if one of the following is true: processes(), is_debugger_present(), comparaison_known_mac_addr(), vm_file_detected(), sandbox().

```APIDOC
## Function: detected

### Description
Returns whether or not any sign of analysis environment is present. This is determined by checking if any of the following conditions are true: `processes()`, `is_debugger_present()`, `comparaison_known_mac_addr()`, `vm_file_detected()`, or `sandbox()`.

### Signature
```rust
pub fn detected() -> Option<bool>
```

### Usage Example
```rust
use std::process;

match antilysis::detected() {
    Some(true) => process::exit(0),
    _ => {}
}
```
```

--------------------------------

### detected

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.detected.html?search=u32+-%3E+bool

Returns whether or not any sign of analysis environment is present. Is true if one of the following is true: processes(), is_debugger_present(), comparaison_known_mac_addr(), vm_file_detected(), sandbox().

```APIDOC
## Function detected

### Signature
```rust
pub fn detected() -> Option<bool>
```

### Description
Returns whether or not any sign of analysis environment is present. This function returns `true` if any of the following conditions are met:

*   `antilysis::processes()` returns a value indicating suspicious processes.
*   `antilysis::is_debugger_present()` returns `true`.
*   `antilysis::comparaison_known_mac_addr()` returns `true`.
*   `antilysis::vm_file_detected()` returns `true`.
*   `antilysis::sandbox()` returns `true`.

### Use
```rust
use std::process;
 
match antilysis::detected(){
    Some(true) => process::exit(0),
    _ => {}
}
```

### Examples found in repository
`examples/test.rs` (line 11)
```rust
fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}
```
```

--------------------------------

### detected

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.detected.html?search=std%3A%3Avec

Returns whether or not any sign of analysis environment is present. Is true if one of the following is true: processes(), is_debugger_present(), comparaison_known_mac_addr(), vm_file_detected(), sandbox().

```APIDOC
## Function detected

### Description
Returns whether or not any sign of analysis environment is present. This is determined by checking if any of the following conditions are true: `processes()`, `is_debugger_present()`, `comparaison_known_mac_addr()`, `vm_file_detected()`, or `sandbox()`.

### Signature
```rust
pub fn detected() -> Option<bool>
```

### Use Case
This function is useful for detecting if the current environment is a suspected analysis or virtualized environment.

### Example
```rust
use std::process;

match antilysis::detected() {
    Some(true) => process::exit(0), // Exit if analysis environment is detected
    _ => {} // Continue execution if no analysis environment is detected or result is None
}
```

### Related Functions
- `processes()`
- `is_debugger_present()`
- `comparaison_known_mac_addr()`
- `vm_file_detected()`
- `sandbox()`
```

--------------------------------

### Antilysis Library Test Binary

Source: https://docs.rs/antilysis/0.2.2/src/test/test.rs.html?search=

This Rust code creates a binary to test the antilysis library. It calls various detection functions and includes a thread hiding attempt. Compile and run this binary in different environments to test its behavior.

```rust
extern crate antilysis;

// This file is used to create a binary that will test the library's function.
// The binary is meant to be compiled, then executed in different environments and under different conditions.

fn main() {
    println!("Processes: {}", antilysis::processes());
    println!("Sandbox: {}", antilysis::sandbox().unwrap());
    println!("VM files: {}", antilysis::vm_file_detected());
    println!("Debugger: {}", antilysis::is_debugger_present());
    println!("Detected: {}", antilysis::detected().unwrap());
    println!("Known MAC address: {}", antilysis::comparaison_known_mac_addr().unwrap());

    println!("Attempt at hiding thread...");
    antilysis::attempt_hide_thread();
    println!("Done");

    antilysis::wait_for_left_clicks(2);
    println!("Left click");
}

```

--------------------------------

### Check for Suspicious Processes

Source: https://docs.rs/antilysis/0.2.2/antilysis/fn.processes.html?search=u32+-%3E+bool

Call this function to determine if any suspicious processes are running on the system. If suspicious processes are found, the function returns true, which can be used to exit the current process.

```rust
use std::process;

if antilysis::processes() {
    process::exit(0);
}
```

--------------------------------

### detected()

Source: https://docs.rs/antilysis/0.2.2/src/antilysis/lib.rs.html?search=std%3A%3Avec

Checks for any signs of an analysis environment. Returns `Some(true)` if any detection method returns true, otherwise `Some(false)`. Returns `None` if underlying checks fail.

```APIDOC
## detected()

### Description
Returns whether or not any sign of analysis environment is present. This is determined by checking for suspicious processes, sandbox artifacts, active debuggers, or specific VM-related files.

### Returns
- `Option<bool>`: `Some(true)` if an analysis environment is detected, `Some(false)` otherwise. Returns `None` if an error occurs during the checks.
```
Tokens:
Raw