Skip to content

Commit acbb29e

Browse files
authored
Add files via upload
1 parent f3cd810 commit acbb29e

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

AntiCrack-DotNet/Program.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,7 @@ private static void ExecuteAntiVirtualizationTricks()
228228
ConsoleConfig.DisplayResult("Checking for devices created by VMs or Sandboxes: ", AntiVirtualization.CheckDevices(), false, "Checks for VM or sandbox devices.");
229229
ConsoleConfig.DisplayResult("Checking if the program is emulated using a timing check: ", AntiVirtualization.Generic.EmulationTimingCheck(), false, "Checks if the program is emulated using a timing check.");
230230
ConsoleConfig.DisplayResult("Checking For Ports (useful to detect VMs which have no ports connected): ", AntiVirtualization.Generic.PortConnectionAntiVM(), false, "Checks for VM port connections.");
231+
ConsoleConfig.DisplayResult("Checking For Static values in KUSER_SHARED_DATA Time Data: ", AntiVirtualization.Generic.IsKUserSharedDataTimeStatic(), false, "Checks if the Time values in KUSER_SHARED_DATA is static, which many emulators don't update regularly.");
231232
ConsoleConfig.DisplayResult("Checking for AVX instructions not being implemented properly: ", AntiVirtualization.Generic.AVXInstructions(), false, "Checks to see if the AVX instructions are properly implemented to see if we are running in a virtual/emulated CPU.");
232233
ConsoleConfig.DisplayResult("Checking for RDRAND instruction not being implemented/misconfigured: ", AntiVirtualization.Generic.RDRANDInstruction(), false, "Checks to see if the RDRAND instruction is supported and properly implemented which some emulators don't.");
233234
ConsoleConfig.DisplayResult("Checking if the instructions that control the RFlags (or EFlags) register are handled correctly: ", AntiVirtualization.Generic.FlagsManipulationInstructions(), false, "Verifies if the RFlags (or EFlags) register manipulations are correct, which may indicate an emulator.");

0 commit comments

Comments
 (0)