统一天下
禁止发言
积分 348
发帖 348
注册 2010-2-2
|
#1 检测Kaspersky沙盒之DeleteFile大法
//
//AUTHOR:黑客守卫者
//BLOG:http://hi.baidu.com/ihxdef
//URL:http://hi.baidu.com/ihxdef/blog/ ... 75d8c9d562259b.html
//
#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>
//
//Define
//
int DetectSandBox(void);
//
//Routine
//
int DetectSandBox(void)
{
//
//Routine Description:
//
//This routine detect if is run in real OS or SandBox.
//
//Arguments:
//
//None
//
//Return Value:
//
// -1 for error
// 0 for run in real OS
// 1 for run in SandBox
//
//Detect
//
char strCurrentFile[MAX_PATH] = {0};
GetModuleFileName(NULL,strCurrentFile,MAX_PATH);
BOOL bRet = FALSE;
bRet = DeleteFile(strCurrentFile);
if( bRet == TRUE )
{
return 1;
}
else
{
return 0;
}
return -1;
}
//
//Entry
//
int main(void)
{
int iRet = DetectSandBox();
if( iRet == 1 )
{
MessageBox(NULL,"RUN IN SANDBOX! DAMN IT!","NOTICE",MB_ICONSTOP);
}
else
if( iRet == 0 )
{
MessageBox(NULL,"RUN IN REAL OS!","NOTICE",MB_ICONINFORMATION);
}
else
{
MessageBox(NULL,"UNKNOWN ERROR! DAMN IT!","NOTICE",MB_ICONSTOP);
}
return 0;
}
| |
※ ※ ※ 本文纯属【统一天下】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
|
 |
|
