+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Hacking and Cracking Zone (https://bhcforums.cc/Forum-Hacking-and-Cracking-Zone)
+--- Forum: Hacking (https://bhcforums.cc/Forum-Hacking)
+---- Forum: Hacking Tools (https://bhcforums.cc/Forum-Hacking-Tools)
+---- Thread: [funcion]_anti_sandboxie_shellcode (/Thread-funcion-anti-sandboxie-shellcode)
[funcion]_anti_sandboxie_shellcode - Blackhatking - 02-10-2020
//---------------------------------------------------------
// use :
// if Anti_Sandboxie = True then Exit;
//---------------------------------------------------------
function Anti_Sandboxie: Bool;
var
hRes: DWORD;
Const
Shell: Array [0 .. 258] of byte = ($55, $8B, $EC, $83, $C4, $F4, $53, $56,
$57, $64, $8B, $05, $30, $00, $00, $00, $8B, $40, $0C, $8B, $40, $0C, $8B,
$00, $8B, $00, $8B, $40, $18, $89, $45, $FC, $8B, $4D, $FC, $66, $81, $39,
$4D, $5A, $0F, $85, $A8, $00, $00, $00, $8B, $45, $FC, $33, $D2, $52, $50,
$8B, $41, $3C, $99, $03, $04, $24, $13, $54, $24, $04, $83, $C4, $08, $81,
$38, $50, $45, $00, $00, $0F, $85, $87, $00, $00, $00, $8B, $48, $78, $03,
$4D, $FC, $8B, $79, $18, $85, $FF, $7C, $7A, $47, $33, $DB, $8B, $45, $FC,
$33, $D2, $52, $50, $8B, $41, $20, $33, $D2, $52, $50, $8B, $C3, $C1, $E0,
$02, $99, $03, $04, $24, $13, $54, $24, $04, $83, $C4, $08, $03, $04, $24,
$13, $54, $24, $04, $83, $C4, $08, $8B, $00, $03, $45, $FC, $81, $38, $4C,
$6F, $61, $64, $75, $3E, $83, $C0, $04, $81, $38, $4C, $69, $62, $72, $75,
$33, $8B, $45, $FC, $03, $41, $24, $33, $D2, $52, $50, $8B, $C3, $03, $C0,
$99, $03, $04, $24, $13, $54, $24, $04, $83, $C4, $08, $66, $8B, $00, $8B,
$55, $FC, $03, $51, $1C, $0F, $B7, $C0, $C1, $E0, $02, $03, $D0, $8B, $02,
$03, $45, $FC, $8B, $F0, $EB, $04, $43, $4F, $75, $89, $C6, $45, $F4, $73,
$C6, $45, $F5, $62, $C6, $45, $F6, $69, $C6, $45, $F7, $65, $C6, $45, $F8,
$64, $C6, $45, $F9, $6C, $C6, $45, $FA, $6C, $C6, $45, $FB, $00, $8D, $45,
$F4, $50, $FF, $D6, $5F, $5E, $5B, $8B, $E5, $5D, $C3);
begin
Result := False;
asm
CALL Shell
MOV hRes, EAX
end;
if hRes <> 0 then
Result := True;
end;