AntiCrack-DotNet

This is kinda of a late update, but here we are, with some bug fixes, improvments, etc.

• Fixed a bug in Setting DLL Policy Mitigation.
• Added initial syscall support for some anti debugging options (not all of them yet) to avoid some anti-anti-debuggers and other hooking solutions like scyllahide.
• Added calls that would make it harder for harmony hooks to detect like Marshal.Copy, etc.
• Removed LoadLibraryA/LoadLibraryW Patching as it is useless for production apps.
• Fixed a bug in hardware breakpoints detection.
• overall improvements and bug fixes.

AntiCrack-DotNet

Improved CLR Functions hooks detection.

AntiCrack-DotNet

some code improvements and any.run detection by LimerBoy.

AntiCrack-DotNet

some changes made in the console ui and some added features.

Features Added:

• Detection for Triage. (thanks to 1)
• Detection for Parallels (thanks to 1)
• Detection for Qemu. (thanks to 1)
• Detection for Virtualization-Based Security. (thanks to 1)
• Detection for Memory Integrity Protection. (thanks to 1)
• Detection for Invoked Assembly.
• Detection for CLR Functions Hooking.

Improvements:

• Improved Console UI. (thanks to 1)
• General Code Improvements. (thanks to 1)
• WinAPI hooking detection improvements.

AntiCrack-DotNet

New Features:

• Added NtSetDebugFilterState check
• Added Page Guard breakpoints detection
• Added a check for devices created by sandboxes or VMs
• Added a check for injected libraries by adding dll path whitelisting check
• Added secure boot detection

Improved:

• improved hooking detection
• some optimizations

AntiCrack-DotNet

New Features:

• Added a Detection to check if Kernel Debugging Enabled on the system.

Improvements:

• Improved Hooks Detection Code by replacing it's WinAPI calls with a lower-level ones and adding kernelbase.dll module.

AntiCrack-DotNet

Improved Hooks Detection

AntiCrack-DotNet

new Anti-Debugging Methods:

• Parent Process Name Checking.

• GetForegroundWindow.

• Now CloseHandle are replaced with NtClose and it's now in two categories: Invalid Handle, Protected Handle.

• Added Patching DbgBreakPoint for Anti-Debugging Attach.

new Anti-Virtualization Methods:

• Checking For Known Bad VM File Locations.

• Checking For Known Bad Process Names.

• Checking For Ports on the system.

New Detection Categories Added:

• Hooks Detection (Checking for hooks on common anti-debugging functions)

• Other Detections (checks if unsigned/test-signed drivers are allowed to load)

this release also contains a console output improvements.

AntiCrack-DotNet

Anti-Debugging: Added Hardware Breakpoints Detection, Replacing CheckRemoteDebuggerPresent with NtQueryInformationProcessCheck with 3 other checks: ProcessDebugFlags, ProcessDebugPort, ProcessDebugObjectHandle.

Anti-Dll Injection: Taking Advantage of Binary Image Mitigation Policy to prevent injecting Non-Microsoft Binaries.

AntiCrack DotNet

First Release.