Skip to content

Commit 2a8b716

Browse files
authored
Update README.md
1 parent 5015869 commit 2a8b716

File tree

1 file changed

+11
-14
lines changed

1 file changed

+11
-14
lines changed

README.md

Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ By the way, for quick setup, run `install.bat`.
1818
- **Username Check**: Verifies if the current user is a default virtualization user.
1919
- **Recent User Activity**: Checks user activity; if there are fewer than 20 files, it exits.
2020
- **USB Mount**: Checks if a USB was ever plugged into the computer before.
21+
- **VM Artifacts**: Identifies artifacts left behind by virtual machines (VMs), which can indicate the presence of a VM environment.
22+
- **Parallels Check**: Detects Parallels Desktop, a popular virtualization software for macOS, used to run Windows and other guest operating systems.
23+
- **QEMU Detection**: Identifies the presence of QEMU, an open-source machine emulator and virtualizer, which may indicate virtual machine detection.
24+
- **Patching Dll**: Taking Advantage of Binary Image Signature Mitigation Policy to prevent injecting Non-Microsoft Binaries.
2125

2226
### Anti-Debug
2327

@@ -29,17 +33,16 @@ This module includes functions to detect and prevent debugging and analysis of t
2933
- **Check Blacklisted Windows Names**: Verifies if the process name matches any blacklisted names commonly used by debuggers.
3034
- **Running Processes**: Retrieves a list of running processes and identifies potential malicious ones.
3135
- **Parent Anti-Debug**: Detects if the parent process is attempting to debug the current process.
32-
- **Kill Bad Processes**: Terminates known malicious processes detected on the system.
33-
- **Detects Usermode AntiAntiDebuggers**: Detects user-mode anti-anti-debuggers like ScyllaHide (BASIC).
36+
- **Check for bad Processes**: if detected on the system, do something based on your option (bool).
37+
- **Detects Usermode AntiAntiDebuggers**: Detects user-mode anti-anti-debuggers like ScyllaHide (BASIC / VMP Plugin).
3438
- **Internet Connection Check**: Checks if an internet connection is present.
3539

36-
### Process
37-
38-
This module focuses on critical processes that should be monitored or protected.
39-
40+
### ProcessUtils
41+
ProcessUtils you probably need for you app
4042
- **Critical Process**: Implements functionality to manage critical processes essential for system operation.
41-
- **SeDebugPrivilege**: Grants better permissions.
42-
43+
- **Set Runtime**: Set the app runtime to specified one: ```MacOS,Linux,Windows```
44+
- **Enable All Tokens**: Enable all tokens Windows privileges for current process
45+
- **IsAdmin - Request Admin**: Request admin for current process, and Check if current process is Admin
4346

4447
### Quick Nutshell
4548

@@ -51,9 +54,3 @@ This module focuses on critical processes that should be monitored or protected.
5154
- https://github.com/MmCopyMemory: Provided ideas and much more. Check out his GitHub.
5255
- I made this because I noticed someone was trying to crack or analyze my other Go programs. Previously, I had many lines of anti-debugging code (I coded lazily and put everything into one), so I wanted to create something quick and reliable that would make a reverse engineer's life harder. Thus, I made GoDefender.
5356

54-
55-
## Added V1.0.7
56-
- Patching DLL (Migitation Policy)
57-
- QEMU Detection
58-
- Parallels Check
59-
- VM Artifacts

0 commit comments

Comments
 (0)