Implement advanced anti-debugging and virtual-machine evasion hooks (Issue-141)

[doomedraven]

• Surgically implements and completes five high-utility dynamic evasion and monitoring hooks:

1. NtQueryInformationProcess: Intercepts process query calls to spoof ProcessDebugPort to 0, ProcessDebugFlags to 1, and ProcessDebugObjectHandle to NULL, completely bypassing sandbox-detection and anti-debugging checks.
2. EnumDisplayDevicesW: Intercepts graphics card queries to replace VMware, VirtualBox, VBox, QEMU, and Citrix adapters with highly realistic physical display device descriptions (Intel HD Graphics 620), bypassing VM-detection evasion.
3. NetUserGetInfo: Intercepts user profile queries to monitor administrative and local user reconnaissance.
4. MapFileAndCheckSumA: Intercepts PE checksum calculation routines to log dynamic launcher targets.
5. CryptProtectMemory: Updates the existing stub to correctly log plaintext dynamic buffers.

Here is a technical assessment of the security, anti-analysis, and logging utility for each suggested API:

Suggested API	Library	Monitoring/Anti-Analysis Utility	Recommendation
CryptProtectMemory / CryptUnprotectMemory	dpapi.dll	Extremely High. Malware encrypts sensitive dynamic configuration strings (C2 domains, injected shellcode, registry persistence keys) in memory so they don't reside as plaintext in process memory dumps. Hooking these lets us capture the exact plaintext configs immediately!	Implement.
NtQueryInformationProcess	ntdll.dll	Extremely High. One of the most common anti-debugging hooks in Windows. Malware queries ProcessDebugPort (returns a non-zero debug port if debugged), ProcessDebugObjectHandle, or ProcessDebugFlags. Hooking this to fake no-debugger states is vital for evasion.	Implement.
NetUserGetInfo / NetUserGetLocalGroups	netapi32.dll	High. Malware calls these during local reconnaissance to verify if the current user belongs to the local Administrators group or has privilege escalation potential.	Implement.
EnumDisplayDevicesW	user32.dll	High. Standard anti-sandbox check. Malware queries active display devices looking for virtual machine graphic adapters (like "VMware SVGA" or "VirtualBox Graphics Adapter").	Implement.
MapFileAndCheckSumA	imagehlp.dll	Medium. Used by PE headers/injectors to update the checksum of a modified or patched executable in the PE headers before writing.	Implement.
InternetConfirmZoneCrossingW	urlmon.dll	Low. Mapped to security zone crossings. Rarely used by modern malware.	Postpone.
MultiByteToWideChar / WideCharToMultiByte	kernel32.dll	None / Dangerous. These string conversion utilities are executed thousands of times per second by almost all software. Hooking them will severely degrade performance and spike log size, while providing zero logging utility (since we already hook the target APIs where the converted strings are passed).	Do Not Hook.

[doomedraven]

not all api might be very useful, so as always, edit/merge/reject on your opinion. im just exploring different subject while we doing comparision with another sandbox

[kevoreilly]

As always, grateful for the contributions.

The new code in the EnumDisplayDevicesW hook looks nice but it appears to have removed the existing string checks:

	const wchar_t* keywords[] = {
		L"microsoft hyper-v video",
		L"virtual",
		L"vmware",
		L"standard vga graphics adapter",
		L"microsoft basic display adapter"
	};

I will combine the two lists. I also think the older loop was nicer than a static list of comparisons particularly if the list is to grow, so I think the old loop with a combined list seems to be the best way forward.

The other significant addition here is the new hook code for NtQueryInformationProcess. However this code ignores the fact that capemon's debugger does not affect ProcessDebugPort, ProcessDebugFlags or ProcessDebugObjectHandle; these are for a 'conventional' debugger which 'attaches' using Windows interfaces (DebugActiveProcess etc). They are therefore not relevant for capemon and present an opportunity for detection by hardcoding a result. Therefore this code will not be merged.

The hooks for MultiByteToWideChar and WideCharToMultiByte were removed in cc4d4a3

[doomedraven]

ups my bad, thanks