CheesyDoodle

Function AntiVMware():boolean;
begin
 try
  asm
   push edx;
   push ecx;
   push ebx;
   mov eax, 'VMXh';
   mov ebx, 0; // This can be any value except MAGIC
   mov ecx, 10; // "CODE" to get the VMware Version
   mov edx, 'VX'; // Port Number
   in eax, dx; // Read port
   //On return EAX returns the VERSION
   cmp ebx, 'VMXh'; // is it VMware
   setz Result; //Set flag state
   pop ebx;
   pop ecx;
   pop edx;
  end;
 except
  Result:= False;
 end;
end;

if AntiVMware then
  MessageBox(0, 'VMware Instance Detected', 'VMware Detected', +MB_OK +MB_ICONINFORMATION)
  else
  MessageBox(0, 'No VMware Instance Detected', 'No VMware Detected', +MB_OK +MB_ICONINFORMATION);

(************************************
 Unit    : uAddNewSectionPE
 Author  : JEDI Code Library (JCL)
 Modded  : Departure
 Url     : cheesydoodle.com
************************************)
unit uAddNewSectionPE;
 
interface
 
Uses
 Windows, Classes, SysUtils;
 
function AddNewSection(sFileName, sNewSectionName: String; dwNewSectionSize, dwNewSectionCharacteristics: DWORD): Boolean;
 
implementation
 
function PeMapImgSections(const NtHeaders: PImageNtHeaders): PImageSectionHeader;
begin
  if NtHeaders = nil then
    Result := nil
  else
    Result := PImageSectionHeader(DWORD(@NtHeaders^.OptionalHeader) +
      NtHeaders^.FileHeader.SizeOfOptionalHeader);
end;
 
function PeMapImgFindSection(const NtHeaders: PImageNtHeaders;
  const SectionName: string): PImageSectionHeader;
var
  Header: PImageSectionHeader;
  I: Integer;
  P: PChar;
begin
  Result := nil;
  if NtHeaders <> nil then
  begin
    P := PChar(SectionName);
    Header := PeMapImgSections(NtHeaders);
    with NtHeaders^ do
      for I := 1 to FileHeader.NumberOfSections do
        if StrLComp(PChar(@Header^.Name), P, IMAGE_SIZEOF_SHORT_NAME) = 0 then
        begin
          Result := Header;
          Break;
        end
        else
          Inc(Header);
  end;
end;
 
function PeMapImgNtHeaders(const BaseAddress: Pointer): PImageNtHeaders;
begin
  Result := nil;
  if IsBadReadPtr(BaseAddress, SizeOf(TImageDosHeader)) then
    Exit;
  if (PImageDosHeader(BaseAddress)^.e_magic <> IMAGE_DOS_SIGNATURE) or
    (PImageDosHeader(BaseAddress)^._lfanew = 0) then
    Exit;
  Result := PImageNtHeaders(DWORD(BaseAddress) + DWORD(PImageDosHeader(BaseAddress)^._lfanew));
  if IsBadReadPtr(Result, SizeOf(TImageNtHeaders)) or
    (Result^.Signature <> IMAGE_NT_SIGNATURE) then
      Result := nil
end;
 
function AddNewSection(sFileName, sNewSectionName: String; dwNewSectionSize, dwNewSectionCharacteristics: DWORD): Boolean;
var
  ImageStream                       : TMemoryStream;
  NtHeaders                         : PImageNtHeaders;
  Sections, LastSection, NewSection : PImageSectionHeader;
  VirtualAlignedSize                : DWORD;
  I, X, NeedFill                    : Integer;
 
  procedure Alignment(var Value: DWORD; Alignment: DWORD);
  begin
    if (Value mod Alignment) <> 0 then
      Value := ((Value div Alignment) + 1) * Alignment;
  end;
 
begin
 
 ImageStream := TMemoryStream.Create;
  try
    try
      ImageStream.LoadFromFile(sFileName);
      NtHeaders := PeMapImgNtHeaders(ImageStream.Memory);
      Assert(NtHeaders <> nil);
      Sections := PeMapImgSections(NtHeaders);
      Assert(Sections <> nil);
      // Check whether there is not a section with the name already. This
      // should never occur.
      Assert(PeMapImgFindSection(NtHeaders, sNewSectionName) = nil);
      LastSection := Sections;
      Inc(LastSection, NtHeaders^.FileHeader.NumberOfSections - 1);
      NewSection := LastSection;
      Inc(NewSection);
 
      // Increase the number of sections
      Inc(NtHeaders^.FileHeader.NumberOfSections);
      FillChar(NewSection^, SizeOf(TImageSectionHeader), #0);
      // Virtual Address
      NewSection^.VirtualAddress := LastSection^.VirtualAddress + LastSection^.Misc.VirtualSize;
      Alignment(NewSection^.VirtualAddress, NtHeaders^.OptionalHeader.SectionAlignment);
      // Physical Ofset
      NewSection^.PointerToRawData := LastSection^.PointerToRawData + LastSection^.SizeOfRawData;
      Alignment(NewSection^.PointerToRawData, NtHeaders^.OptionalHeader.FileAlignment);
      // Section name
      StrPLCopy(PChar(@NewSection^.Name), sNewSectionName, IMAGE_SIZEOF_SHORT_NAME);
      // Characteristics flags
      NewSection^.Characteristics := dwNewSectionCharacteristics;
 
      // Size of virtual data area
      NewSection^.Misc.VirtualSize := dwNewSectionSize;
      VirtualAlignedSize := dwNewSectionSize;
      Alignment(VirtualAlignedSize, NtHeaders^.OptionalHeader.SectionAlignment);
      // Update Size of Image
      Inc(NtHeaders^.OptionalHeader.SizeOfImage, VirtualAlignedSize);
      // Raw data size
      NewSection^.SizeOfRawData := dwNewSectionSize;
      Alignment(NewSection^.SizeOfRawData, NtHeaders^.OptionalHeader.FileAlignment);
      // Update Initialized data size
      Inc(NtHeaders^.OptionalHeader.SizeOfInitializedData, NewSection^.SizeOfRawData);
 
      // Fill data to alignment
      NeedFill := Integer(NewSection^.SizeOfRawData) + dwNewSectionSize;
 
      // Note: Delphi linker seems to generate incorrect (unaligned) size of
      // the executable when adding data so the position could be
      // behind the size of the file then.
      ImageStream.Seek(NewSection^.PointerToRawData, soFromBeginning);
 
      X := 0;
      for I := 1 to NeedFill do
        ImageStream.WriteBuffer(X, 1);
 
      ImageStream.SaveToFile(sFileName);
      Result := True;
    except
      Result := False;
    end;
  finally
    ImageStream.Free;
  end;
end;
 
end.

(* *****************************************************
  Unit             : uMultiMemPatch
  Author           : Departure
  Url              : cheesydoodle.com
 
  Info:
     An Easy way to patch your Target in memory,
     Just add your VA and your array of bytes,
     it will load the target in suspended mode
     write the bytes to address(s) given and then
     resume the thread with new Patches.
 
  Usage:
   uses
    uMultiMemPatch;
   Var
    MyArrayOfPatches: APatchRec;
   Being
    AddPatch($0040107B,[$90,$90,$90],MyArrayOfPatches);
    AddPatch($004010B0,[$90,$EB],MyArrayOfPatches);
    WritePatches('CrackMe.exe', MyArrayOfPatches);
    MyArrayOfPatches:= Nil;
   end;
  ***************************************************** *)
 
unit uMultiMemPatch;
 
interface
 
uses
 Windows;
 
type
 TPatchRec = Record
  dwAddress: Dword;
  baPatches: Array of Byte;
 end;
 
type
 APatchRec = Array of TPatchRec;
 
 Procedure AddPatch(dwAddress: Dword; aPatches: Array of byte; var ArrayRecord: APatchRec);
 
implementation
 
Procedure AddPatch(dwAddress: Dword; aPatches: Array of byte; var ArrayRecord: APatchRec);
var
 Patch: TPatchRec;
 i: Integer;
begin
 {Set the Address}
 Patch.dwAddress:= dwAddress;
 {Set the Length of Patches}
 SetLength(Patch.baPatches, Length(aPatches));
 {Add the Patches}
 for i:= low(aPatches) to high(aPatches) do
  Patch.baPatches[i]:= aPatches[i];
 
 {Check if Array is already Built}
 if ArrayRecord = Nil then
   SetLength(ArrayRecord,1)
 else
  SetLength(ArrayRecord,Length(ArrayRecord) +1);
 {Add out Patches to the Array}
 ArrayRecord[high(ArrayRecord)]:= Patch;
end;
 
Function WritePatches(sFileName: String; ArrayPatches: APatchRec):Boolean;
var
 { Startup and variables used in procedure }
 StartInfo  : TStartupInfo;
 ProcInfo   : TProcessInformation;
 CreateOK   : Boolean;
 Write: Cardinal;
 i: Integer;
begin
  Result:= False;
 { Intinilize }
 FillChar(StartInfo,SizeOf(TStartupInfo),#0);
 FillChar(ProcInfo,SizeOf(TProcessInformation),#0);
 StartInfo.cb := SizeOf(TStartupInfo);
 
 { Create Process in a suspended state }
 CreateOK := CreateProcess(PChar(sFileName),nil, nil, nil,False,CREATE_SUSPENDED,nil, nil, StartInfo, ProcInfo);
 
 { check to see if successful }
 if CreateOK then
  try
   Begin
    for i:= low(ArrayPatches) to high(ArrayPatches) do
    { Write MultiPatch to memory }
     WriteProcessMemory(ProcInfo.hProcess,ptr(ArrayPatches[i].dwAddress),@ArrayPatches[i].baPatches,Length(ArrayPatches[i].baPatches),Write);
    { Resume the thread }
    ResumeThread(ProcInfo.hThread);
    CloseHandle(ProcInfo.hProcess);
    Result:= True;
   end;
  except
   Result:= False;
  end;
end;
 
end.