@@ -6839,13 +6839,13 @@ struct VM {
68396839 " Xen"
68406840 } };
68416841
6842- constexpr std::array<const char * , 22 > brands_map = { {
6843- brands ::PARALLELS, brands ::PARALLELS,
6844- brands ::VBOX, brands ::VBOX, brands ::VBOX, brands ::VBOX, brands ::VBOX,
6845- brands ::VMWARE, brands ::VMWARE, brands ::VMWARE, brands ::VMWARE,
6846- brands ::QEMU, brands ::QEMU, brands ::QEMU, brands ::QEMU, brands ::BOCHS,
6847- nullptr , nullptr , nullptr , nullptr , nullptr ,
6848- brands ::XEN
6842+ constexpr std::array<brand::brand_enum , 22 > brands_map = { {
6843+ brand_enum ::PARALLELS, brand_enum ::PARALLELS,
6844+ brand_enum ::VBOX, brand_enum ::VBOX, brand_enum ::VBOX, brand_enum ::VBOX, brand_enum ::VBOX,
6845+ brand_enum ::VMWARE, brand_enum ::VMWARE, brand_enum ::VMWARE, brand_enum ::VMWARE,
6846+ brand_enum ::QEMU, brand_enum ::QEMU, brand_enum ::QEMU, brand_enum ::QEMU, brand_enum ::BOCHS,
6847+ brand_enum::NULL_BRAND, brand_enum::NULL_BRAND, brand_enum::NULL_BRAND, brand_enum::NULL_BRAND, brand_enum::NULL_BRAND ,
6848+ brand_enum ::XEN
68496849 } };
68506850
68516851 // inside struct to not have to move out of function, constexpr this way because of c++ 11 compatibility
@@ -6919,8 +6919,8 @@ struct VM {
69196919 }
69206920
69216921 debug (" FIRMWARE: Detected " , pattern);
6922- const char * detected_brand = brands_map[i];
6923- return (detected_brand ? core::add (detected_brand) : true );
6922+ const enum brand_enum detected_brand = brands_map[i];
6923+ return core::add (detected_brand);
69246924 }
69256925 }
69266926
@@ -7862,19 +7862,19 @@ struct VM {
78627862 const char * dll_name;
78637863 const char * brand;
78647864 } dlls[] = {
7865- {" sbiedll.dll" , brands ::SANDBOXIE},
7866- {" pstorec.dll" , brands ::CWSANDBOX},
7867- {" vmcheck.dll" , brands ::VPC},
7868- {" cmdvrt32.dll" , brands ::COMODO},
7869- {" cmdvrt64.dll" , brands ::COMODO},
7870- {" cuckoomon.dll" , brands ::CUCKOO},
7871- {" SxIn.dll" , brands ::QIHOO},
7872- {" wpespy.dll" , brands ::NULL_BRAND}
7865+ {" sbiedll.dll" , brand_enum ::SANDBOXIE},
7866+ {" pstorec.dll" , brand_enum ::CWSANDBOX},
7867+ {" vmcheck.dll" , brand_enum ::VPC},
7868+ {" cmdvrt32.dll" , brand_enum ::COMODO},
7869+ {" cmdvrt64.dll" , brand_enum ::COMODO},
7870+ {" cuckoomon.dll" , brand_enum ::CUCKOO},
7871+ {" SxIn.dll" , brand_enum ::QIHOO},
7872+ {" wpespy.dll" , brand_enum ::NULL_BRAND}
78737873 };
78747874
78757875 for (const auto & x : dlls) {
78767876 if (GetModuleHandleA (x.dll_name ) != nullptr ) {
7877- debug (" DLL: Found " , x.dll_name , " (" , x.brand , " )" );
7877+ debug (" DLL: Found " , x.dll_name , " (" , brand::brand_enum_to_string ( x.brand ) , " )" );
78787878 return core::add (x.brand );
78797879 }
78807880 }
@@ -8056,9 +8056,9 @@ struct VM {
80568056 };
80578057
80588058 constexpr target_pattern targets[] = {
8059- {" 55274-640-2673064-23950" , brands ::JOEBOX},
8060- {" 76487-644-3177037-23510" , brands ::CWSANDBOX},
8061- {" 76487-337-8429955-22614" , brands ::ANUBIS}
8059+ {" 55274-640-2673064-23950" , brand_enum ::JOEBOX},
8060+ {" 76487-644-3177037-23510" , brand_enum ::CWSANDBOX},
8061+ {" 76487-337-8429955-22614" , brand_enum ::ANUBIS}
80628062 };
80638063
80648064 constexpr size_t target_length = 21 ;
@@ -11654,7 +11654,7 @@ struct VM {
1165411654 last_detected_brand = p_brand;
1165511655 last_detected_score = score; // Store for the engine to read
1165611656
11657- u8 brand_score = brand_scoreboard[static_cast <u8 >(p_brand)].score ;
11657+ brand_score_t brand_score = brand_scoreboard[static_cast <u8 >(p_brand)].score ;
1165811658
1165911659 brand_scoreboard[static_cast <u8 >(p_brand)] = { p_brand, ++brand_score };
1166011660
@@ -12810,9 +12810,9 @@ std::array<VM::core::technique, VM::enum_size + 1> VM::core::technique_table = [
1281012810 {VM::HYPERVISOR_QUERY, {100 , VM::hypervisor_query}},
1281112811 {VM::AUDIO, {25 , VM::audio}},
1281212812 {VM::DISPLAY, {25 , VM::display}},
12813- {VM::WINE , {100 , VM::wine }},
12813+ {VM::WINE_FUNC , {100 , VM::wine_function }},
1281412814 {VM::DLL, {50 , VM::dll}},
12815- {VM::DBVM , {150 , VM::dbvm }},
12815+ {VM::DBVM_HYPERCALL , {150 , VM::dbvm_hypercall }},
1281612816 {VM::UD, {100 , VM::ud}},
1281712817 {VM::BLOCKSTEP, {100 , VM::blockstep}},
1281812818 {VM::VMWARE_BACKDOOR, {100 , VM::vmware_backdoor}},
0 commit comments