Orginal Test.

Language: Python | Created: 10 months ago | By: HUTAOSHUSBAND ADMIN

Options: [Raw View] [Report] Views: 123

import tkinter as tk
from tkinter import ttk, scrolledtext, messagebox
import os
import sys
import platform
import ctypes
import subprocess
import psutil
try:
    import winreg
except ImportError:
    winreg = None
import time
from datetime import datetime
import threading

class SecurityChecker:
    def __init__(self):
        self.detection_results = {}
        self.is_safe = True
        self.log_messages = []
        
    def log(self, message):
        timestamp = datetime.now().strftime("%H:%M:%S")
        log_entry = f"[{timestamp}] {message}"
        self.log_messages.append(log_entry)
        print(log_entry)
        
    def check_debugger(self):
        """Überprüft auf aktive Debugger"""
        detected = False
        self.log("\n" + "="*60)
        self.log("🔍 Debugger-Erkennung")
        self.log("="*60)
        
        # Windows Debugger Check
        if sys.platform == 'win32':
            try:
                if ctypes.windll.kernel32.IsDebuggerPresent():
                    self.log("⚠️ WARNUNG: IsDebuggerPresent() hat einen Debugger erkannt!")
                    detected = True
                else:
                    self.log("✅ IsDebuggerPresent() - Kein Debugger erkannt")
            except:
                self.log("ℹ️ IsDebuggerPresent() nicht verfügbar")
        
        # Process Name Check
        debugger_names = ['ida', 'ida64', 'ollydbg', 'x64dbg', 'x32dbg', 
                         'windbg', 'gdb', 'processhacker', 'cheatengine',
                         'immunity', 'radare2', 'ghidra']
        
        for proc in psutil.process_iter(['name']):
            try:
                proc_name = proc.info['name'].lower()
                for dbg in debugger_names:
                    if dbg in proc_name:
                        self.log(f"⚠️ WARNUNG: Debugger-Prozess gefunden: {proc.info['name']}")
                        detected = True
            except:
                pass
        
        if not detected:
            self.log("✅ Keine bekannten Debugger-Prozesse gefunden")
        
        self.detection_results['debugger'] = detected
        if detected:
            self.is_safe = False
        
        time.sleep(0.5)
            
    def check_vm(self):
        """Überprüft auf virtuelle Maschinen"""
        detected = False
        self.log("\n" + "="*60)
        self.log("🔍 VM-Erkennung")
        self.log("="*60)
        
        # BIOS Manufacturer
        try:
            manufacturer = platform.system()
            self.log(f"ℹ️ System: {manufacturer}")
            
            if sys.platform == 'win32':
                result = subprocess.check_output(
                    'wmic bios get manufacturer', 
                    shell=True,
                    stderr=subprocess.DEVNULL
                ).decode()
                
                vm_signs = ['vmware', 'virtualbox', 'qemu', 'xen', 'hyper-v', 'kvm', 'parallels']
                for sign in vm_signs:
                    if sign in result.lower():
                        self.log(f"⚠️ WARNUNG: VM-Signatur gefunden in BIOS: {sign}")
                        detected = True
        except:
            self.log("ℹ️ BIOS-Info konnte nicht abgerufen werden")
        
        # CPU Count Check
        cpu_count = psutil.cpu_count()
        self.log(f"ℹ️ CPU Kerne: {cpu_count}")
        if cpu_count < 2:
            self.log("⚠️ WARNUNG: Ungewöhnlich wenige CPU-Kerne (VM-Indikator)")
            detected = True
        
        # RAM Check
        ram_gb = psutil.virtual_memory().total / (1024**3)
        self.log(f"ℹ️ RAM: {ram_gb:.2f} GB")
        if ram_gb < 4:
            self.log("⚠️ WARNUNG: Wenig RAM (möglicher VM-Indikator)")
            detected = True
        
        # MAC Address Check
        try:
            import uuid
            mac = ':'.join(['{:02x}'.format((uuid.getnode() >> elements) & 0xff) 
                           for elements in range(0,2*6,2)][::-1])
            
            vm_macs = ['00:05:69', '00:0c:29', '00:1c:14', '00:50:56', '08:00:27']
            for vm_mac in vm_macs:
                if mac.startswith(vm_mac):
                    self.log(f"⚠️ WARNUNG: VM MAC-Adresse erkannt: {mac}")
                    detected = True
                    break
            
            if not detected:
                self.log(f"✅ MAC-Adresse scheint legitim: {mac}")
        except:
            self.log("ℹ️ MAC-Adresse konnte nicht überprüft werden")
        
        if not detected:
            self.log("✅ Keine VM-Indikatoren gefunden")
            
        self.detection_results['vm'] = detected
        if detected:
            self.is_safe = False
        
        time.sleep(0.5)
            
    def check_sandbox(self):
        """Überprüft auf Sandbox-Umgebungen"""
        detected = False
        self.log("\n" + "="*60)
        self.log("🔍 Sandbox-Erkennung")
        self.log("="*60)
        
        # File System Checks
        sandbox_files = [
            r'C:\analysis',
            r'C:\sandbox',
            r'C:\cwsandbox',
            r'C:\sample',
            r'C:\virus',
            r'C:\malware'
        ]
        
        for path in sandbox_files:
            if os.path.exists(path):
                self.log(f"⚠️ WARNUNG: Sandbox-Ordner gefunden: {path}")
                detected = True
        
        # User Check
        username = os.getenv('USERNAME', 'unknown')
        self.log(f"ℹ️ Benutzername: {username}")
        
        sandbox_users = ['sandbox', 'malware', 'virus', 'sample', 'test', 'currentuser']
        if any(sand in username.lower() for sand in sandbox_users):
            self.log(f"⚠️ WARNUNG: Verdächtiger Benutzername: {username}")
            detected = True
        
        # Computer Name Check
        computer_name = os.getenv('COMPUTERNAME', 'unknown')
        self.log(f"ℹ️ Computer Name: {computer_name}")
        
        # Uptime Check
        try:
            boot_time = datetime.fromtimestamp(psutil.boot_time())
            uptime = datetime.now() - boot_time
            self.log(f"ℹ️ System-Uptime: {uptime}")
            
            if uptime.total_seconds() < 600:  # 10 Minuten
                self.log("⚠️ WARNUNG: System kürzlich gestartet (Sandbox-Indikator)")
                detected = True
        except:
            self.log("ℹ️ Uptime konnte nicht ermittelt werden")
        
        # Temp Files Check
        temp_files = os.listdir(os.environ.get('TEMP', '/tmp'))
        self.log(f"ℹ️ Temporäre Dateien: {len(temp_files)}")
        if len(temp_files) < 10:
            self.log("⚠️ WARNUNG: Sehr wenige temporäre Dateien (Sandbox-Indikator)")
            detected = True
        
        if not detected:
            self.log("✅ Keine Sandbox-Indikatoren gefunden")
            
        self.detection_results['sandbox'] = detected
        if detected:
            self.is_safe = False
        
        time.sleep(0.5)
            
    def check_processes(self):
        """Analysiert laufende Prozesse"""
        detected = False
        self.log("\n" + "="*60)
        self.log("🔍 Prozess-Analyse")
        self.log("="*60)
        
        suspicious_processes = [
            'wireshark', 'fiddler', 'tcpdump', 'processhacker',
            'procexp', 'procmon', 'autoruns', 'vboxservice',
            'vmtoolsd', 'vmwareuser', 'vmwaretray', 'vmusrvc',
            'df5serv', 'vboxtray'
        ]
        
        found_procs = []
        for proc in psutil.process_iter(['name']):
            try:
                proc_name = proc.info['name'].lower()
                for susp in suspicious_processes:
                    if susp in proc_name:
                        found_procs.append(proc.info['name'])
                        detected = True
            except:
                pass
        
        if found_procs:
            self.log(f"⚠️ WARNUNG: Verdächtige Prozesse gefunden: {', '.join(set(found_procs))}")
        else:
            self.log("✅ Keine verdächtigen Prozesse gefunden")
        
        # Process Count
        proc_count = len(list(psutil.process_iter()))
        self.log(f"ℹ️ Laufende Prozesse: {proc_count}")
        
        if proc_count < 50:
            self.log("⚠️ WARNUNG: Ungewöhnlich wenige Prozesse (mögliche Sandbox)")
            detected = True
            
        self.detection_results['processes'] = detected
        if detected:
            self.is_safe = False
        
        time.sleep(0.5)
            
    def check_registry(self):
        """Überprüft Windows Registry (nur Windows)"""
        self.log("\n" + "="*60)
        self.log("🔍 Registry-Analyse")
        self.log("="*60)
        
        if sys.platform != 'win32' or winreg is None:
            self.log("ℹ️ Registry-Check nur unter Windows verfügbar")
            return
        
        detected = False
        
        vm_registry_keys = [
            (winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\VBoxGuest"),
            (winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\VBoxMouse"),
            (winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\VBoxSF"),
            (winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\VMTools"),
            (winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\VMware, Inc.\VMware Tools"),
            (winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\Oracle\VirtualBox Guest Additions"),
        ]
        
        for hkey, subkey in vm_registry_keys:
            try:
                winreg.OpenKey(hkey, subkey)
                self.log(f"⚠️ WARNUNG: VM Registry-Key gefunden: {subkey}")
                detected = True
            except:
                pass
        
        if not detected:
            self.log("✅ Keine VM Registry-Keys gefunden")
            
        self.detection_results['registry'] = detected
        if detected:
            self.is_safe = False
        
        time.sleep(0.5)
            
    def check_hardware(self):
        """Überprüft Hardware-Merkmale"""
        detected = False
        self.log("\n" + "="*60)
        self.log("🔍 Hardware-Analyse")
        self.log("="*60)
        
        # Disk Size
        disk_usage = psutil.disk_usage('/')
        disk_gb = disk_usage.total / (1024**3)
        self.log(f"ℹ️ Festplattengröße: {disk_gb:.2f} GB")
        
        if disk_gb < 60:
            self.log("⚠️ WARNUNG: Kleine Festplatte (VM-Indikator)")
            detected = True
        
        # Screen Resolution
        try:
            if sys.platform == 'win32':
                user32 = ctypes.windll.user32
                width = user32.GetSystemMetrics(0)
                height = user32.GetSystemMetrics(1)
                self.log(f"ℹ️ Bildschirmauflösung: {width}x{height}")
                
                if width < 1024 or height < 768:
                    self.log("⚠️ WARNUNG: Niedrige Auflösung (VM-Indikator)")
                    detected = True
        except:
            self.log("ℹ️ Bildschirmauflösung konnte nicht ermittelt werden")
        
        # Check for multiple physical drives
        try:
            partitions = psutil.disk_partitions()
            self.log(f"ℹ️ Anzahl Laufwerke: {len(partitions)}")
        except:
            pass
        
        if not detected:
            self.log("✅ Hardware-Checks bestanden")
            
        self.detection_results['hardware'] = detected
        if detected:
            self.is_safe = False
        
        time.sleep(0.5)
            
    def check_timing(self):
        """Überprüft Timing-Anomalien"""
        detected = False
        self.log("\n" + "="*60)
        self.log("🔍 Timing-Checks")
        self.log("="*60)
        
        # CPU Timing Check
        start = time.time()
        time.sleep(1)
        elapsed = time.time() - start
        
        self.log(f"ℹ️ Sleep-Time: {elapsed:.3f} Sekunden")
        
        if abs(elapsed - 1.0) > 0.5:
            self.log("⚠️ WARNUNG: Timing-Anomalie erkannt (Sandbox-Indikator)")
            detected = True
        else:
            self.log("✅ Timing-Check bestanden")
            
        # RDTSC Check (CPU Cycle Counter)
        try:
            if sys.platform == 'win32':
                self.log("ℹ️ Führe RDTSC-Check durch...")
                # Einfacher Timing-Check für CPU-Zyklen
                start_perf = time.perf_counter()
                for _ in range(1000000):
                    pass
                end_perf = time.perf_counter()
                perf_time = end_perf - start_perf
                self.log(f"ℹ️ Performance Counter: {perf_time:.6f} Sekunden")
        except:
            self.log("ℹ️ Erweiterte Timing-Checks nicht verfügbar")
            
        self.detection_results['timing'] = detected
        if detected:
            self.is_safe = False
        
        time.sleep(0.5)
    
    def check_windows_specific(self):
        """Windows-spezifische Checks"""
        if sys.platform != 'win32':
            return
            
        detected = False
        self.log("\n" + "="*60)
        self.log("🔍 Windows-spezifische Checks")
        self.log("="*60)
        
        try:
            # Check für Remote Debugging
            if ctypes.windll.kernel32.CheckRemoteDebuggerPresent(ctypes.windll.kernel32.GetCurrentProcess(), False):
                self.log("⚠️ WARNUNG: Remote Debugger erkannt!")
                detected = True
            else:
                self.log("✅ Kein Remote Debugger erkannt")
        except:
            self.log("ℹ️ Remote Debugger Check nicht verfügbar")
        
        self.detection_results['windows_specific'] = detected
        if detected:
            self.is_safe = False
        
        time.sleep(0.5)
        
    def run_all_checks(self):
        """Führt alle Sicherheits-Checks aus"""
        self.log("\n" + "="*70)
        self.log("🔒 SICHERHEITSÜBERPRÜFUNG GESTARTET")
        self.log("="*70)
        self.log(f"Datum: {datetime.now().strftime('%d.%m.%Y %H:%M:%S')}")
        self.log(f"System: {platform.system()} {platform.release()}")
        self.log(f"Hostname: {platform.node()}")
        
        checks = [
            self.check_debugger,
            self.check_vm,
            self.check_sandbox,
            self.check_processes,
            self.check_registry,
            self.check_hardware,
            self.check_timing,
            self.check_windows_specific,
        ]
        
        for check in checks:
            try:
                check()
            except Exception as e:
                self.log(f"❌ Fehler bei {check.__name__}: {str(e)}")
        
        self.print_summary()
        
    def print_summary(self):
        """Gibt die Zusammenfassung aus"""
        self.log("\n" + "="*70)
        self.log("📊 SCAN ABGESCHLOSSEN")
        self.log("="*70)
        
        total_checks = len(self.detection_results)
        failed_checks = sum(self.detection_results.values())
        
        self.log(f"Durchgeführte Tests: {total_checks}")
        self.log(f"Erkannte Bedrohungen: {failed_checks}")
        self.log(f"Status: {'🔴 UNSICHERE UMGEBUNG' if not self.is_safe else '🟢 SICHERE UMGEBUNG'}")
        
        self.log("\nDetails:")
        for check, result in self.detection_results.items():
            status = "❌ Erkannt" if result else "✅ Sicher"
            self.log(f"  - {check.replace('_', ' ').capitalize()}: {status}")
        
        self.log("\n" + "="*70)
        
    def write_output_file(self):
        """Schreibt eine Ausgabedatei wenn sicher"""
        try:
            timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
            filename = f"security_check_{timestamp}.txt"
            
            with open(filename, 'w', encoding='utf-8') as f:
                f.write("="*70 + "\n")
                f.write("SICHERHEITSÜBERPRÜFUNG ERFOLGREICH\n")
                f.write("="*70 + "\n\n")
                f.write(f"Datum: {datetime.now().strftime('%d.%m.%Y %H:%M:%S')}\n")
                f.write(f"System: {platform.system()} {platform.release()}\n")
                f.write(f"Hostname: {platform.node()}\n\n")
                f.write("Status: SICHER ✅\n")
                f.write("Keine Debugger, VMs oder Sandboxen erkannt.\n\n")
                f.write("Überprüfte Kategorien:\n")
                for check, result in self.detection_results.items():
                    f.write(f"  - {check.replace('_', ' ').capitalize()}: {'❌ Erkannt' if result else '✅ Sicher'}\n")
                
                f.write("\n" + "="*70 + "\n")
                f.write("VOLLSTÄNDIGES LOG:\n")
                f.write("="*70 + "\n\n")
                for log_msg in self.log_messages:
                    f.write(log_msg + "\n")
            
            abs_path = os.path.abspath(filename)
            self.log(f"\n✅ Datei erfolgreich erstellt: {filename}")
            self.log(f"📁 Pfad: {abs_path}")
            return abs_path
            
        except Exception as e:
            self.log(f"\n❌ Fehler beim Schreiben der Datei: {str(e)}")
            return None

class ResultsGUI:
    def __init__(self, checker):
        self.checker = checker
        try:
             self.root = tk.Tk()
             self.root.title("Security Check - Ergebnisse")
             self.root.geometry("1000x750")
             self.root.configure(bg="#2b2b2b")
             self.setup_gui()
        except Exception as e:
             print(f"GUI initialization failed (expected in headless env): {e}")
             self.root = None

def setup_gui(self):
        # Header
        status_color = "#00ff00" if self.checker.is_safe else "#ff0000"
        status_text = "🟢 SICHERE UMGEBUNG" if self.checker.is_safe else "🔴 UNSICHERE UMGEBUNG"
        
        header = tk.Label(
            self.root, 
            text="🔒 Sicherheitsüberprüfung Abgeschlossen", 
            font=("Arial", 20, "bold"),
            bg="#2b2b2b",
            fg="#ffffff"
        )
        header.pack(pady=15)
        
        status_frame = tk.Frame(self.root, bg="#2b2b2b")
        status_frame.pack(pady=10)
        
        status_label = tk.Label(
            status_frame,
            text=status_text,
            font=("Arial", 16, "bold"),
            bg="#2b2b2b",
            fg=status_color
        )
        status_label.pack()
        
        # Statistics Frame
        stats_frame = tk.Frame(self.root, bg="#3b3b3b", relief=tk.RAISED, borderwidth=2)
        stats_frame.pack(pady=15, padx=20, fill=tk.X)
        
        total_checks = len(self.checker.detection_results)
        failed_checks = sum(self.checker.detection_results.values())
        passed_checks = total_checks - failed_checks
        
        stats_text = f"Tests: {total_checks}  |  Bestanden: {passed_checks}  |  Bedrohungen: {failed_checks}"
        stats_label = tk.Label(
            stats_frame,
            text=stats_text,
            font=("Arial", 12, "bold"),
            bg="#3b3b3b",
            fg="#ffffff",
            pady=10
        )
        stats_label.pack()
        
        # Results Text Area
        results_label = tk.Label(
            self.root,
            text="📋 Detaillierte Ergebnisse:",
            font=("Arial", 12, "bold"),
            bg="#2b2b2b",
            fg="#ffffff"
        )
        results_label.pack(pady=(10, 5))
        
        self.results_text = scrolledtext.ScrolledText(
            self.root,
            width=115,
            height=28,
            font=("Courier", 9),
            bg="#1e1e1e",
            fg="#00ff00",
            insertbackground="white"
        )
        self.results_text.pack(padx=20, pady=5)
        
        # Display all log messages
        for log_msg in self.checker.log_messages:
            self.results_text.insert(tk.END, log_msg + "\n")
        
        self.results_text.config(state=tk.DISABLED)
        
        # Buttons Frame
        button_frame = tk.Frame(self.root, bg="#2b2b2b")
        button_frame.pack(pady=15)
        
        if self.checker.is_safe:
            write_button = tk.Button(
                button_frame,
                text="💾 Datei schreiben",
                command=self.write_file,
                font=("Arial", 12, "bold"),
                bg="#4CAF50",
                fg="white",
                padx=20,
                pady=10,
                cursor="hand2"
            )
            write_button.pack(side=tk.LEFT, padx=10)
        
        close_button = tk.Button(
            button_frame,
            text="❌ Beenden",
            command=self.root.quit,
            font=("Arial", 12),
            bg="#f44336",
            fg="white",
            padx=20,
            pady=10,
            cursor="hand2"
        )
        close_button.pack(side=tk.LEFT, padx=10)
        
    def write_file(self):
        filepath = self.checker.write_output_file()
        if filepath:
            messagebox.showinfo(
                "Erfolg",
                f"✅ Datei erfolgreich erstellt!\n\n{filepath}"
            )
        else:
            messagebox.showerror(
                "Fehler",
                "❌ Fehler beim Schreiben der Datei!"
            )
    
    def run(self):
        if self.root:
            self.root.mainloop()
        else:
            print("Skipping GUI mainloop due to headless environment.")

def main():
    print("\n" + "="*70)
    print("🔒 SICHERHEITSÜBERPRÜFUNG WIRD GESTARTET...")
    print("="*70)
    print("Bitte warten Sie, während die Checks durchgeführt werden...\n")
    
    # Führe alle Checks im Hintergrund aus
    checker = SecurityChecker()
    checker.run_all_checks()
    
    print("\n" + "="*70)
    print("✅ Alle Checks abgeschlossen!")
    print("="*70)
    
    if checker.is_safe:
        print("\n🟢 Keine Bedrohungen erkannt - Umgebung ist sicher!")
        print("GUI wird geöffnet...\n")
    else:
        print("\n🔴 WARNUNG: Bedrohungen erkannt!")
        print("GUI wird mit Ergebnissen geöffnet...\n")
    
    time.sleep(2)
    
    # Zeige GUI mit Ergebnissen
    gui = ResultsGUI(checker)
    gui.run()

if __name__ == "__main__":
    main()