Working with a mounted flash drive

If a flash drive smaller than 80 GB is mounted, there will be a false positive.
ayoubfaouzi · Mar 6, 2024 · a7268ff · a7268ff
1 parent 1f7c4a6
commit a7268ff
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/al-khaser/AntiVM/Generic.cpp b/al-khaser/AntiVM/Generic.cpp
@@ -542,6 +542,7 @@ BOOL disk_size_wmi()
 			// Iterate over our enumator
 			while (pEnumerator)
 			{
+				BOOL detectedRealDisk = FALSE;
 				hRes = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn);
 				if (0 == uReturn)
 					break;
@@ -561,6 +562,9 @@ BOOL disk_size_wmi()
 							if (diskSizeBytes < minHardDiskSize) { // Less than 80GB
 								bFound = TRUE;
 							}
+							else { // Detect real disk
+								detectedRealDisk = TRUE;
+							}
 						}
 
 						// release the current result object
@@ -572,7 +576,7 @@ BOOL disk_size_wmi()
 				pclsObj->Release();
 
 				// break from while
-				if (bFound)
+				if (bFound || detectedRealDisk)
 					break;
 			}
 
@@ -2011,4 +2015,4 @@ BOOL number_SMBIOS_tables()
 		free(smbios);
 	}
 	return result;
-}
+}