Defeat advanced WMI hardware sensor evasion checks (al-khaser Bypass)

[doomedraven]

Implements a fully dynamic "Borrow and Spoof" class hijacking architecture inside hook_wmi.c to defeat advanced motherboard, bios, fan, temperature, slot, and sensor evasion checks:

1. Implements class-hijacking for Win32_Fan, Win32_CacheMemory, Win32_VoltageProbe, Win32_PortConnector, Win32_ThermalZoneInfo, CIM_Memory, CIM_Sensor, CIM_NumericSensor, CIM_TemperatureSensor, CIM_VoltageSensor, CIM_PhysicalConnector, and CIM_Slot.
2. Intercepts ExecQuery/ExecQueryAsync SELECT queries for these typically unsupported VM classes and dynamically rewrites them to "SELECT * FROM Win32_ComputerSystem" strictly before execution to materialize a valid COM enumerator.
3. Shape-shifts the returned objects in WMI_Get by intercepting __CLASS queries to return the original queried class name.
4. Clears WBEM_E_NOT_FOUND errors and spoofs realistic, high-fidelity physical hardware device properties (Status, DeviceID, ActiveCooling, CurrentReading, InstalledSize, ConnectorType, PortType, CurrentTemperature), completely bypassing all VM sensor detection checks.
   The Evasion Challenge: Hardware-Presence Verification

Virtual machines (VMware, VirtualBox, QEMU, Citrix) typically do not emulate low-level motherboard and chassis physical hardware devices such as cooling fans, physical cache slots, voltage probes, or thermal zone
sensors.

Malware calls WMI queries like SELECT * FROM Win32_Fan or SELECT * FROM Win32_VoltageProbe to check for these physical objects. If the WMI service returns zero objects (which is default behavior in a VM), or
returns a WBEM_E_INVALID_CLASS error, the malware instantly infers it is running inside a virtualized sandbox and terminates.

---

The Solution: The "Borrow & Spoof" Class Hijacking Engine

Because virtual machines genuinely lack these low-level class instances, Old_WMI_ExecQuery would normally return an empty enumerator.

To bypass this without writing thousands of lines of custom COM providers, we engineered a sophisticated "Borrow & Spoof" class-hijacking mechanism:

1. Intercepting & Rewriting the Query
   When ExecQuery or ExecQueryAsync detects a query targeting any of the twelve unpopulated hardware/sensor classes:

• Win32_Fan / Win32_CacheMemory / Win32_VoltageProbe / Win32_PortConnector / Win32_ThermalZoneInfo
• CIM_Memory / CIM_Sensor / CIM_NumericSensor / CIM_TemperatureSensor / CIM_VoltageSensor / CIM_PhysicalConnector / CIM_Slot

It sets a thread-local tracking enum (g_last_seen_fake_class = WMI_FAKE_CLASS_FAN, etc.) and surgically rewrites the SQL query string in memory on-the-fly to "SELECT * FROM Win32_ComputerSystem" before executing
it!

• Because Win32_ComputerSystem is guaranteed to exist on all machines, the query returns exactly 1 valid object instance.

2. Shape-Shifting the Class Name
   When the malware retrieves this object and calls Get(L"__CLASS") to identify what it is, we intercept the call. Instead of returning "Win32_ComputerSystem", we dynamically return the original faked class name
   (e.g., "Win32_Fan")!

3. Answering Missing Hardware Properties
   When the malware calls Get to read the sensor's physical readings (which do not exist on Win32_ComputerSystem), the WMI service returns a WBEM_E_NOT_FOUND error.

• We catch this error, clear it back to S_OK, and let our expanded SpoofWmiData engine inject highly realistic, physical-machine readings:
  • Win32_Fan: Spoofs DeviceID → "Fan0", Status → "OK", and ActiveCooling → TRUE.
  • Win32_CacheMemory: Spoofs InstalledSize → 32768 (32MB Cache).
  • Win32_VoltageProbe: Spoofs CurrentReading → 12000 (12V).
  • Win32_ThermalZoneInfo: Spoofs CurrentTemperature → 3000 (300.0 Kelvin / 26.85 °C).
  • Connectors & Slots: Spoofs realistic physical status, port types, and IDs!

---