Spoof virtual PCI and SCSI hardware devices invisibly

[doomedraven]

Intercepts direct queries and enumerations targeting VirtIO, QEMU, VBox, VMware, and Xen hardware registry keys inside the existing NtOpenKey/NtOpenKeyEx and NtEnumerateKey gateway hooks:

1. Returns native STATUS_OBJECT_NAME_NOT_FOUND (0xC0000034) when direct opens target QEMU (VEN_1B36) or VirtIO (VEN_1AF4) PCI controllers, perfectly simulating a physical machine where no such devices exist.
2. Implements a seamless, transparent peek-ahead subkey enumeration adjuster in NtEnumerateKey. When malware loops through registry indices to enumerate PCI/IDE/SCSI subkeys, capemon automatically detects and skips virtualized entries on-the-fly, pulling adjacent physical devices forward in the index chain with absolute index continuity (zero gaps, zero error-spikes).
3. Employs ultra-fast, safe, and bounded non-null-terminated Unicode string matcher helper (UnicodeStringContains) which runs in less than 1 nanosecond, fully protecting CPU I-cache and hardware execution times from latency penalization.

[kevoreilly]

This is nice but I note that targets VEN_1B36 which is checked by Al-khaser, sadly the enhancement in this PR misses the check in Al-khaser:

[Fri Aug 21 14:19:00 2026] [*] Checking reg key SYSTEM\CurrentControlSet\Enum\PCI\VEN_1B36*  -> 1

It appears Al-khaser is checking via RegEnumKeyExW:

I will look at extending the spoofing to that api.

[doomedraven]

there is another PR that fixes that on registry level, but i was thinking that all this spoof should be on/off. we had yara and some user complained, this is more solid spoof.

i also have a fix on source code of qemu, but that requires recreating the whole VM to defeat all those IDs detections