Add support for Lockdown Browser versions ≥2.1.2.09

[Voidless7125]

Important

This issue will be closed/marked as resolved when the code in this repository supports using Lockdown Browser versions ≥ 2.1.2.09. As long as this issue remains open, you will be detected and potentially banned when using this tool.

---

A potential solution?

Lockdown Browser now detects using detours in a test on version 2.1.3.00, and although it isn't 100% that you will get caught, it can sometimes. This was implemented in 2.1.2.09.

We can use the instructions MOV EDI, EDI,
https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583

Here's a screenshot of decompiling
(2.1.3.00)

This was not implemented in 2.1.2.08 or earlier.

[Voidless7125]

So since we can't inject a dll into the program, I'll also implement a way to hide the vm agent from as a running program.

[Voidless7125]

We might not even need to do that. Here's how we are being detected:

Haha, nice.

[Rolozity]

Oh shit...did you garner up a fix?

[Voidless7125]

Oh shit...did you garner up a fix?

Sadly, not yet. I won't be able to hide detours, so we will have to be low level to fix this.

[Rolozity]

No worries man. Wish I was as intelligent as you so I could help you tackle this issue!

Seems like a lot of fun on the backhand! Appreciate your hard work bro.