More anti-anti-vm suggestions - Githubissues

hzqst / VmwareHardenedLoader

Vmware Hardened VM detection mitigation loader (anti anti-vm)

MIT License

1.7k stars 460 forks source link

More anti-anti-vm suggestions #16

Open skidunion opened 4 years ago

skidunion commented 4 years ago

Change network adapter type to bridged VM can be detected by checking for "localdomain" in DNS suffix

Add 'disk.EnableUUID = "true"' to VMX VMware usually has empty disk serial numbers on SCSI. It can be detected by running "wmic diskdrive get SerialNumber"

No disk serials:

With disk serials:

Extra: Change disk size to >60 gb A program could detect small disk sizes which usually means a VM. Its not widely used to use this a precautious method

Example: https://github.com/LordNoteworthy/al-khaser/blob/6e66d448eaf25dd67a06f23ce256fa2674d68444/al-khaser/AntiVM/Generic.cpp#L274