nsmfoo / antivmdetection

Script to create templates to use with VirtualBox to make vm detection harder
MIT License
714 stars 123 forks source link

/usr/bin/cd-drive #24

Closed SavSanta closed 6 years ago

SavSanta commented 6 years ago

Hello, I just discovered your script. I was attempting to test it out while reading the README.md

So I ran python antivmdetection.py

It gave me an error saying that dmidecode wasnt install. I pip installed dmidecode succesfully but on second run it seems that it is giving me the error: [WARNING] Dependencies are missing, please verify that you have installed: /usr/bin/cd-drive

That being said I am running Linux on an Thinkpad X200 without a CD-ROM drive. I suppose this is the issue?

sudo dmidecode -t0
# dmidecode 2.12
SMBIOS 2.4 present.

Handle 0x0000, DMI type 0, 24 bytes
BIOS Information
    Vendor: LENOVO
    Version: 6DET38WW (2.02 )
    Release Date: 12/19/2008
    Address: 0xE0000
    Runtime Size: 128 kB
    ROM Size: 8192 kB
    Characteristics:
        PCI is supported
        PC Card (PCMCIA) is supported
        PNP is supported
        BIOS is upgradeable
        BIOS shadowing is allowed
        ESCD support is available
        Boot from CD is supported
        Selectable boot is supported
        BIOS ROM is socketed
        EDD is supported
        ACPI is supported
        USB legacy is supported
        BIOS boot specification is supported
        Targeted content distribution is supported
    BIOS Revision: 2.2
    Firmware Revision: 1.3
SavSanta commented 6 years ago

Cancel that I happened to open the script and start perusing it when I saw that it is an explicit dependency. I resolved it via the package install. Thanks

Although, not despite that I am running on Linux it is under the assumption that I am running on Windows the new error is

[WARNING] Dependencies are missing, please verify that you have installed: DevManView.exe

nsmfoo commented 6 years ago

Hi,

I'm glad that you made progress, I know that things can be improved regarding user friendliness.

Regarding the Windows dependencies, the reason for the check is that the Windows binaries is bundled in the template. thus you only need to transfer one file that contains everything you need to the guest machine. So get yourself a copy of DevManView.exe and you will be set.

After a successful run I think, things might clear a bit, if not please let me know! =)

SavSanta commented 6 years ago

Hi nsmfoo,

So the thing is yesterday I just removed the Windows dependencies from the list "DevManView.exe", "Volumeid.exe", "computer.lst", "user.lst"

Just to attempt a dry-run. I dont know why but I think the library dmidecode must require a specific version because it doesnt seem to have the ability to call the dmidecode.bios().values() portion.

Because it gives me a traceback error.

Traceback (most recent call last):
  File "antivmdetect.py", line 46, in <module>
    dmi_info['DmiBIOSReleaseDate'] = v['data']['Relase Date']

Outside of this I tried to import the dmiedecode and trying the function builtins. I get:

Python 2.7.6 (default, Oct 26 2016, 20:30:19) 
[GCC 4.8.4] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import dmidecode
>>> dmidecode.bios()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
AttributeError: 'module' object has no attribute 'bios'
>>>

Yesterday when I inspected the dmidecode it looks like the whole (i guess programmers call it interface or api?) might've changed. Because I only see:

In [2]: dmidecode.<tab completion>
dmidecode.TYPE       dmidecode.parse_dmi  dmidecode.profile

So unfortunately I wasnt able to fully test it out. Sorry!

nsmfoo commented 6 years ago

I think we should be able to solve this one =)

Which Linux dist are you using, name and version if possible

Also if you run: sudo dmidecode -t 0 , which information do you see?

SavSanta commented 6 years ago

So for my output on that I have:

`Out[22]: 'Linux santa-laptop 3.19.0-32-generic #37~14.04.1-Ubuntu SMP Thu Oct 22 09:41:40 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux' which is running Linux Mint with Ubuntu Trusty as the base

The output of sudo output is the same as my opening post. Nothing has changed so far.

`
# dmidecode 2.12
SMBIOS 2.4 present.

Handle 0x0000, DMI type 0, 24 bytes
BIOS Information
    Vendor: LENOVO
    Version: 6DET38WW (2.02 )
    Release Date: 12/19/2008
    Address: 0xE0000
    Runtime Size: 128 kB
    ROM Size: 8192 kB
    Characteristics:
        PCI is supported
        PC Card (PCMCIA) is supported
        PNP is supported
        BIOS is upgradeable
        BIOS shadowing is allowed
        ESCD support is available
        Boot from CD is supported
        Selectable boot is supported
        BIOS ROM is socketed
        EDD is supported
        ACPI is supported
        USB legacy is supported
        BIOS boot specification is supported
        Targeted content distribution is supported
    BIOS Revision: 2.2
    Firmware Revision: 1.3
nsmfoo commented 6 years ago

Ah yes of course, sorry about the output repeat.

So what happens if you remove the pip installed dmidecode package and try with: apt-get install python-dmidecode ? Any change?

SavSanta commented 6 years ago

So the installation candidate for python-dmidecode is

sudo apt-cache show python-dmidecode
Package: python-dmidecode
Priority: optional
Section: universe/python
Installed-Size: 290
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Original-Maintainer: Debian Python Modules Team <python-modules-team@lists.alioth.debian.org>
Architecture: amd64
Version: 3.10.13-3
Depends: python (<< 2.8), python (>= 2.7), python-support (>= 0.90.0), libc6 (>= 2.14), libxml2 (>= 2.7.4), python-libxml2
Filename: pool/universe/p/python-dmidecode/python-dmidecode_3.10.13-3_amd64.deb
Size: 66612
MD5sum: 7f67ea5c942dd9e294ed09aef10636c1
SHA1: 5017c7d5ba22ceefd52faebaf82d67697b8c81f3
SHA256: 92e73a314053d79452bcdc5ecf0023f1690bb60a557542b23d5f71536c5a55c3
Description-en: Python extension module for dmidecode
 DMI (the desktop management interface) provides a standardized description of
 a computer's hardware, including characteristics such as BIOS serial number
 and hardware connectors.
 .
 This package provides an interface to the DMI data available from the BIOS.
 It is intended to be used as a back-end tool by other hardware detection
 programs implemented in Python.
Description-md5: 7e04763bd0893634762c697f539cd68e
Homepage: https://fedorahosted.org/python-dmidecode/
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Origin: Ubuntu

Upon removing the pip version of dmidecode (0.8 i beleve) and installing the dmidecode from the repository. The dmidecode does have a dmidecode.bios() function.

Everything works as expected (minus the fact that I dont have the Windows files).

sudo python antivmdetect.py 
--- Generate VirtualBox templates to help thwart VM detection and more .. - Mikael, @nsmfoo ---
[*] Creating VirtualBox modifications ..
[*] Creating a DSDT file...
[*] Finished: A template shell script has been created named: 7458WKR.sh
[*] Finished: A DSDT dump has been created named: DSDT_7458WKR.bin
[*] Creating guest based modification file (to be run inside the guest)...
Traceback (most recent call last):
  File "antivmdetect.py", line 591, in <module>
    with open("DevManView.exe", "rb") as file:
IOError: [Errno 2] No such file or directory: 'DevManView.exe'

So it looks like it was solved!

nsmfoo commented 6 years ago

Great to hear! So just try to add the missing Windows binaries and let me know how it works out

You are almost there =)

SavSanta commented 6 years ago

Im sure it works after this fine!

However I dont know when Ill get around to testing it because Im slightly bulasy (that is made word comprised of busy/lazy lol). The windows machine is in storage id have to dig thru.

Or....can I pull any of the Windows binaries say from an already installed separate Virtual Disk image running XP on it? I wonder if that would be a problem....?

nsmfoo commented 6 years ago

Oh DevManView is not a binary that is shipped with Windows! You can find it here: http://www.nirsoft.net/utils/device_manager_view.html

I hope this might get you to test if the script works a bit quicker ;) Also made up words are the best words!

nsmfoo commented 6 years ago

I will go a head and close this issue. Please let me know if you have anymore questions by either open a new case or re-open this one.

ameisehaufen commented 5 years ago

Just to be recorded. In Mac you have to change the path in dependency check section of the script. cd-drive is actually in /usr/local/bin/cd-drive.