search

nsmfoo / antivmdetection

Script to create templates to use with VirtualBox to make vm detection harder
MIT License
714 stars 123 forks source link

DSDT dump file not created #42

Closed nov3mb3r closed 5 years ago

nov3mb3r commented 5 years ago

I have followed all the instructions. Although I couldn't install acpidump with apt, I manually downloaded it from https://ubuntu.pkgs.org/16.04/ubuntu-universe-amd64/acpidump_20160108-2_all.deb.html Upon running the python script, it is mentioned that the bin file is created, although it is nowhere to be found! Am I missing something?

$ sudo python antivmdetect.py 
[sudo] password for november: 
--- Generate VirtualBox templates to help thwart VM detection and more .. - Mikael, @nsmfoo ---
[*] Creating VirtualBox modifications ..
[*] Creating a DSDT file...
[*] Finished: A template shell script has been created named: C2SBA.sh
[*] Finished: A DSDT dump has been created named: DSDT_C2SBA.bin
[*] Creating guest based modification file (to be run inside the guest)...
[Info] Could not find a user supplied file called: clipboard_buffer, a random string will be generated instead
[*] Finished: A Powershell file has been created, named: C2SBA.ps1

$ ls
antivmdetect.py  computer.lst    README.md   Volumeid64.exe
C2SBA.ps1        DevManView.chm  readme.txt  Volumeid.exe
C2SBA.sh         DevManView.exe  user.lst
nsmfoo commented 5 years ago

@nov3mb3r sorry for my very late response. Did you ever find out why you did not get the bin file? I looked at the code and It looks like there is no check if the file exist, just because a name is given. .. Added a note to make that more robust.

Can you try to make a manual dump to see if that works? acpidump -s ?

nov3mb3r commented 5 years ago

I re-run the script on a newer architecture CPU and worked. An advice to all of you guys! Don't use CPUs older that 2 decades for malware testing :)