search

nsmfoo / antivmdetection

Script to create templates to use with VirtualBox to make vm detection harder
MIT License
703 stars 123 forks source link

Windows 10 20H2 x64 Fails to Install - Blue Screen of Death #61

Open DavidBerdik opened 3 years ago

DavidBerdik commented 3 years ago

When I try to install Windows 10 20H2 x64 in my patched VM, the boot disk fails. It will attempt to load, display the blue screen of death, and restart.

Capture

I have not tried other Windows 10 ISOs, but I was able to install Windows 7 x64 and it has worked so far. For my purposes Windows 7 is sufficient, but I felt that this should still be reported.

I am using VirtualBox 6.1.16, and my host operating system is Windows 10 Pro, x64. The shell script and PowerShell scripts that I am working with were generated on an old laptop running Ubuntu.

nsmfoo commented 3 years ago

@DavidBerdik thank you for reporting this issue! To be able to understand the issue better, when having the BSOD. Can you look to see if you have any error messages in the VBox logs? Anything that could hint what the underlaying issue could be would be very valuable.

DavidBerdik commented 3 years ago

You're welcome! I've attached a copy of the logs that get generated by VirtualBox when I attempt to run the VM.

Unfortunately, this tool is not sufficient for evading detection (the software I'm trying to use still detects that it's a virtual machine), so I've had to give up on using it, but I'd still be happy to help with the debugging process.

VBox.log VBoxHardening.log

Programmerino commented 3 years ago

By the way, this is error doesn't happen when you unset the CustomTable parameter

funte commented 1 year ago

@DavidBerdik Thank you reporting, this tool missing clear the hypervisor bit in cpuid.1.ecx, and the command VBoxManage modifyvm -- cpuidset \ \ \ \ \ not work anymore(in my virtualbox7.0+win11host)😟Do you have better solutation?

DavidBerdik commented 1 year ago

@funte You're welcome! I haven't done any further digging on this issue, so unfortunately, I do not have a solution.

Scrut1ny commented 4 months ago

I'd use one of the ones available "%ProgramFiles%\Oracle\VirtualBox\VBoxManage.exe" list cpu-profiles.

$VBoxManager modifyvm $VM --cpu-profile "AMD Ryzen 7 1800X Eight-Core"