nsmfoo / antivmdetection

Script to create templates to use with VirtualBox to make vm detection harder
MIT License
703 stars 123 forks source link

No longer what it claims #67

Open LukasJerabek opened 6 months ago

LukasJerabek commented 6 months ago

Pafish got upgraded since and this fails many more tests than in the README.

image image

Scrut1ny commented 4 months ago
  1. The generic reverse turning tests are on you, they're stupid anyway.
  2. Theres already been a solution for fixing the RDTSC check, but for the Force VM exit though you must patch the host kernal, and it'll have to be on Linux because Windows is proprietary.
    # RDTSC (Read Time-Stamp Counter)
    $VBoxManager setextradata $VM "VBoxInternal/TM/TSCMode" "RealTSCOffset"
    $VBoxManager setextradata $VM "VBoxInternal/CPUM/SSE4.1" "1"
    $VBoxManager setextradata $VM "VBoxInternal/CPUM/SSE4.2" "1"
  3. The check up time GetTickCount() is also kinda stupid, all you have to do is leave the hypervisor runnning for 12+ minutes
  4. The vbox detections do need to get updated, they're very easy fixes though.

SCSI Identifier Spoof

function Get-UpperRandomString {
    $Identifier = -join (1..20 | ForEach {[char]((65..90) + (48..57) | Get-Random)})
    return $Identifier
}

# Physical Drives (SATA/NVMe)
foreach ($PortNumber in 0..9) {
    foreach ($BusNumber in 0..9) {
        foreach ($LogicalUnitIdNumber in 0..9) {
            $registryPath = "HKLM:\HARDWARE\DEVICEMAP\Scsi\Scsi Port $PortNumber\Scsi Bus $BusNumber\Target Id 0\Logical Unit Id $LogicalUnitIdNumber"

            if (Test-Path -Path $registryPath) {
                $NewString = Get-UpperRandomString
                Set-ItemProperty -Path "$registryPath" -Name 'Identifier' -Type String -Value "NVMe    Samsung SSD 980 FXO7" -Force
                Set-ItemProperty -Path "$registryPath" -Name 'SerialNumber' -Type String -Value "$NewString" -Force
            }
        }
    }
}

MAC Address Spoof

$VBoxManager modifyvm $VM --nic1 "bridged" --mac-address1 "428D5C257A8B"