search

zhaodice / qemu-anti-detection

A patch to hide qemu itself, bypass mhyprot,EAC,nProtect / VMProtect,VProtect, Themida, Enigma Protector,Safegine Shielden
804 stars 117 forks source link

Guide #4

Closed Cjaker closed 1 year ago

Cjaker commented 1 year ago

Hi, I compiled qemu + patches from this repository and got lost on creating a new virtual machine. Is there some good guide that i can refer for start my learning on creating windows 10 virtual machine and apply the concepts of this repository?

Thanks.

zhaodice commented 1 year ago

Google is your friend

Cjaker commented 1 year ago

Got it working, thanks for this repo.

Cjaker commented 1 year ago

Before I was using only QXL without GPU, for weak games that use advanced VM detections and work greats, but now I'm attempting to use VirtIO on network interface, SATA disk and single GPU passthrough.

Probably because the hardware informations are spoofed and win10 setup can't detect them? Can you give me some hints about what I can do in my next steps?

Thanks again.

Cjaker commented 1 year ago

After all day made it work with single gpu passthrough, if someone have trouble i will try to help.

zhaodice commented 1 year ago

After all day made it work with single gpu passthrough, if someone have trouble i will try to help.

Nononono...you cannot use "VirtIO", because it will be a feature that can be detected by others software!

zhaodice commented 1 year ago

if you want to use VirtIO, you can edit my patch... because I edited VirtIO's device id , the device cannot be detected...

But , a VirtIO can be detected means your win10 could be detected as a Virtual Machine!

zhaodice commented 1 year ago

Lastly, if you have installed the VirtIO, I recommend that you uninstall it, or make a new win10 system to clear all of VirtIO Driver's trace

PS: not only VirtIO,but also qemu-tools/Agent/VMware tools/VirtualBox tools ... are not welcomed. keep away from any software/driver that can only use by Virtual Machine , it will tell detection " I am a virtual machine!"

Cjaker commented 1 year ago

Sorry for late response, I forgot to say that I had ended by making the VM without VirtIO and works fine with my preferred games and thanks again for your effort, learned a lot with this repository and kernel sources.

Just needed to do a extra patch on RDTSC and everything works fine.

zhaodice commented 1 year ago

Sorry for late response, I forgot to say that I had ended by making the VM without VirtIO and works fine with my preferred games and thanks again for your effort, learned a lot with this repository and kernel sources.

Just needed to do a extra patch on RDTSC and everything works fine.

Congratulation! if you have any another patch to enhance qemu-hide(more anti detection patch), welcome to make a pull request... because there are some flaw to solve, some detection still could detect it ,example: STR/LDT/TSS...

zhaodice commented 1 year ago

you can use https://github.com/LordNoteworthy/al-khaser to check full of virtual environment . the less item detected,the more true virtual machine will be.

Cjaker commented 1 year ago

I'm using pafish and Al-khaser, on my free time I will try to patch left detections.

Additional resources: https://secret.club/2020/04/13/how-anti-cheats-detect-system-emulation.html https://evasions.checkpoint.com/