zhaodice / qemu-anti-detection

A patch to hide qemu itself, bypass mhyprot,EAC,nProtect / VMProtect,VProtect, Themida, Enigma Protector,Safegine Shielden
746 stars 113 forks source link

Better Roblox Support #69

Closed Stefanuk12 closed 5 months ago

Stefanuk12 commented 5 months ago

Introduction

As outlined in this, Roblox checks 4 main things:

To get the values for the first 2, run the following commands:

wmic path win32_computersystemproduct get UUID
wmic memorychip get devicelocator, serialnumber

Monitor EDID can be found in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\DISPLAY

My request

Adding support to spoof monitor EDID and memory chip serial (if not possible with libvirt XML) already would be great!

Side note

Roblox uses these fields for HWID, not exactly VM detection, but it would be nice to be able to spoof HWID - just in case.

zhaodice commented 5 months ago

1.System UUID (SMBIOS UUID) SIMBIOS has been edited(?) 2.Memory Devices wmic memorychip get devicelocator, serialnumber can do spofing by xml config, 3. Monitor EDID...I think if you want to play a game, you may need passthough GPU, so monitor is your physical screen...

Stefanuk12 commented 5 months ago

Thank your for your reply.

  1. I'm unsure how to do this - specifically setting the serial number. I looked at the libvirt docs and found this but I don't see any reference to serial number, unless it's to do with the UUID. I would greatly appreciate an example.
  2. I am using GPU pass through and have my monitor plugged into my GPU that way. Is there a way to patch qemu or via XML to change the serial number. I looked at my EDID and it was my actual one. I was looking at the QEMU source, and the patch and found references to EDID but I'm very unfamiliar with the code and was hoping you could help out.

Edit: I believe I found the solution to 2 within a fork

Edit 2: Since GPU reports EDID, and we have passed through the GPU, we cannot change it on the host. It has to be done in the guest. To do that, look at these docs.

Samuil1337 commented 5 months ago

Hey, that's me. This patch spoofs the names and serials of the virtual devices created by QEMU, so you can't really change what the physical GPU reports. However, you could use a tool on the guest that edits the data in the registry (or not get hardware banned in the first place -.-). Hope that helps!

uragan1987 commented 5 months ago

Thank your for your reply.

2. I'm unsure how to do this - specifically setting the serial number. I looked at the libvirt docs and found [this](https://www.libvirt.org/formatdomain.html#memory-devices) but I don't see any reference to serial number, unless it's to do with the UUID. I would greatly appreciate an example.

3. I am using GPU pass through and have my monitor plugged into my GPU that way. Is there a way to patch qemu or via XML to change the serial number. I looked at my EDID and it was my actual one. I was looking at the QEMU source, and the patch and found references to EDID but I'm very unfamiliar with the code and was hoping you could help out.

Edit: I believe I found the solution to 2 within a fork

did got success with """" ??

i have older qemu version, i use q35-7.0, looks like not supported on my version

Stefanuk12 commented 5 months ago

@uragan1987 You might also have to update your schema to use the QEMU schema. I believe the first line of the XML in the fork shows that