zhaodice / qemu-anti-detection

A patch to hide qemu itself, bypass mhyprot,EAC,nProtect / VMProtect,VProtect, Themida, Enigma Protector,Safegine Shielden
791 stars 117 forks source link

[FEATURE] Changing serial numbers on every patched QEMU installation #9

Open Samuil1337 opened 1 year ago

Samuil1337 commented 1 year ago

Hi there,

First I want to thank you for creating this repository, because this helps setting up gaming VMs a ton. Now, to get back to my issue, the serial numbers and IDs in your patch are set statically, meaning that if some goofball uses this project to cheat, all the other users will get "hardware banned" as well. A script that creates these fields on every install would fix this, but I am already working on a port of the patch on QEMU 7.2, so I don't have the time to add this feature.

Best regards, Samuil

zhaodice commented 1 year ago

ok, I will add a script to generate random id to alter patch file

zxcvqwerasdf commented 1 year ago

Can you describe id's/serials and where i can find them?

zxcvqwerasdf commented 11 months ago

Any updates?

zhaodice commented 11 months ago

Any updates?

actually, you can edit any string "xxxx" from patch file

Samuil1337 commented 11 months ago

Alright, so I tried find and replace on "XXXX" in the patch file, but it couldn't find any occurrences of that string. Could you please specify which strings exactly I should be looking out for?

zhaodice commented 11 months ago

Alright, so I tried find and replace on "XXXX" in the patch file, but it couldn't find any occurrences of that string. Could you please specify which strings exactly I should be looking out for?

it just example : [STR_SERIALNUMBER] = "144514"

Scrut1ny commented 8 months ago

Done. Enjoy.

#!/bin/bash

DIRECTORY="$HOME/Downloads/qemu/hw/usb"

find "$DIRECTORY" -type f -exec grep -l '\[STR_SERIALNUMBER\]' {} + | while IFS= read -r file; do
    NEW_SERIAL=$(tr -dc 'A-Z0-9' </dev/urandom | head -c 10)
    sed -i "s/\(\[STR_SERIALNUMBER\] *= *\"\)[^\"]*/\1$NEW_SERIAL/" "$file"
    echo -e "\e[32m + Modified:\e[0m '$file' with new serial: \e[32m$NEW_SERIAL\e[0m"
done

Run this command to verify results:

grep -Rn '\[STR_SERIALNUMBER\]'
Scrut1ny commented 8 months ago

@zhaodice Hey, what modification did you apply in the patch file to bypass Characteristics Bit4 of DMI SMBIOS [BIOS Information] (Type 0) section?

Theres a string called SMBIOS table describes a virtual machine - 0 (No). What part of the patch fixes this and tricks the SMBIOS into thinking it's a real machine?

image

zhaodice commented 8 months ago

@zhaodice Hey, what modification did you apply in the patch file to bypass Characteristics Bit4 of DMI SMBIOS [BIOS Information] (Type 0) section?

Theres a string called SMBIOS table describes a virtual machine - 0 (No). What part of the patch fixes this and tricks the SMBIOS into thinking it's a real machine?

image

I guess: https://github.com/zhaodice/qemu-anti-detection/blob/e3a72a84bf41edd4e0a067ba00faa6b256b1c6f9/qemu-8.2.0.patch#L728

Scrut1ny commented 8 months ago

@zhaodice Thank you, I don't know how you figured that out. Did you find it off of someone else or... I'm just curious.

image

zhaodice commented 8 months ago

Thank you, I don't know how you figured that out. Did you find it off of someone else or... I'm just curious.

This is contributed by https://github.com/zhaodice/qemu-anti-detection/commit/0cdd184176778511fba82bf6eee6f7d100b63c4f

Scrut1ny commented 8 months ago

"Spoofed SMBios VM bit" Well he knew what he was trying to accomplish. Thank you so much @Samuil1337!