pafish
pafish copied to clipboard
Add how to patch detections to wiki
I know this is probably out of the scope of this application but I think it would be a great edition to explain how to patch the detections on things like qemu/libvirt, on almost stock qemu/libvirt (a few xml modifications) the following detections were found:
- rdtsc forcing VM exit (https://www.reddit.com/r/VFIO/comments/i071qx/spoof_and_make_your_vm_undetectable_no_more/ This reddit post shows how to fix the rdtsc detection (modifying arch/x86/kvm/vmx/vmx.c))
- Checking hypervisor bit in cpuid feature bits (i'd assume there is a simple libvirt xml change to fix this)
- Using mouse activity (not going to lie, I have no clue what that means or how you would fix that)
- Reg key (HKLM\HARDWARE\Description\System "SystemBiosVersion") (I'd assume this is either a simple windows registry change or a libvirt xml change)
Yeah that would be awesome. I use KVM and I have no idea how to patch this stuff.
Dear @a0rtega
Do you plan to update or continue developing this program of yours in the near future?
Looking forward to hearing from you, thank you and best regards, Pocok
Do you plan to update or continue developing this program of yours in the near future?
Hey @Pocokk ,
I maintain the project and will release new versions as needed. I'll only add new detections if they are innovative in any way, because there are just too many of them; I also review and accept PRs if they are appropriate.