antivmdetection icon indicating copy to clipboard operation
antivmdetection copied to clipboard

No longer what it claims

Open LukasJerabek opened this issue 1 year ago • 1 comments

Pafish got upgraded since and this fails many more tests than in the README.

image image

LukasJerabek avatar Dec 11 '23 23:12 LukasJerabek

  1. The generic reverse turning tests are on you, they're stupid anyway.
  2. Theres already been a solution for fixing the RDTSC check, but for the Force VM exit though you must patch the host kernal, and it'll have to be on Linux because Windows is proprietary.
# RDTSC (Read Time-Stamp Counter)
$VBoxManager setextradata $VM "VBoxInternal/TM/TSCMode" "RealTSCOffset"
$VBoxManager setextradata $VM "VBoxInternal/CPUM/SSE4.1" "1"
$VBoxManager setextradata $VM "VBoxInternal/CPUM/SSE4.2" "1"
  1. The check up time GetTickCount() is also kinda stupid, all you have to do is leave the hypervisor runnning for 12+ minutes
  2. The vbox detections do need to get updated, they're very easy fixes though.

SCSI Identifier Spoof

function Get-UpperRandomString {
    $Identifier = -join (1..20 | ForEach {[char]((65..90) + (48..57) | Get-Random)})
    return $Identifier
}

# Physical Drives (SATA/NVMe)
foreach ($PortNumber in 0..9) {
    foreach ($BusNumber in 0..9) {
		foreach ($LogicalUnitIdNumber in 0..9) {
			$registryPath = "HKLM:\HARDWARE\DEVICEMAP\Scsi\Scsi Port $PortNumber\Scsi Bus $BusNumber\Target Id 0\Logical Unit Id $LogicalUnitIdNumber"

			if (Test-Path -Path $registryPath) {
				$NewString = Get-UpperRandomString
				Set-ItemProperty -Path "$registryPath" -Name 'Identifier' -Type String -Value "NVMe    Samsung SSD 980 FXO7" -Force
				Set-ItemProperty -Path "$registryPath" -Name 'SerialNumber' -Type String -Value "$NewString" -Force
			}
		}
    }
}

MAC Address Spoof

$VBoxManager modifyvm $VM --nic1 "bridged" --mac-address1 "428D5C257A8B"

Scrut1ny avatar Feb 24 '24 21:02 Scrut1ny