qemu-anti-detection icon indicating copy to clipboard operation
qemu-anti-detection copied to clipboard

Published 20 hours ago • verified publisher icon zhaodice

[FEATURE] Changing serial numbers on every patched QEMU installation

Open Samuil1337 opened this issue 2 years ago • 12 comments

Hi there,

First I want to thank you for creating this repository, because this helps setting up gaming VMs a ton. Now, to get back to my issue, the serial numbers and IDs in your patch are set statically, meaning that if some goofball uses this project to cheat, all the other users will get "hardware banned" as well. A script that creates these fields on every install would fix this, but I am already working on a port of the patch on QEMU 7.2, so I don't have the time to add this feature.

Best regards, Samuil

Samuil1337 avatar Apr 12 '23 21:04 Samuil1337

ok, I will add a script to generate random id to alter patch file

zhaodice avatar Apr 13 '23 19:04 zhaodice

Can you describe id's/serials and where i can find them?

zxcvqwerasdf avatar Aug 26 '23 16:08 zxcvqwerasdf

Any updates?

zxcvqwerasdf avatar Nov 21 '23 14:11 zxcvqwerasdf

Any updates?

actually, you can edit any string "xxxx" from patch file

zhaodice avatar Nov 22 '23 09:11 zhaodice

Alright, so I tried find and replace on "XXXX" in the patch file, but it couldn't find any occurrences of that string. Could you please specify which strings exactly I should be looking out for?

Samuil1337 avatar Nov 29 '23 18:11 Samuil1337

Alright, so I tried find and replace on "XXXX" in the patch file, but it couldn't find any occurrences of that string. Could you please specify which strings exactly I should be looking out for?

it just example : [STR_SERIALNUMBER] = "144514"

zhaodice avatar Dec 03 '23 05:12 zhaodice

Done. Enjoy.

#!/bin/bash

DIRECTORY="$HOME/Downloads/qemu/hw/usb"

find "$DIRECTORY" -type f -exec grep -l '\[STR_SERIALNUMBER\]' {} + | while IFS= read -r file; do
    NEW_SERIAL=$(tr -dc 'A-Z0-9' </dev/urandom | head -c 10)
    sed -i "s/\(\[STR_SERIALNUMBER\] *= *\"\)[^\"]*/\1$NEW_SERIAL/" "$file"
    echo -e "\e[32m + Modified:\e[0m '$file' with new serial: \e[32m$NEW_SERIAL\e[0m"
done

Run this command to verify results:

grep -Rn '\[STR_SERIALNUMBER\]'

Scrut1ny avatar Mar 06 '24 07:03 Scrut1ny

@zhaodice Hey, what modification did you apply in the patch file to bypass Characteristics Bit4 of DMI SMBIOS [BIOS Information] (Type 0) section?

Theres a string called SMBIOS table describes a virtual machine - 0 (No). What part of the patch fixes this and tricks the SMBIOS into thinking it's a real machine?

image

Scrut1ny avatar Mar 07 '24 03:03 Scrut1ny

@zhaodice Hey, what modification did you apply in the patch file to bypass Characteristics Bit4 of DMI SMBIOS [BIOS Information] (Type 0) section?

Theres a string called SMBIOS table describes a virtual machine - 0 (No). What part of the patch fixes this and tricks the SMBIOS into thinking it's a real machine?

image

I guess: https://github.com/zhaodice/qemu-anti-detection/blob/e3a72a84bf41edd4e0a067ba00faa6b256b1c6f9/qemu-8.2.0.patch#L728

zhaodice avatar Mar 07 '24 05:03 zhaodice

@zhaodice Thank you, I don't know how you figured that out. Did you find it off of someone else or... I'm just curious.

image

Scrut1ny avatar Mar 07 '24 07:03 Scrut1ny

Thank you, I don't know how you figured that out. Did you find it off of someone else or... I'm just curious.

This is contributed by https://github.com/zhaodice/qemu-anti-detection/commit/0cdd184176778511fba82bf6eee6f7d100b63c4f

zhaodice avatar Mar 07 '24 10:03 zhaodice

"Spoofed SMBios VM bit" Well he knew what he was trying to accomplish. Thank you so much @Samuil1337!

Scrut1ny avatar Mar 07 '24 19:03 Scrut1ny