Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add how to patch detections to wiki #68

Open
JordanPlayz158 opened this issue Jan 4, 2021 · 3 comments
Open

Add how to patch detections to wiki #68

JordanPlayz158 opened this issue Jan 4, 2021 · 3 comments

Comments

@JordanPlayz158
Copy link

I know this is probably out of the scope of this application but I think it would be a great edition to explain how to patch the detections on things like qemu/libvirt, on almost stock qemu/libvirt (a few xml modifications) the following detections were found:

  • rdtsc forcing VM exit (https://www.reddit.com/r/VFIO/comments/i071qx/spoof_and_make_your_vm_undetectable_no_more/ This reddit post shows how to fix the rdtsc detection (modifying arch/x86/kvm/vmx/vmx.c))
  • Checking hypervisor bit in cpuid feature bits (i'd assume there is a simple libvirt xml change to fix this)
  • Using mouse activity (not going to lie, I have no clue what that means or how you would fix that)
  • Reg key (HKLM\HARDWARE\Description\System "SystemBiosVersion") (I'd assume this is either a simple windows registry change or a libvirt xml change)
@meisme-dev
Copy link

Yeah that would be awesome. I use KVM and I have no idea how to patch this stuff.

@Pocokk
Copy link

Pocokk commented Mar 27, 2023

Dear @a0rtega

Do you plan to update or continue developing this program of yours in the near future?

Looking forward to hearing from you, thank you and best regards,
Pocok

@a0rtega
Copy link
Owner

a0rtega commented Mar 28, 2023

Do you plan to update or continue developing this program of yours in the near future?

Hey @Pocokk ,

I maintain the project and will release new versions as needed. I'll only add new detections if they are innovative in any way, because there are just too many of them; I also review and accept PRs if they are appropriate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants