Implement more anti-anti-vm features

[ctxis]

Implement more anti-anti-vm features

[kevoreilly]

Hi bart, thanks for this suggestion. As it happens I just discussed this in a thread on spender-sanbox: spender-sandbox/cuckoo-modified#459 which concludes with a way to clear the 'hypervisor' bit in VMware systems to pass a test in Pafish. I will look at implementing this and other possible fixes to try and get past these tests.

Cheers!

[redsand]

I feel the role of this is at the virtualization layer and the process of deploying your test machines.

I have an attached script I've written (based upon @doomedraven script for debian) that will work on centos 7.

kvm-qemu-antivm-patch.sh.txt

[doomedraven]

@redsand i have published how to install latest qemu/kvm with libvirt etc and not break nothing, https://gist.github.com/doomedraven/41af84c8cf93ba63cea933a80e898fb6
works much faster than previos versions, and allows to have all fixes :)
waiting for qemu 3 :)

[kevoreilly]

This issue I think has been addressed by @doomedraven in the fantastic KVM install script at https://github.com/doomedraven/Tools/blob/master/Virtualization/kvm-qemu.sh. If anyone is having issues with VM detection, the advised hypervisor to minimise this is KVM using this script.

[bartblaze]

May be of help as well, ran Al-Khaser a few days back, see analysis task #2675

Cheers!

[doomedraven]

Hey cool stuff, can i use it in my blog with thanks to you?

[redsand]

Sounds fine to me! Just mention Tim Shelton (redsand) @ HAWK (hawk.io)

…

On Jun 25, 2018, at 11:40 AM, doomedraven ***@***.***> wrote: Hey cool stuff, can i use it in my blog with thanks to you? — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[doomedraven]

Cool, thanks, nice to meet you too, Im from UA

[doomedraven]

FYI tested on ubuntu 16 and 18, works just fine

[redsand]

Awesome! Thanks for the mention! Tim

…

Sent from my iPhone

On Aug 3, 2018, at 10:01 AM, doomedraven ***@***.***> wrote: FYI tested on ubuntu 16 and 18, works just fine — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[doomedraven]

you are welcome :)

[doomedraven]

@redsand a question, did you fix force vm to exit?

[redsand]

Can you link me for details? I patched a bunch of stuff and tried many more things. Lol

…

On Wed, Sep 19, 2018, 8:21 AM doomedraven ***@***.***> wrote: @redsand <https://github.com/redsand> a question, did you fix force vm to exit? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#5 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAhV8w-rc0k-cqAMI26iZXM_XDIRM5NCks5uckTmgaJpZM4NwfAK> .

[doomedraven]

in that your .txt attachmed is like this, but that just a comment

 void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
 {
+    // env->tsc_offset -= 1000;
 }

 void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code, uint64_t exit_info_1)
EOF

in qemu3

void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code, uint64_t exit_info_1,
                uintptr_t retaddr)
{
    assert(0);
}

[redsand]

This was me toying with the feature to beat the other rdtsc check in pafish. So far no luck. My research shows it wants a greater value returned than being received. Tim

…

Sent from my iPhone On Sep 19, 2018, at 8:46 AM, doomedraven <[email protected]> wrote: in that your .txt attachmed is like this, but that just a comment void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1) { + // env->tsc_offset -= 1000; } void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code, uint64_t exit_info_1) EOF in qemu3 void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code, uint64_t exit_info_1, uintptr_t retaddr) { assert(0); } — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[doomedraven]

ok thanks