Why not release builds / binaries? about antivmdetection HOT 2 CLOSED

Hi @mngyuan , it's a valid question and if people like to send me generated templates files which I can host here, please do. But the main reason is that the .sh, .ps1 and the DSDT dump all contain information, that you would like to be kept unique, so if all clients end up with the same serial number, name etc. It would be much easier for malware to just detect these installations.

I hope that make sense?

/Mikael

from antivmdetection.

that does make sense, but it is sort of frustrating that theoretically this technique is sort of limited to a 1:1 mapping between real machines and vms, because it piggy backs off of real hardware values. I guess as long as they stay out of the hands of malware agents it doesn't really matter how much you reuse your DSDTs, etc though. Anyway I originally asked because I wasn't sure it was worth my time to go through this whole process just for fun but I took the dive. Closing this!

from antivmdetection.