反虚拟化检测虚机(QEMU/virsh)

https://github.com/zhaodice/qemu-anti-detection

apt install libglib2.0-dev libaio-dev liburing-dev
./configure --enable-vnc --enable-linux-aio

<domain type="kvm">
  <name>win10</name>
  <uuid>577ecb18-ed58-4c15-ab27-a7df6cb14b2e</uuid>
  <metadata>
    <libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/xmlns/libvirt/domain/1.0">
      <libosinfo:os id="http://microsoft.com/win/10"/>
    </libosinfo:libosinfo>
  </metadata>
  <memory unit="GiB">12</memory>
  <currentMemory unit="GiB">12</currentMemory>
  <vcpu placement="static">16</vcpu>

  <!-- sysinfo 保持不变 -->
  <sysinfo type="smbios">
    <bios>
      <entry name="vendor">American Megatrends Inc.</entry>
      <entry name="version">5302</entry>
      <entry name="date">10/20/2023</entry>
      <entry name="release">5.17</entry>
    </bios>
    <system>
      <entry name="manufacturer">System manufacturer</entry>
      <entry name="product">System Product Name</entry>
      <entry name="version">System Version</entry>
      <entry name="serial">System Serial Number</entry>
      <entry name="uuid">577ecb18-ed58-4c15-ab27-a7df6cb14b2e</entry>
      <entry name="sku">SKU</entry>
      <entry name="family">To be filled by O.E.M.</entry>
    </system>
    <baseBoard>
      <entry name="manufacturer">ASUSTeK COMPUTER INC.</entry>
      <entry name="product">ROG STRIX B450-F GAMING</entry>
      <entry name="version">1.xx</entry>
      <entry name="serial">212451831070374</entry>
      <entry name="asset">Default string</entry>
      <entry name="location">Default string</entry>
    </baseBoard>
    <chassis>
      <entry name="manufacturer">Default string</entry>
      <entry name="version">Default string</entry>
      <entry name="serial">Default string</entry>
      <entry name="asset">Default string</entry>
      <entry name="sku">Default string</entry>
    </chassis>
    <oemStrings>
      <entry>String 1: Default string</entry>
      <entry>String 2: Default string</entry>
      <entry>String 3: MANASLU</entry>
      <entry>String 4: Default string</entry>
    </oemStrings>
  </sysinfo>

  <os firmware="efi">
    <type arch="x86_64" machine="pc-q35-8.2">hvm</type>
    <firmware>
      <feature enabled="no" name="enrolled-keys"/>
      <feature enabled="no" name="secure-boot"/>
    </firmware>
    <loader readonly="yes" type="pflash">/usr/share/OVMF/OVMF_CODE_4M.fd</loader>
    <nvram>/var/lib/libvirt/qemu/nvram/win10_VARS.fd</nvram>
    <smbios mode="sysinfo"/>
  </os>

  <features>
    <acpi/>
    <apic/>
    <hyperv mode="passthrough">
      <relaxed state="on"/>
      <vapic state="on"/>
      <spinlocks state="on" retries="8191"/>
      <vendor_id state="on" value="AuthenticAMD"/>
    </hyperv>
    <kvm>
      <hidden state="on"/>
    </kvm>
  </features>

  <cpu mode="host-passthrough" check="none" migratable="on">
    <topology sockets="1" dies="1" clusters="1" cores="8" threads="2"/>
    <cache mode="passthrough"/>
    <feature policy="require" name="topoext"/>
    <feature policy="disable" name="hypervisor"/>
  </cpu>

  <clock offset="localtime">
    <timer name="hpet" present="yes"/>
    <timer name="hypervclock" present="yes"/>
  </clock>

  <devices>
    <emulator>/usr/local/bin/qemu-system-x86_64</emulator>

    <!-- 系统磁盘 -->
    <disk type="file" device="disk">
      <driver name="qemu" type="raw" cache="none" io="native" discard="unmap"/>
      <source file="/var/lib/libvirt/images/win10.img"/>
      <target dev="sda" bus="sata"/>
      <serial>590347474223828</serial>
      <boot order="1"/>
      <address type="drive" controller="0" bus="0" target="0" unit="0"/>
    </disk>

    <!-- Windows 安装 ISO -->
    <disk type="file" device="cdrom">
      <driver name="qemu" type="raw"/>
      <source file="/var/lib/libvirt/boot/win10.iso"/>
      <target dev="sdb" bus="sata"/>
      <readonly/>
      <boot order="2"/>
    </disk>

    <interface type="bridge">
      <mac address="f0:bc:8e:cd:6e:ec"/>
      <source bridge="br0"/>
      <model type="e1000e"/>
      <address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/>
    </interface>

    <graphics type="vnc" port="-1" listen="0.0.0.0" autoport="yes">
      <listen type="address" address="0.0.0.0"/>
    </graphics>

  </devices>
</domain>
2025/08/07 posted in  技术分享