File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -15,12 +15,6 @@ $ go get github.com/ShellCode33/VM-Detection/vmdetect
1515
1616Then see [ main.go] ( https://github.com/ShellCode33/VM-Detection/blob/master/main.go ) to use it in your own project.
1717
18- To build the paper, be sure to have Docker installed and run the following command inside the paper directory:
19-
20- ``` bash
21- $ docker run --rm -it -v " $( pwd) :/pandoc" dalibo/pandocker --pdf-engine=xelatex --template=eisvogel --listings --highlight-style espresso * .md -o paper.pdf
22- ```
23-
2418## GNU/Linux techniques
2519
2620- Look for CPU vendor by trying out different assembly instructions ([ cpuid] ( https://github.com/klauspost/cpuid/ ) )
Original file line number Diff line number Diff line change 3737Finally, low resources may be an indication that the operating system is
3838running inside a sandbox or virtual machine. It surely cannot be used as the
3939only clue but it can lead you to investigate: most sandboxes are ran on the
40- laptop of the analyst, who often will give the fewest resources they can. That
41- is why we look for resources below 3 vCPUs or 3 GB of RAM.
40+ laptop of the analyst, who often will give the fewest resources they can. This
41+ is why we consider machines with low resources (below 3GB of RAM and 3 CPUs) to
42+ be virtual machines.
Original file line number Diff line number Diff line change 1313- https://daks2k3a4ib2z.cloudfront.net/5757fcb8825e8dbc6c852e3c/59ad6c357ba794000108098c_Minerva_Introduction_to_Evasive_Techniques.pdf
1414- https://en.wikipedia.org/wiki/Desktop_Management_Interface
1515- https://github.com/torvalds/linux/blob/31cc088a4f5d83481c6f5041bd6eb06115b974af/arch/x86/kernel/cpu/hypervisor.c
16- - https://www.ibm.com/support/knowledgecenter/en/linuxonibm/com.ibm.linux.z.lhdd/lhdd_t_sysinfo.html
16+ - https://www.ibm.com/support/knowledgecenter/en/linuxonibm/com.ibm.linux.z.lhdd/lhdd_t_sysinfo.html
17+ - https://fr.wikipedia.org/wiki/Contr%C3%B4le_d%27acc%C3%A8s_au_support
18+ - https://lwn.net/Articles/301888/
19+ - https://evasions.checkpoint.com
20+
Original file line number Diff line number Diff line change 1+ # Paper
2+
3+ To build the paper, be sure to have Docker installed and run the following
4+ command inside the paper directory:
5+
6+ ``` bash
7+ $ docker run --rm -it -v " $( pwd) :/pandoc" dalibo/pandocker --pdf-engine=xelatex --template=eisvogel --listings --highlight-style espresso * .md -o paper.pdf
8+ ```
You can’t perform that action at this time.
0 commit comments