File tree Expand file tree Collapse file tree 4 files changed +16
-9
lines changed Expand file tree Collapse file tree 4 files changed +16
-9
lines changed Original file line number Diff line number Diff line change @@ -15,12 +15,6 @@ $ go get github.com/ShellCode33/VM-Detection/vmdetect
15
15
16
16
Then see [ main.go] ( https://github.com/ShellCode33/VM-Detection/blob/master/main.go ) to use it in your own project.
17
17
18
- To build the paper, be sure to have Docker installed and run the following command inside the paper directory:
19
-
20
- ``` bash
21
- $ docker run --rm -it -v " $( pwd) :/pandoc" dalibo/pandocker --pdf-engine=xelatex --template=eisvogel --listings --highlight-style espresso * .md -o paper.pdf
22
- ```
23
-
24
18
## GNU/Linux techniques
25
19
26
20
- Look for CPU vendor by trying out different assembly instructions ([ cpuid] ( https://github.com/klauspost/cpuid/ ) )
Original file line number Diff line number Diff line change 37
37
Finally, low resources may be an indication that the operating system is
38
38
running inside a sandbox or virtual machine. It surely cannot be used as the
39
39
only clue but it can lead you to investigate: most sandboxes are ran on the
40
- laptop of the analyst, who often will give the fewest resources they can. That
41
- is why we look for resources below 3 vCPUs or 3 GB of RAM.
40
+ laptop of the analyst, who often will give the fewest resources they can. This
41
+ is why we consider machines with low resources (below 3GB of RAM and 3 CPUs) to
42
+ be virtual machines.
Original file line number Diff line number Diff line change 13
13
- https://daks2k3a4ib2z.cloudfront.net/5757fcb8825e8dbc6c852e3c/59ad6c357ba794000108098c_Minerva_Introduction_to_Evasive_Techniques.pdf
14
14
- https://en.wikipedia.org/wiki/Desktop_Management_Interface
15
15
- https://github.com/torvalds/linux/blob/31cc088a4f5d83481c6f5041bd6eb06115b974af/arch/x86/kernel/cpu/hypervisor.c
16
- - https://www.ibm.com/support/knowledgecenter/en/linuxonibm/com.ibm.linux.z.lhdd/lhdd_t_sysinfo.html
16
+ - https://www.ibm.com/support/knowledgecenter/en/linuxonibm/com.ibm.linux.z.lhdd/lhdd_t_sysinfo.html
17
+ - https://fr.wikipedia.org/wiki/Contr%C3%B4le_d%27acc%C3%A8s_au_support
18
+ - https://lwn.net/Articles/301888/
19
+ - https://evasions.checkpoint.com
20
+
Original file line number Diff line number Diff line change
1
+ # Paper
2
+
3
+ To build the paper, be sure to have Docker installed and run the following
4
+ command inside the paper directory:
5
+
6
+ ``` bash
7
+ $ docker run --rm -it -v " $( pwd) :/pandoc" dalibo/pandocker --pdf-engine=xelatex --template=eisvogel --listings --highlight-style espresso * .md -o paper.pdf
8
+ ```
You can’t perform that action at this time.
0 commit comments