go-obfuscation/pkg/antivm/antivm_linux.go

//go:build linux

package antivm

import (
	"net"
	"os"
	"strings"
	"time"
)

var vmIdentifiers = []string{
	"VMware",
	"VirtualBox",
	"QEMU",
	"KVM",
	"Xen",
	"Microsoft Corporation",
	"Parallels",
}

var vmMACPrefixes = []string{
	"00:0c:29",
	"08:00:27",
	"52:54:00",
	"00:1c:42",
}

var vmPCIVendors = []string{
	"15ad",
	"80ee",
	"1234",
}

func readSysfsTrimmed(path string) string {
	data, err := os.ReadFile(path)
	if err != nil {
		return ""
	}
	return strings.TrimSpace(string(data))
}

func containsAny(s string, needles []string) bool {
	for _, n := range needles {
		if strings.Contains(s, n) {
			return true
		}
	}
	return false
}

func checkDMI() bool {
	paths := []string{
		"/sys/class/dmi/id/sys_vendor",
		"/sys/class/dmi/id/product_name",
	}
	for _, p := range paths {
		val := readSysfsTrimmed(p)
		if containsAny(val, vmIdentifiers) {
			return true
		}
	}
	return false
}

func checkMAC() bool {
	ifaces, err := net.Interfaces()
	if err != nil {
		return false
	}
	for _, iface := range ifaces {
		mac := strings.ToLower(iface.HardwareAddr.String())
		if mac == "" {
			continue
		}
		for _, prefix := range vmMACPrefixes {
			if strings.HasPrefix(mac, prefix) {
				return true
			}
		}
	}
	return false
}

func checkCPUID() bool {
	data, err := os.ReadFile("/proc/cpuinfo")
	if err != nil {
		return false
	}
	content := string(data)

	if strings.Contains(content, "hypervisor") {
		return true
	}

	if strings.Contains(content, "QEMU Virtual CPU") {
		return true
	}

	return false
}

func checkDisk() bool {
	entries, err := os.ReadDir("/sys/block")
	if err != nil {
		return false
	}
	for _, entry := range entries {
		modelPath := "/sys/block/" + entry.Name() + "/device/model"
		model := readSysfsTrimmed(modelPath)
		if containsAny(model, vmIdentifiers) {
			return true
		}
	}
	return false
}

func checkPCI() bool {
	entries, err := os.ReadDir("/sys/bus/pci/devices")
	if err != nil {
		return false
	}
	for _, entry := range entries {
		vendorPath := "/sys/bus/pci/devices/" + entry.Name() + "/vendor"
		vendor := readSysfsTrimmed(vendorPath)
		vendorID := strings.TrimPrefix(vendor, "0x")
		for _, v := range vmPCIVendors {
			if vendorID == v {
				return true
			}
		}
	}
	return false
}

func checkTiming() bool {
	start := time.Now()
	sum := 0
	for i := 0; i < 100000; i++ {
		sum += i
	}
	elapsed := time.Since(start)
	_ = sum
	return elapsed > 10*time.Millisecond
}

func checkSystemProfiler() bool {
	return false
}

func checkIOKit() bool {
	return false
}

func checkRegistry() bool {
	return false
}

func checkWMI() bool {
	return false
}