sandboxed is now available on PyPi as a pip installation.
pip3 install sandboxed
Certainty will be expressed with a value between 0 and 1, whereas closer to 0 is a real machine and closer to 1 a virtual machine.
from sandboxed import is_sandboxed
certainty = is_sandboxed()
certainty = is_sandboxed(logging=False)
print(f"Chance of being inside a virtual machine is {certainty*100}%.")
>>> Chance of being inside a virtual machine is 95%.
Sandboxed will look at 3 aspects to determine whether it's being run inside a virtual machine. As can be found below:
Since VM (=virtual machines) tend to run upon real operating systems, VM's most of the time have rather bad specs. Things that are taken into considerations:
- Hard Drive Storage Amount
- RAM Storage Amount
- CPU (logical) Cores Amount
- Serial Number of the PC
- Model of the PC
- Manufacturer of the PC
Some files directly point to VM that don't exist on real PCs and some files exsist on real PCs that don't exist on the VM. Things that are being looked for:
- Registry Keys
- Active Processes
- Specific Files
- Amount of Previous WIFI Connections
- Amount of Files on PC
- Amount of Previous Logins on PC
When Malware Reverse Engineering the VMs access to internet is most of the time limited or even blocked off completetly to avoid letting the malware back out in the open. Few basic internet checks are:
- Basic Ping
- Downloading a File
- HTTP Post Request
- DNS Socket Request
Feel free to make a pull request and contribute to this project.
If you feel like buying me a drink: