Anti-VM Detection Module

A sophisticated Node.js module for detecting virtual machines and analysis/debugging environments.

Created by HexaSlash - Advanced Anti-VM Detection System

Features

• Hardware Virtualization Detection: Detects VMware, VirtualBox, Hyper-V, KVM, Xen
• System Processes Analysis: Identifies VM characteristic processes
• Anti-Debugging: Detects debuggers and analysis tools
• Timing Attacks: Detects emulated environments through performance analysis
• Sandboxing Detection: Identifies automated testing environments
• Cross-Platform Support: Windows, Linux, macOS compatibility

Installation

npm install anti-vm-detection

Usage

const AntiVM = require('anti-vm-detection');

/* Created by HexaSlash
 * @param {Object} options - Configuration options
 * @param {boolean} options.fastMode - Enable fast mode (recommended)
 * @param {number} options.timeout - Timeout in milliseconds
 * @param {number} options.threshold - Detection confidence threshold
 */

// Fast mode (recommended for most cases)
const detector = new AntiVM({
  fastMode: true,        // Fast mode enabled
  timeout: 2000,         // Reduced timeout
  threshold: 0.7
});

// Full mode (slower but more accurate)
const detectorFull = new AntiVM({
  fastMode: false,       // Full mode
  timeout: 5000,         // Longer timeout
  threshold: 0.7
});

// Complete detection
const result = await detector.detect();
console.log('VM Detected:', result.isVM);
console.log('Confidence:', result.confidence);
console.log('Details:', result.details);

// Individual checks
const hardwareCheck = await detector.checkHardware();
const processCheck = await detector.checkProcesses();
const debugCheck = await detector.checkDebugging();
const timingCheck = await detector.checkTiming();

console.log('Hardware:', hardwareCheck);
console.log('Processes:', processCheck);
console.log('Debugging:', debugCheck);
console.log('Timing:', timingCheck);

API

new AntiVM(options)

Creates a new detector instance.

Options:

• threshold: Confidence threshold for positive detection (default: 0.7)
• timeout: Timeout for checks in ms (default: 2000)
• enableTimingAttacks: Enable timing attacks (default: true)
• fastMode: Fast mode that reduces expensive checks (default: false)

detect()

Performs complete detection and returns an object with:

• isVM: Boolean indicating if VM is detected
• confidence: Confidence level (0-1)
• details: Object detailing each check
• detectedEnvironments: List of detected environments

Individual Methods

• checkHardware(): Checks hardware virtualization
• checkProcesses(): Analyzes system processes
• checkDebugging(): Detects debuggers
• checkTiming(): Performs timing attacks
• checkSandbox(): Detects sandboxing

Example Output

{
  isVM: true,
  confidence: 0.95,
  details: {
    hardware: { detected: true, type: 'VMware', confidence: 0.9 },
    processes: { detected: true, suspicious: ['vmtoolsd.exe', 'VBoxService.exe'] },
    debugging: { detected: false, confidence: 0.1 },
    timing: { detected: true, confidence: 0.8 },
    sandbox: { detected: true, indicators: ['short_uptime', 'limited_resources'] }
  },
  detectedEnvironments: ['VMware', 'Sandbox']
}

License

MIT

Warning

This module is intended for educational and legitimate security purposes only. Using it to bypass security measures or create malware is illegal and not recommended.

Created by HexaSlash - Advanced Anti-VM Detection System GitHub: https://github.com/hexaslash NPM: https://npmjs.com/package/anti-vm-detection