Qemu-anti-detection patch ubuntu 24.04.3

, ,
1

qemu-anti-detection patch ??

2

You are referring to GitHub - zhaodice/qemu-anti-detection: A patch to hide qemu itself, bypass mhyprot,EAC,nProtect / VMProtect,VProtect, Themida, Enigma Protector,Safegine Shielden which is a patch to Qemu that makes it more difficult for software running in a VM, to figure out that they are indeed running in a VM.

Incus includes a version of Qemu. Thus, your question is, can I use my own (patched) version of Qemu?

1 Like
3

Those patches are pretty old, older than any of the QEMU versions we currently use.

1 Like
4

Looking at the patch, it’s mostly changes in the strings. The QEMUstring is replaced with a brand. It should be doable to recreate the patch for a recent version of Qemu.

@@ -1152,7 +1152,7 @@ static int n8x0_atag_setup(void *p, int model)
 
     stw_p(w++, OMAP_TAG_LCD);			/* u16 tag */
     stw_p(w++, 36);				/* u16 len */
-    strcpy((void *) w, "QEMU LCD panel");	/* char panel_name[16] */
+    strcpy((void *) w, "ASUS LCD panel");	/* char panel_name[16] */
     w += 8;
     strcpy((void *) w, "blizzard");		/* char ctrl_name[16] */
     w += 8;
@@ -1272,11 +1272,11 @@ static int n8x0_atag_setup(void *p, int model)
     stw_p(w++, 24);				/* u16 len */
     strcpy((void *) w, "hw-build");		/* char component[12] */
     w += 6;

Therefore, this would require to recompile Qemu with the code changes, then install on the system. Then, it would be easier to compile Incus from source because by doing so, it will use the Qemu installation of the host, whichever that is. Incus from the repository comes with a version of Qemu and it would be a bit messy to replace the included Qemu.

When you run the Incus that you just compiled, it will show in the debug messages whether it found the Qemu binary or not.

$ sudo -E PATH=${PATH}:/sbin LD_LIBRARY_PATH=${LD_LIBRARY_PATH} $(go env GOPATH)/bin/incusd --group sudo --debug
...
INFO   [2025-09-16T07:07:46Z] Instance type operational                     driver=lxc type=container
WARNING[2025-09-16T07:07:46Z] Instance type not operational                 driver=qemu err="QEMU command not available: exec: \"qemu-system-x86_64\": executable file not found in $PATH" type=virtual-machine
...
1 Like