This repository is a mirror of a0rtega/pafish. All credit for Pafish belongs to Alberto Ortega and the upstream contributors. I mirror it here for quick access. Please star and report issues on the upstream repository.
Pafish is a testing tool that uses the same techniques malware families use to detect virtual machines and malware analysis environments: VirtualBox, VMware, QEMU, Bochs, Wine, Sandboxie, Cuckoo, debugger presence, slow-timing checks, and more. The goal is defensive: analysts can verify their analysis environments are properly implemented, and researchers can study anti-analysis techniques with all of the code published openly.
Executables for Windows (x86 32-bit and 64-bit) can be downloaded from the upstream releases page.
The project collects techniques commonly observed in malware samples to evade analysis systems. It is free and open source, and educational by design.
Pafish is written in C and can be built with Mingw-w64 and make. The wiki page "How to build" contains detailed instructions; Makefile.win, Makefile64.linux, and Makefile.linux in this mirror cover both targets.
Alberto Ortega (a0rtega) and many awesome contributors.