Neura Market
hfiref0x/VBoxHardenedLoader logo

hfiref0x/VBoxHardenedLoader

Free

VirtualBox VM detection mitigation loader

FreeFree tier
Type
Open Source
Visit Website GitHub (38 stars)

About hfiref0x/VBoxHardenedLoader

VBoxHardenedLoader is an open-source tool designed to mitigate VirtualBox VM detection by patching VirtualBox DLLs at runtime. It consists of a monitoring driver (Tsugumi) and a loader application (Zekamashi) that work together to bypass hypervisor detection mechanisms. The project is no longer maintained (archived April 2023) and is compatible with x64 versions of Windows 7 through 10 and VirtualBox 6.1.6 and later. It requires administrative privileges and full source code is provided for building with Visual Studio 2019 and Windows Driver Kit.

Key Features

Runtime patching of VirtualBox DLLs to bypass VM detection
Includes Tsugumi monitoring driver (x64) and Zekamashi loader application
Open source with full C/C++ source code available
Supports VirtualBox 6.1.6 and later (with version-specific loader releases for older versions)
Built with Microsoft Visual Studio 2019 and Windows Driver Kit 8.1/10
Provides command-line help with supported commands and syntax
Loader version 2 introduced key changes (detailed in linked blog post)

Pros & Cons

Pros
  • Freely available open-source code allows for auditing and customization
  • Runtime patching approach does not require modification of VirtualBox installation files
  • Includes both driver and application components for comprehensive detection bypass
  • Provides version-specific loader releases for compatibility with multiple VirtualBox versions
Cons
  • Project is no longer maintained and has been archived since April 2023
  • Windows only (x64) – no Linux or macOS support
  • Requires administrative privileges to install and run the driver
  • Incompatible with VirtualBox versions below 6.1.2
  • Relies on Intel Nal driver which is blocked in some Windows 11 updates (workaround needed)
  • ACPI tables, offsets, and EFI VGA module patch have not been updated since mid 2020

Best For

Bypassing VirtualBox VM detection for malware analysis or reverse engineeringTesting and research involving virtualized environments that detect hypervisorsRunning software inside VirtualBox that otherwise refuses to execute in a VM