5 ms·

I wonder how feasible it is to remove such fingerprints - find a way to make the VM be functionally indistinguishable from the host.

• conductor 6y ago
  This is an old problem for reverse engineers, and there are some solutions, for example VBoxHardenedLoader [0]. As per usual with such things, these tools are in cat/mouse category. [0] https://github.com/hfiref0x/VBoxHardenedLoader https://github.com/hfiref0x/VBoxHardenedLoader
  • ColanR 6y ago
    That's interesting - I would have guessed that after a certain point, a VM and a physical computer are indistinguishable from the POV of software running inside.
    • lights0123 6y ago
      It's easy to make the core device indistinguishable. It's the additional hardware that becomes a problem: QEMU/libvirt hardcodes its hard drive model to include the word "QEMU" (although there is an unmerged patch to make that configurable), and although I don't know how graphics work in a VM, it's far easier to create a higher-level graphics device than e.g. emulating Intel graphics.
      • ColanR 6y ago
        I imagine a script could be used with qemu - given that patch you mentioned, which I would love a source for if you have it - to match the names of the virtual devices with names of devices on the physical host. Then there's no way for software to check the device names against a list of VM tools, since it always matches real, physical hardware. At that point, it seems to me that there isn't much left to distinguish the virtual machine from the physical. Behavioral properties of the CPU? Anyway, that's what I meant when I said it seems like after a certain point, it becomes impossible to tell the difference. EDIT: based on the link above, it looks like current state-of-the-art doesn't go far beyond making sure names and common virtualbox performance shortcuts aren't present. https://github.com/hfiref0x/VBoxHardenedLoader/blob/master/Binary/howto.md https://github.com/hfiref0x/VBoxHardenedLoader/blob/master/B...
        • WrtCdEvrydy 6y ago
          This is a classic computer science question of whether the OS should be aware that it's being virtualized.
        • cosmie 6y ago
          One of the other telltale signs of a VM are "things VMs can do that physical devices can't" - such as weird screen resolutions (when running in windowed mode rather than full screen), weird CPU core counts, physical ram values that aren't cleanly divisible into DIMM slots, etc.
          • ColanR 6y ago
            Good point. I guess that would be relatively easy to check for programmatically. What else is there that could possibly indicate virtualization? Available instruction sets? Strange limitations of the given CPU? (e.g., the cpu presents itself as some Intel chip that's known to have 4 cores, but there's only 2 available)
        • lights0123 6y ago
          patch is https://lists.gnu.org/archive/html/qemu-devel/2012-03/msg02132.html https://lists.gnu.org/archive/html/qemu-devel/2012-03/msg021...
          • ColanR 6y ago
            Thanks!
        • userbinator 6y ago
          I know of malware long ago that would attempt to time how long CPU instructions take, based on the theory that a VM would be significantly slower, but more recently, especially with hardware-assisted virtualisation, the differences have become close to indistinguishable.
    • fuyu 6y ago
      The video game anti-cheat world has been playing this cat and mouse game for a while. A few months back I saw an interesting article [0] describing some of the detection methods being used. It's fascinating to think about how much effort gets put into this. [0] https://secret.club/2020/04/13/how-anti-cheats-detect-system-emulation.html https://secret.club/2020/04/13/how-anti-cheats-detect-system...
• noodlesUK 6y ago
  There are certain tools often used for malware testing such as Cuckoo that can help conceal some of the more obvious tells.
• tenebrisalietum 6y ago
  - You run into copyright issues, because unless you duplicate a commercial UEFI (SMBIOS and all that good stuff) within the VM you'll be detected. - You run into performance issues - virtualization's speed depends on paravirtualized drivers, which are readily identifiable (e.g. "virtio" disk controller). These can be emulated instead of paravirtualized but will cost performance. Windows drivers are signed so you can't just change names of things. - Chipsets - some are often emulated by VMs. For example, if you are running a system in 2020 and are using an Intel 440BX chipset, it's probably a VM.
• Kaze404 6y ago
  For what it's worth, I play MMOs with malware anti cheats on a VM all the time with a Pci-pass-through setup. Event he ones that are known for detecting VMs don't seem to detect me under QEMU. Go figure.