3 ms·
While changing the reported device names can just make the VM a little less obvious, I suspect there will always be clues that indicate a VM. For example: - D
by mmwelt 6y ago
While changing the reported device names can just make the VM a little less obvious, I suspect there will always be clues that indicate a VM. For example:
- Do network adapter MAC vendor ID's make sense?
- Does the hard drive size make sense?
- Which 3D acceleration features are supported/work correctly?
- How much graphics RAM is there?
- Timing-based methods
It's a bit like detecting private/incognito mode in a browser. Everything worked great, until websites realised there are ways to detect it, then became a game of cat and mouse.
- gruez 6y ago>- Do network adapter MAC vendor ID's make sense? >- Does the hard drive size make sense? not detectable through browser APIs >- Which 3D acceleration features are supported/work correctly? vmware workstation has 3d acceleration support targeting directx 11, so I'd imagine most features are supported and are passed through to the host gpu for execution. I doubt you'll able to detect is a vm or not based on that. In addition, resistfingerprinting (on firefox) hides this kind of stuff. >- How much graphics RAM is there? vmware workstation has vram selectable from 32MB all the way to 8GB, so that covers the entire range of plausible vram sizes. >- Timing-based methods what else can you test that is both accessible via browser api and would yield big differences between a vm and a slow computer? >It's a bit like detecting private/incognito mode in a browser. Everything worked great, until websites realised there are ways to detect it, then became a game of cat and mouse. not really, it's a solved problem: make a new browser profile and then delete it after you're done. I've seen a few HN commenters post their (relatively short) scripts to make a new firefox/chromium, start it, and then automatically delete it once it exits.