3 ms·
If a game anti-cheat system can detect that a regular VM is a VM, then it will also detect Kata VM is a VM. In both cases you're running a game in a VM with a d
by jitl 3y ago
If a game anti-cheat system can detect that a regular VM is a VM, then it will also detect Kata VM is a VM. In both cases you're running a game in a VM with a dedicated kernel.
Kata VMs are especially VM-y because they use a lot of VM-only features that wouldn't work with real hardware to enhance performance by sharing work between the guest and the host.
- xyst 3y agoWell it’s not that it “detects” it but most game AC (Valgrind or BattleEye) install at the ring0 layer (kernel). So on VMs, that doesn’t exist (from what I understand). But with this it should be enough to fool it into thinking it’s installed in the right space.
- amarshall 3y ago> So on VMs, [ring0 layer (the kernel)] doesn’t exist (from what I understand) The kernel still exists in a VM. The “dedicated kernel” bit of Kata distinguishes it from typical containers, not from VMs. Kata is an abstraction atop existing hypervisors that are themselves just an abstraction over KVM. There’s nothing new here w.r.t. VM detection evasion. > fool it into thinking it’s installed in the right space Most VM detection is about observing devices, drivers, timings, or other side-channel type data that is often only seen in a VM.