> leveraging known bugs/mismatches What if a real CPU ends up having a similar bug? The more detection tricks you try, the higher the rate of false positives w

> leveraging known bugs/mismatches What if a real CPU ends up having a similar bug? The more detection tricks you try, the higher the rate of false positives will be. Bochs emulation side-steps most VM detection because it's not a VM. You can't even use the CPUID/VMEXIT timing detection trick because it's all emulated.