Bypassing VM detection
Some software checks whether it is running in a virtual machine and changes what it does when it is - malware goes quiet, anti-cheat refuses to start. This is the week I spent making a KVM guest answer no, down to one …
Some software checks whether it is running in a virtual machine and changes what it does when it is - malware goes quiet, anti-cheat refuses to start. This is the week I spent making a KVM guest answer no, down to one …
The full writeup: getting a KVM guest from 10/85 to 1/85 on VMAware - the packaged short path, domain XML, QEMU and KVM patches grouped by the detection each one clears, the host headroom that costs 85x on every timing …