https://archworks.co/tags/anti-cheat/enSun, 06 Sep 2026 00:00:00 +0200https://archworks.co/posts/bypassing-vm-detection/Sun, 06 Sep 2026 00:00:00 +0200https://archworks.co/posts/bypassing-vm-detection/Some software checks whether it is running in a virtual machine and changes what it does when it is - malware goes quiet, anti-cheat refuses to start. This is the week I spent making a KVM guest answer no, down to one detection out of 85. The hiding cost no measurable performance, and the thing that ate the most time was not a detection at all. It was a clock.https://archworks.co/docs/vfio-native/Sat, 05 Sep 2026 00:00:00 +0000https://archworks.co/docs/vfio-native/The full writeup: getting a KVM guest from 10/85 to 1/85 on VMAware - the packaged short path, domain XML, QEMU and KVM patches grouped by the detection each one clears, the host headroom that costs 85x on every timing call when you get it wrong, and how to measure both the score and the speed.