Mastodawn

Oct 16, 2024

I'm trying to make my #QEMU #VM resilient against software that tries to detect it's running inside of a VM. Seems like I have to do a lot to make this work. Like changing QEMU and #OVMF #source #code. Currently I'm trying to remove the detectable overhead of executing the instructions RDTSC -> CPUID -> RDTSC in sequence. Which results in a much longer delay within VMs.

Show thread

Enitin

This turned into me writing a program that tries to detects if it's running inside of a #VM. So I can then try to make the VM less detectable. And because I was using the #RDTSC and #CPUID instructions I continued developing my CPUID program that I've never finished.
https://git.enitin.xyz/enitin/cpuid
A classic rabbit hole.
"I want to do this. But that means I have to do that. Which means I can continue that other thing I've started doing some time ago."

Enitin / CPUID · GitLab

Reads CPU infos from CPU registers.

GitLab