5

I am looking for a hypervisor that can be "hidden" from the guest OS such that they believe that they are running on real hardware, instead of being virtualized.

Microsoft-VM's report the motherboard as made by "Microsoft Corporation" - and since they don't actually make motherboards, this is a giveaway

VMware forces the NIC MAC address to fit the following format: "00:50:56:XX:YY:ZZ" which is detectable.

Is there any hypervisor that has no such flaws, or can be configured to hide them from the guest OS?

I realize that any hyper-visor is subject to a timing attack, however I would like something that does better than provide "plug-in-hooks" for compatibility - as for the purpose, I am looking to dissect a virus in a "safe" environment, but notice that it isn't acting as expected in a virtualized environment.

Improve this question
5
  • Have you considered using Xen, which is open source and therefore you can modify any detail you like?
    – Greg Hewgill
    Aug 12 '14 at 22:14
  • @GregHewgill - not sure I know where to look through the code for "giveaways" (there are quite a few), but I suppose I could try if there aren't any other alternatives that are pre-configured for such a task
    – user2813274
    Aug 13 '14 at 2:00
  • I'm not sure that what you want is really possible - even if it doesn't have something as obvious as the device names, almost every hypervisor is going to end up having various 'tells' that are a result of it's implementation.
    – Michael Kohne
    Aug 13 '14 at 12:34
  • 1
    @MichaelKohne - I agree, however whoever made the virus is also unlikely to check for every single "tell" in every single hypervisor, and I am somewhat surprised that there doesn't seem to be any that exists already for this purpose, or a configurable setting.
    – user2813274
    Aug 13 '14 at 15:02
  • I would hazard a guess that this has been solved before, but people who did solve it saw no reason to publish their changes.
    – Ekevoo
    Aug 14 '14 at 0:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.