Уровень 0 · материалов: 3
В кластер входят документы о технических методах скрытия или изменения параметров виртуальной среды для обхода программных ограничений, но не входят инструкции по скрытию установленного ПО от администраторов ОС.
Общие признаки: эмуляция оборудования, обход механизмов обнаружения виртуализации, манипуляция таблицами ACPI и SMBIOS, гипервизоры QEMU, VMware, Xen
Группа выше: Критика и обход виртуализации
Смысл: The text provides a practical method for hiding a VMware virtual machine from software that employs anti-VM techniques, primarily for the purpose of reverse engineering or malware analysis.
A technical guide on modifying VMware configuration files and Windows registry keys to bypass virtual machine detection mechanisms used by protected software.
Смысл: The main idea is to demonstrate how security researchers can evade malware detection by manipulating SMBIOS tables in hypervisors (Xen and QEMU) to emulate hardware components that malware uses as fingerprints for virtual environments.
The author explains how to spoof a CPU cooler in Xen and QEMU virtual machines by injecting custom SMBIOS Type 27 and 28 records to deceive anti-VM malware.
Смысл: The main idea is to demonstrate that Windows OEM activation mechanisms, which rely on hardware-embedded ACPI tables (SLIC and MSDM), can be replicated in a virtual environment by extracting these tables from real hardware and passing them to a QEMU virtual machine.
The author explains how to extract ACPI SLIC and MSDM tables from physical laptops to achieve OEM activation for Windows Vista through 8.1 within QEMU virtual machines.