ID #1057

How to hide being inside a VM ?

It is not possible to hide the existence of a VM from a skilled user.

It is only possible to hide the fact that a virtual machine is used from simple "Am I running inside a VM ?" tests.
Those tests are used by several programs - the idea is to prevent an unexperienced user from using this program inside a VM.
Some programs only allow more expensive Pro-versions to be used inside a VM.
VMware itself for example prevents installing Workstation inside a VM.

Very simple detection mechanisms can be cheated by closing the backdoor that is used by the VMware-Tools.
For those simple apps this parameter may be enough

monitor_control.restrict_backdoor = "TRUE"

For more sophisticated programs this may help:

monitor_control.virtual_rdtsc = "false"
monitor_control.restrict_backdoor = "true"
isolation.tools.getPtrLocation.disable = "true"
isolation.tools.setPtrLocation.disable = "true"
isolation.tools.setVersion.disable = "true"
isolation.tools.getVersion.disable = "true"
monitor_control.disable_directexec = "true"


Tags: -

Related entries:

You can comment this FAQ