Hiding Virtualization From Other Software

The Kernel-based Virtual Machine (KVM) allows Linux systems to function as hypervisors without needing any extra software, but VMs created with it don’t behave exactly like real hardware does. Hiding Virtualization From Other Software. Sometimes that’s important, though, so [sandwich] built a tool called vfio-native that obscures the fact that software might be running in a virtual machine.

There are plenty of the ways that virtual hardware differs from bare metal. The VM may behave slightly differently for obscure instructions in ways that are measurable, it may take slightly longer to perform some tasks, or the hypervisor may simply announce itself directly. Vfio-native includes some kernel patches that solve some bugs which address the different behaviors, changes the way that the kernel identifies itself, and attempts to force the CPUs to behave in ways that real hardware would behave.

With all of this applied to the virtual machine, it scores a 1/85 against a VM detection tool, with a standard KVM virtual machine scoring 10/85. For anyone looking to test this out, it’s available in the AUR for Arch Linux. Also, it’s probably worth mentioning that there are more reasons to use this than cheating at Counter-Strike.