13

Some software contains tests to see if they are running on a virtual machine.

It's very unpleasant to see alert messages such as "Sorry, this application cannot run under a Virtual Machine." and have your software stopped!

There are lots of legal reasons to override such tests. Moreover such limitations are (most of the time) not written in User License Agreements.

So... how do I hide the fact that a Virtual Machine is running the program? I don't want programs that do this scan to successfully detect the VM that is running.

I'm using a Virtual Private Server (VPS) with Hyper-V... I'm administrator of the Operating System (Windows 2003) installed on this VPS, not administrator of Hyper-V.

  • 1
    Can you clarify what you mean by "hide a program"? Also, what software are you trying to run, specifically? – Anderson Green Sep 29 '12 at 17:10
  • @AndersonGreen, they mean that they want to prevent a program from detecting that it is running in a VM. – Synetech Sep 29 '12 at 17:43
  • So let me get this straight, your running software within the VM and you do not want software on the host to detect there is certain software running within the VM, correct? – user88311 Sep 30 '12 at 1:01
  • 1
    You should be careful. If the program is deliberately checking whether it's running under a debugged/virtual environment, it may be very possible it's trying to enforce a certain statement listed in its License Agreement. Tampering with VM might be a direct violation of the EULA. – bytebuster Oct 1 '12 at 20:03
  • 1
    @bytebuster I said in my question "Moreover such limitations are (most of the time) not written in User License Agreements."... So I know that it's sometimes forbidden to do it... and sometimes it's allowed... I do not seek legal advice but technical advice! – Femto Trader Oct 2 '12 at 4:33
1

In short, I think you just cannot. It's the discussion about malware trying to detect if it is running in a VM to avoid being detected by systems that use VMs to run code to check for malware.

Some quick references are: VRT: How does malware know the difference between the virtual world and the real world? and The Dead Giveaways of VM-Aware Malware .

| improve this answer | |
  • 1
    Strongly disagree, you have the argument the wrong way around. Detection that it is a virtualized environment makes it much easier for malware to do its job. Also consider there are anti-malware and anti-virus labs that need to run VMs to isolate their research and that plant malware in those VMs and need to hide the fact that the instance is a virtualized instance. That is the precise reason ESXi/VSphere allows setting a flag to hide the fact that a VM is a VM. – Matthias Wolf Oct 27 '17 at 8:51
  • I also strongly disagree, How about NVidia GPU passthrough w/ Consumer grade cards. NVidia Drivers do a "VM" check and fail to install w/ error code 43, but a quick google finds the workaround. It is a constant game of cat and mouse when it comes to stuff like this. – FreeSoftwareServers Oct 24 '18 at 7:29
  • I think this answer is correct, or rather would be if it stated that anything found to work 'now' likely would not work after some period of time as this is in many ways a sort of 'arms race' (especially were malware is concerned) and so means of detection vs means to thwart detection are constantly changing and advancing over time. – Chuck van der Linden Oct 25 '19 at 23:05
0

As far as I know, it depends on the kind of virtualization you are using.

Let's start saying that you can surely mitigate some things (E.G. change MAC address, uninstall guest additions).

That said, if you are running a full virtualization, the hypervisor emulates the hardware for the guests. An emulated CPU will have its own (software) clock that, soon or later, will show different speeds, when it shouldn't.

This is one of the things you can't repair in any way, and a program (mostly malwares) will know it is running in a VM.

You can get it straight using a Paravirtualization that consists in using your real hardware in a closed environment.

| improve this answer | |
  • I'd say it depends equally what hyper-visor you are using as to what checks the software is doing to see if it is in a VM. – FreeSoftwareServers Oct 24 '18 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.