15

Some software contains tests to see if they are running on a virtual machine.

It's very unpleasant to see alert messages such as "Sorry, this application cannot run under a Virtual Machine." and have your software stopped!

There are lots of legal reasons to override such tests. Moreover such limitations are (most of the time) not written in User License Agreements.

So... how do I hide the fact that a Virtual Machine is running the program? I don't want programs that do this scan to successfully detect the VM that is running.

I'm using a Virtual Private Server (VPS) with Hyper-V... I'm administrator of the Operating System (Windows 2003) installed on this VPS, not administrator of Hyper-V.

7
  • 1
    Can you clarify what you mean by "hide a program"? Also, what software are you trying to run, specifically? Sep 29, 2012 at 17:10
  • @AndersonGreen, they mean that they want to prevent a program from detecting that it is running in a VM.
    – Synetech
    Sep 29, 2012 at 17:43
  • So let me get this straight, your running software within the VM and you do not want software on the host to detect there is certain software running within the VM, correct?
    – user88311
    Sep 30, 2012 at 1:01
  • 1
    You should be careful. If the program is deliberately checking whether it's running under a debugged/virtual environment, it may be very possible it's trying to enforce a certain statement listed in its License Agreement. Tampering with VM might be a direct violation of the EULA.
    – bytebuster
    Oct 1, 2012 at 20:03
  • 1
    @bytebuster I said in my question "Moreover such limitations are (most of the time) not written in User License Agreements."... So I know that it's sometimes forbidden to do it... and sometimes it's allowed... I do not seek legal advice but technical advice! Oct 2, 2012 at 4:33

2 Answers 2

1

In short, I think you just cannot. It's the discussion about malware trying to detect if it is running in a VM to avoid being detected by systems that use VMs to run code to check for malware.

Some quick references are: VRT: How does malware know the difference between the virtual world and the real world? and The Dead Giveaways of VM-Aware Malware .

3
  • 1
    Strongly disagree, you have the argument the wrong way around. Detection that it is a virtualized environment makes it much easier for malware to do its job. Also consider there are anti-malware and anti-virus labs that need to run VMs to isolate their research and that plant malware in those VMs and need to hide the fact that the instance is a virtualized instance. That is the precise reason ESXi/VSphere allows setting a flag to hide the fact that a VM is a VM.
    – Matt
    Oct 27, 2017 at 8:51
  • I also strongly disagree, How about NVidia GPU passthrough w/ Consumer grade cards. NVidia Drivers do a "VM" check and fail to install w/ error code 43, but a quick google finds the workaround. It is a constant game of cat and mouse when it comes to stuff like this. Oct 24, 2018 at 7:29
  • I think this answer is correct, or rather would be if it stated that anything found to work 'now' likely would not work after some period of time as this is in many ways a sort of 'arms race' (especially were malware is concerned) and so means of detection vs means to thwart detection are constantly changing and advancing over time. Oct 25, 2019 at 23:05
0

As far as I know, it depends on the kind of virtualization you are using.

Let's start saying that you can surely mitigate some things (E.G. change MAC address, uninstall guest additions).

That said, if you are running a full virtualization, the hypervisor emulates the hardware for the guests. An emulated CPU will have its own (software) clock that, soon or later, will show different speeds, when it shouldn't.

This is one of the things you can't repair in any way, and a program (mostly malwares) will know it is running in a VM.

You can get it straight using a Paravirtualization that consists in using your real hardware in a closed environment.

1
  • I'd say it depends equally what hyper-visor you are using as to what checks the software is doing to see if it is in a VM. Oct 24, 2018 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.