This repository contains research and resources regarding hypervisor detection evasion, specifically targeting QEMU/KVM architectures. It explores techniques to create "Stealth VMs" that are indistinguishable from bare-metal hardware by modern anti-cheat systems and security software.
The primary focus is on the "Red Pill" concept in computer science—manipulating the guest OS's perception of reality to hide the hypervisor layer.
- QEMU/KVM Source Code Modification: Removing static signatures (CPUID leaves, device model strings, vendor IDs).
- Kernel-Level Evasion: Developing kernel modules to intercept and spoof privileged instructions (like
RDTSC). - Hardware Emulation: Mimicking realistic hardware timing and behavior to bypass heuristic analysis.
- Nested Virtualization: Analysis of performance impacts and detection vectors in nested environments.
Modifying KVM kernel code to intercept CPUID instructions, specifically masking leaves like 0x40000000 which typically leak hypervisor signatures (e.g., "KVMKVMKVM").
Anti-cheat systems often use timing attacks (measuring CPU cycles for specific operations) to detect virtualization overhead (VMExit/VMEntry latency). This project explores methods to:
- Intercept
RDTSCinstructions via VMCS (Virtual Machine Control Structure). - Calculate and subtract the virtualization overhead.
- Return a "faked" cycle count to the guest OS, simulating bare-metal speed.
Editing OVMF/SeaBIOS source code to remove virtualization-specific strings from ACPI tables (FACP, RSDT) and firmware identifiers.
This repository is for educational and research purposes only. The techniques described herein are intended to improve understanding of virtualization security and operating system internals. The authors do not encourage or endorse the use of this information for malicious purposes or cheating in online games.
Based on the research paper: "Hipervizör Tespiti ve Kaçınma Sanatı: QEMU/KVM Kaynak Kod Modifikasyonu ve Kernel Düzeyinde Gizlilik Üzerine Derinlemesine Bir İnceleme"