Audio Fingerprinting for VM Detection

[nks0005]

Hi,

I’m thinking about experimenting with audio fingerprinting to distinguish between a VM and a bare-metal environment.

I got the idea from the audio fingerprinting approach used by FingerprintJS.

The basic idea is simple:

Bare-metal → generate an audio fingerprint

VM → generate an audio fingerprint

Compare the results

I’d like to see whether there is a consistent difference between VM and bare-metal environments.

If the results are promising, it could potentially be used as an additional signal for VM detection in VMAware.

What do you think about this idea?

[NotRequiem]

Interesting.

FingerprintJS uses OfflineAudioContext. They pass an audio signal through a series of audio filters and hash the rendered mathematical buffer values. However, OfflineAudioContext does not interact with the physical sound card or audio DAC, it is rendered 100% in software.

So... Subtle floating-point rounding differences occurring at the CPU level, like whether the browser executes operations using FMA, AVX2, SSE2, ARM NEON, etc can make it vary.

It would be useful for emulated CPUs or if the hypervisor mask out some instruction sets, I guess...? Which VMAware already detects well. If your VM uses actual hardware-assisted virtualization with host CPU passthrough and the same OS/browser version, floating-point instructions execute natively in the CPU, so there would not be any difference.

I would suggest to query AudioContext, but inspect its hardware properties and driver metadata. I experimented with it in the past, but did not find any reliable detection in sample rate, channel capabilities or latency metrics like base and output latency.

Maybe you have some other idea?