Skip to content
This repository was archived by the owner on Aug 22, 2025. It is now read-only.
This repository was archived by the owner on Aug 22, 2025. It is now read-only.

Add how to patch detections to wiki #68

@JordanPlayz158

Description

@JordanPlayz158

I know this is probably out of the scope of this application but I think it would be a great edition to explain how to patch the detections on things like qemu/libvirt, on almost stock qemu/libvirt (a few xml modifications) the following detections were found:

  • rdtsc forcing VM exit (https://www.reddit.com/r/VFIO/comments/i071qx/spoof_and_make_your_vm_undetectable_no_more/ This reddit post shows how to fix the rdtsc detection (modifying arch/x86/kvm/vmx/vmx.c))
  • Checking hypervisor bit in cpuid feature bits (i'd assume there is a simple libvirt xml change to fix this)
  • Using mouse activity (not going to lie, I have no clue what that means or how you would fix that)
  • Reg key (HKLM\HARDWARE\Description\System "SystemBiosVersion") (I'd assume this is either a simple windows registry change or a libvirt xml change)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions