Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Hypervisor detect #21
this article shows few methods to detect hypervisor. https://rayanfam.com/topics/defeating-malware-anti-vm-techniques-cpuid-based-instructions/
Inside HvppHandleExecuteCpuid I do the following to set the 31st bit to 0
but this breaks chrome, firefox and many others, they won't connect to the internet. Do you why and a way to fix it?
update: appears it breaks apps regardless if I set anything, I have to cal HvppVmExitPassthrough(Passthrough); but then the context registers aren't set.
my intention is to set 0 to the 31bit of ecx if eax == 1 when someone else calls cpuid; I've done this successfully with your HvppHandleExecuteCpuid callback and tested with usermod app, but my issue is even if I modify no registers it breaks all browser say for example
without calling HvppVmExitPassthrough(Passthrough); breaks internet. If I call that function then it doesn't matter if I set context register or not because it doesn't set anything.