logoalt Hacker News

rwmjyesterday at 7:28 PM2 repliesview on HN

Testing if you're running under virtualization or emulation is a whole thing. We wrote virt-what to do this for virt and containers. It could do emulators as well if someone was motivated enough. It's basically a giant shell script. https://people.redhat.com/~rjones/virt-what/

There's also an adversarial aspect to this. Some emulators try to avoid detection and a lot of software tries to detect if it's running under virt for various reasons, eg. to stop cheating in games or stop reverse-engineering. (virt-what is deliberately not adversarial, it's very easy to "trick" it if you wanted to do that)


Replies

billypilgrimtoday at 7:40 AM

Also: malware often tries to detect a VM or an emulator too, for example Windows Defender uses an emulator internally to detonate samples, and there are attempts by malware to detect this and change the behavior to something benign.

show 1 reply
tombertyesterday at 7:33 PM

Makes sense; when I was doing WGU they explicitly forbid virtual machines, which makes enough sense since if you're in a VM they can't see your full screen. It wouldn't surprise me if nowadays they have some sort of software detector to see if you're in a VM.

show 2 replies