I was reading about people trying to use their apple cloud services on their Mac OS VM
And I was curious, in a more general way, how do we make a VM indistinguishable from a bare metal computer ?
Preferably without having to passthrough everything (and compromise the ability of the hypervisor to run more than one such VM at a time)
Is there a "Hypervisor stealthing" best practices document ?
I did a search but these were the closest documents I could find
Surely this work has been done already, the malware analysis white hats certainly do use these techniques every day so at least the basics aren't going to be a secret.
Probably things like not having hardware that has "red hat" in the name, and timing attacks and the like
Asking an LLM about it, it mentions the following
And the fields at the forefront of this practice are
But I'm more interesting in developing this capability in a "general purpose" way, not specifically tuned for any other these but instead to take the best idea from those fields and the lesser known ones and make general purpose tooling to enable "Hypervisor Stealthing" aspect for whatever scenario/purpose I might want to try in the future.
Code:
https://forum.proxmox.com/threads/mac-os-15-sequoia-on-proxmox-9-0-3.169742/
https://forum.proxmox.com/threads/macos-sequoia-cant-log-apple-id-and-its-services.154328/
https://forum.proxmox.com/threads/anyone-can-make-bluetooth-work-on-sonoma.153301/And I was curious, in a more general way, how do we make a VM indistinguishable from a bare metal computer ?
Preferably without having to passthrough everything (and compromise the ability of the hypervisor to run more than one such VM at a time)
Is there a "Hypervisor stealthing" best practices document ?
I did a search but these were the closest documents I could find
Code:
https://www.qumulus.io/best-practices-for-mitigating-common-virtual-machine-vulnerabilities-in-your-cloud-lab/
https://www.reddit.com/r/PiratedGames/comments/1s1vnkc/deep_dive_what_is_hypervisor_how_does_it_work/
https://www.entrust.com/blog/2022/11/preventing-hyperjacking-in-a-virtual-environment
https://www.sygnia.co/blog/fire-ant-a-deep-dive-into-hypervisor-level-espionage/
https://www.virusbulletin.com/conference/vb2025/abstracts/living-hypervisor-defeating-anti-vm-sandbox-analysis-patching-hypervisor/Surely this work has been done already, the malware analysis white hats certainly do use these techniques every day so at least the basics aren't going to be a secret.
Probably things like not having hardware that has "red hat" in the name, and timing attacks and the like
Asking an LLM about it, it mentions the following
Code:
1. Memory View Splitting (SLAT/EPT Hooks): Using Second-Level Address Translation
(like Intel's EPT or AMD's NPT), a stealth hypervisor can split the "view" of memory.
If an application tries to read or scan an area of memory for tampering, the hypervisor
serves an unmodified, clean page. However, when the processor executes code from that
exact same address, the hypervisor seamlessly swaps in a modified "hooked" page.
2. CPUID and MSR Spoofing: Standard operating systems query the CPUID instruction to check if
they are virtualized (which normally returns flags like VMX or hypervisor brand strings).
A stealth hypervisor intercepts these instructions (via VM-Exits) and rewrites the
registers on the fly to return physical CPU information instead.
3. Handling Timing Side-Channels: Virtualization naturally introduces minor delays
when executing certain low-level hardware operations due to the transition between
the VM and the hypervisor (VM-Exits). To prevent the guest OS from noticing these
timing discrepancies via instructions like RDTSC (Read Time-Stamp Counter), stealth
hypervisors spoof or manipulate the time tracking to match bare-metal speedsAnd the fields at the forefront of this practice are
Code:
Malware Analysis (Sandboxing)
Malicious Rootkits (Hyperjacking)
DRM Bypasses & Game CrackingBut I'm more interesting in developing this capability in a "general purpose" way, not specifically tuned for any other these but instead to take the best idea from those fields and the lesser known ones and make general purpose tooling to enable "Hypervisor Stealthing" aspect for whatever scenario/purpose I might want to try in the future.