Awesome Anti-Virtualization [](https://awesome.re)

A curated list of resources related to anti-virtualization techniques containing references to books, papers, blog posts, and other written resources.

Anti-virtualization techniques are used to detect and evade virtualized environments. These techniques are used by malware authors, anti-cheats and proprietary software among others to avoid detection by security researchers and analysts.

We generally divide anti-virtualization techniques (also called anti-VM or redpills) into 4 categories:

• Timing-based: These techniques rely on the fact that virtualized environments have different timing characteristics than physical machines.
• Behavior-based: These techniques rely on the fact that virtualized environments have different behaviors than physical machines.
• Signature-based: These techniques rely on the fact that virtualized environments have different signatures than physical machines.
• Based on a trusted third party: These techniques rely on the fact that virtualized environments have a trusted third party that can be used to detect them.

These techniques can be called redpills because they are used to detect the "red pill" of a virtualized environment. The term "red pill" comes from the movie "The Matrix" where the red pill is used to wake up the protagonist from the virtual world.

The red pill is a special case of the related "trusted computing" and the attestation concept (Zaidenberg et al. 2015d), In Trusted computing attestation a remote 3rd party or even local software tries to ensure the integrity of the local machine in terms of software (mainly) and hardware (sometimes).

• Creating Modern Blue Pills and Red Pills, July 2019

Contents

• :books: Literature : everything written about anti-virtualization techniques
  • Documentation (blogs, manuals, specifications, etc.)
  • Scientific Research
  • Media (videos, podcasts, etc.)
• :wrench: Tools : tools to detect and evade virtualized environments
• :jigsaw: Techniques : a list of anti-virtualization techniques

:books: Literature

Documentation

• About evasion techniques - Check Point Research : A collection of evasion techniques used by malware to avoid detection.
• Detecting Hypervisor-assisted Hooking - Maurice Heumann, see also Github Project EPT Hook Detection
• Evading ACPI checks in commercial virtualization platforms - Nick Peterson
• How anti-cheats detect system emulation - secret.club
• Detecting Hypervisor Presence on Windows 10 - Nick Peterson
• 7 Ways to Detect Virtualization from your VM [Xen,VirtualBox,KVM,OpenStack with KVM] - techglimpse.com
• Playing with GuLoader Anti-VM techniques - outpost24.com
• Detecting VMware by reading an invalid MSR - drew
• Defeating malware's Anti-VM techniques (CPUID-Based Instructions) - Sina Karvandi
• Deploy Hidden Virtual Machine For VMProtections Evasion And Dynamic Analysis - r0ttenbeef

Scientific Research

The following papers are sorted by publication date (newest first):

• ARAP: Demystifying Anti Runtime Analysis Code in Android Apps (August 2024)
• Unraveling Shadows: Exploring the Realm of Elite Cyber Spies (July 2024)
• The Reversing Machine: Reconstructing Memory Assumptions (May 2024)
• CLOUDOSCOPE: Detecting Anti-Forensic Malware using Public Cloud Environments (June 2023)
• From Text to MITRE Techniques: Exploring the Malicious Use of Large Language Models for Generating Cyber Attack Payloads (May 2023)
• HyperDbg: Reinventing Hardware-Assisted Debugging (May 2022)
• On the Effectiveness of Binary Emulation in Malware Classification (April 2022)
• An automated framework for runtime analysis of malicious executables on Linux (2021)
• Bypassing Anti-Analysis of Commercial Protector Methods Using DBI Tools (2021)
• A Review on Android Malware: Attacks, Countermeasures and Challenges Ahead (2021)
• Longitudinal Study of the Prevalence of Malware Evasive Techniques (December 2021)
• POW-HOW: An enduring timing side-channel to evadeonline malware sandboxes (September 2021)
• Detection of Virtual Machines Based on Thread Scheduling (July 2021)
• Hypervisor-assisted dynamic malware analysis (June 2021)
• Sandbox Detection Using Hardware Side Channels (April 2021)
• Resurrecting anti-virtualization and anti-debugging: Unhooking your hooks (March 2021)
• DBI, debuggers, VM: gotta catch them all: How to escape or fool debuggers with internal architecture CPU flaws? (June 2021)
• Reducing Malware Analysis Overhead With Coverings (January 2021)
• Creating Modern Blue Pills and Red Pills (July 2019)
• Rethinking anti-emulation techniques for large-scale software deployment (June 2019)
• Malware Dynamic Analysis Evasion Techniques (November 2018)
• Follow the WhiteRabbit: Towards Consolidation of On-the-Fly Virtualization and Virtual Machine Introspection (September 2018)
• New attack technique based on Meltdown. Using speculative instructions to detect virtualization (May 2018)
• Handling Anti-Virtual Machine Techniques in Malicious Software (December 2017)
• A Study of I/O Performance of Virtual Machines (June 2017)
• Detecting Hardware -Assisted Virtualization (July 2016)
• Advanced or Not? A Comparative Study of the Use of Anti-debugging and Anti-VM Techniques in Generic and Targeted Malware (May 2016)
• A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (March 2016)
• Virtual Machines Detection Methods Using IP Timestamps Pattern Characteristic (February 2016)
• Research on Utilizing Emulab for Malware Analysis (February 2016)
• Two challenges of stealthy hypervisors detection : time cheating and data fluctuations (2015)
• New Methods for Detecting Malware Infections and New Attacks against Hardware Virtualization (2015)
• Hyperprobe: Towards Virtual Machine Extrospection (2015), see also Presentation Video
• Mal-EVE: Static detection model for evasive malware (August 2015)
• An assessment of virtual machine assails (January 2015)
• Cardinal Pill Testing of System Virtual Machines (August 2014)
• An analysis of hardware-assisted virtual machine based rootkits (June 2014)
• VMDE: Virtual Machines Detection Enhanced (November 2013)
• Anti-virtual machines and emulations (June 2012)
• Virtualization Security: Virtual Machine Monitoring and Introspection (2011)
• Malware Virtualization-Resistant Behavior Detection (December 2011)
• Detecting Environment-Sensitive Malware (September 2011)
• On the Impossibility of Detecting Virtual Machine Monitors (2009)
• Detecting the Presence of Virtual Machines Using the Local Data Table (2009)
• Stealth sandbox analysis of malware (August 2009)
• Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware (June 2008)
• Attacks on More Virtual Machine Emulators (2007), see associated slides
• Attacks on Virtual Machine Emulators (2007), see associated slides
• Detecting System Emulators (October 2007)
• Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction (October 2007)
• Hiding Virtualization from Attackers and Malware (May 2007)
• On the Cutting Edge: Thwarting Virtual Machine Detection (2006)
• Methods for Virtual Machine Detection (June 2006)

Media

• Countering Anti-Debugging Techniques: Enhancing Transparency in Nested Virtualization using HyperDbg (slides only) (July 2025)
• LISA15 - Hyperprobe: Towards Virtual Machine Extrospection (December 2021)
• Don't Tell Joanna, The Virtualized Rootkit Is Dead, see associated slides (2007)

:wrench: Tools

Tools are divided into their respective categories (by default, all tools are in user-mode):

Icon	Description
🐧	Linux
🪟	Windows
🍏	macOS
💽	raw / no OS / UEFI
🚀	kernel-mode

Start of the list:

• 🐧🪟🍏 | VMAware : Easy-to-use cross-platform C++ VM detection library and tool
• 🐧 | Hypervisor-Phantom : Advanced malware analysis tool for evading detection from advanced malware.
• 🪟 | Pafish : testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do.
• 🪟 | VMDE : Virtual Machines Detection Enhanced, source from VMDE paper, adapted to 2015.
• 🪟 | Hypervision-Detection : Detects virtual machines and malware analysis environments
• 🪟 | Al-khaser : al-khaser is a PoC "malware" application with good intentions that aims to stress your anti-malware system. It performs a bunch of common malware tricks with the goal of seeing if you stay under the radar.
• 💽🪟 | illusion-rs : Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)
  • specifically see Hypervisor detection section
• 🚀🪟 | hyperdetect.cc: C++ code snippet that checks for a “lazy” hypervisor running in kernel-mode
• 🪟 | antivmdetection : Script to create templates to use with VirtualBox to make vm detection harder
• 🪟 | InviZzzible : InviZzzible is a tool for assessment of your virtual environments in an easy and reliable way. It contains the most recent and up to date detection and evasion techniques as well as fixes for them.
• 🪟 | Anti-VM : C++ Windows-based implementation of several anti-vm techniques used in malware development.
• 🐧 | apate : Apate performs anti-debugging, anti-VM and anti-sandbox tests, to see if your linux system is able to stay under the radar.
• 🐧 | inside-vm : Detect if code is running inside a virtual machine (x86 and x86-64 only).
• 🪟 | EPT Hook Detection
• 🪟 | PyDefender : Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package for Python.
• 🪟 | GoDefender : Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package for Go. Windows ONLY.
• 🐧🪟 | Metasploit : Open-source penetration testing framework that includes virtual machine detection modules
  • metasploit-framework/modules/post/linux/gather/checkvm.rb
  • metasploit-framework/modules/post/windows/gather/checkvm.rb
  • metasploit-framework/scripts/meterpreter/winenum.rb
  • metasploit-framework/modules/auxiliary/scanner/netbios/nbname.rb
• 🐧 | systemd-detect-virt (man page) : systemd-detect-virt detects execution in a virtualized environment. It identifies the virtualization technology and can distinguish full machine virtualization from container virtualization. systemd-detect-virt exits with a return value of 0 (success) if a virtualization technology is detected, and non-zero (error) otherwise.
  • See also systemd code systemd/src/basic/virt.c

:jigsaw: Techniques

Technique	Description	Certainty	Platform	Code reference
VMID	Check CPUID output of manufacturer ID for known VMs/hypervisors at leaf 0 and 0x40000000-0x40000100	100%	🐧🪟🍏	link
CPU brand	Check if CPU brand model contains any VM-specific string snippets	50%	🐧🪟🍏	link
Hypervisor bit	Check if hypervisor feature bit in CPUID eax bit 31 is enabled (always false for physical CPUs)	100%	🐧🪟🍏	link
Hypervisor string	Check for hypervisor brand string length (would be around 2 characters in a host machine)	75%	🐧🪟🍏	link
Timer	Check for timing anomalies in the system	45%	🐧🪟🍏	link
Thread count	Check if there are only 1 or 2 threads, which is a common pattern in VMs with default settings (nowadays physical CPUs should have at least 4 threads for modern CPUs)	35%	🐧🪟🍏	link
MAC address	Check if mac address starts with certain VM designated values	20%	🐧🪟	link
Temperature	Check if thermal directory in linux is present, might not be present in VMs	15%	🐧	link
Chassis vendor	Check if the chassis vendor is a VM vendor	65%	🐧	link
Chassis type	Check if the chassis type is valid (it's very often invalid in VMs)	20%	🐧	link
/.dockerenv	Check if /.dockerenv or /.dockerinit file is present	30%	🐧	link
dmidecode output	Check if dmidecode output matches a VM brand	55%	🐧	link
dmesg output	Check if dmesg output matches a VM brand	55%	🐧	link
/sys/class/hwmon	Check if /sys/class/hwmon/ directory is present. If not, likely a VM	35%	🐧	link
5th sidt byte	Check if the 5th byte after sidt is null	45%	🐧	link
DLL	Check for VM-specific DLLs	25%	🪟	link
Registry	Check for VM-specific registry values	50%	🪟	link
VM files	Find for VM-specific specific files	25%	🪟	link
hwmodel	Check if the sysctl for the hwmodel does not contain the "Mac" string	100%	🍏	link
Disk size	Check if disk size is under or equal to 50GB	60%	🐧	link
RAM and disk size VBox	Check for default RAM and DISK sizes set by VirtualBox	25%	🐧🪟	link
VBox network	Check for VirtualBox network provider string	100%	🪟	link
Computer name	Check if the computer name (not username to be clear) is VM-specific	10%	🪟	link
Wine file	Check wine_get_unix_file_name file for Wine	100%	🪟	link
Hostname	Check if hostname is specific	10%	🪟	link
KVM directories	Check for KVM directory "Virtio-Win"	30%	🪟	link
QEMU directories	Check for QEMU-specific blacklisted directories	30%	🪟	link
Power capabilities	Check what power states are enabled	50%	🪟	link
Disk drive ID	Checks for virtual machine signatures in disk drive device identifiers	100%	🪟	link
VM processes	Check for any VM processes that are active	15%	🪟	link
User and hostname	Check for default VM username and hostname for linux	10%	🐧	link
Gamarue	Check for Gamarue ransomware technique which compares VM-specific Window product IDs	10%	🪟	link
Bochs faulty CPU	Check for various Bochs-related emulation oversights through CPU checks	100%	🐧🪟🍏	link
MSSMBIOS	Check MSSMBIOS registry for VM-specific signatures	100%	🪟	link
Low memory	Check if memory is too low for MacOS system	15%	🍏	link
IO kit	Check MacOS' IO kit registry for VM-specific strings	100%	🍏	link
ioreg command	Check for VM-strings in ioreg commands for MacOS	100%	🍏	link
System Integrity Protection	Check if System Integrity Protection is disabled (likely a VM if it is)	40%	🍏	link
HKLM	Check HKLM registries for specific VM strings	25%	🪟	link
QEMU process	Check for "qemu-ga" process	10%	🐧	link
VirtualPC backdoor	Check for official VPC method	75%	🪟	link
sidt instruction	Check for sidt instruction method	25%	🪟	link
sgdt instruction	Check for sgdt instruction method	30%	🪟	link
sldt instruction	Check for sldt instruction method	15%	🪟	link
Offensive Security sidt	Check for Offensive Security SIDT method	60%	🪟	link
Offensive Security sgdt	Check for Offensive Security SGDT method	60%	🪟	link
Offensive Security sldt	Check for Offensive Security SLDT method	20%	🪟	link
VirtualPC sidt	Check for sidt method with VPC's 0xE8XXXXXX range	15%	🪟	link
VMware iomem	Check for VMware string in /proc/iomem	65%	🐧	link
VMware ioports	Check for VMware string in /proc/ioports	70%	🐧	link
VMware scsi	Check for VMware string in /proc/scsi/scsi	40%	🐧	link
VMware dmesg	Check for VMware-specific device name in dmesg output	65%	🐧	link
VMware str instruction	Check str assembly instruction method for VMware	35%	🪟	link
VMware IO port backdoor	Check for official VMware io port backdoor technique	100%	🪟	link
VMware memory IO port	Check for VMware memory using IO port backdoor	85%	🪟	link
smsw instruction	Check for SMSW assembly instruction technique	30%	🪟	link
Mutex strings	Check for mutex strings of VM brands	85%	🪟	link
Odd CPU threads	Check for odd CPU threads, usually a sign of modification through VM setting because 99% of CPUs have even numbers of threads	80%	🐧🪟🍏	link
Intel thread mismatch	Check for Intel CPU thread count database if it matches the system's thread count	95%	🐧🪟🍏	link
Xeon thread mismatch	Same as above, but for Xeon Intel CPUs	95%	🐧🪟🍏	link
Nettitude VM memory	Check for memory regions to detect VM-specific brands	100%	🪟	link
Cuckoo directory	Check for cuckoo directory using crt and WIN API directory functions	30%	🪟	link
Cuckoo pipe	Check for Cuckoo specific piping mechanism	30%	🪟	link
Hyper-V hostname	Check for default Azure hostname format regex (Azure uses Hyper-V as their base VM brand)	30%	🐧🪟	link
General hostname	Check for commonly set hostnames by certain VM brands	10%	🐧🪟	link
Screen resolution	Check for pre-set screen resolutions commonly found in VMs	20%	🪟	link
Device string	Check if bogus device string would be accepted	25%	🪟	link
BlueStacks folders	Check for the presence of BlueStacks-specific folders	5%	🐧	link
CPUID signature	Check for signatures in leaf 0x40000001 in CPUID	95%	🐧🪟🍏	link
KVM bitmask	Check for KVM CPUID bitmask range for reserved values	40%	🐧🪟🍏	link
Intel KGT signature	Check for Intel KGT (Trusty branch) hypervisor signature in CPUID	80%	🐧🪟🍏	link
QEMU DMI	Check for presence of QEMU in the /sys/devices/virtual/dmi/id directory	40%	🐧	link
QEMU USB	Check for presence of QEMU in the /sys/kernel/debug/usb/devices directory	20%	🐧	link
Hypervisor directory	Check for presence of any files in /sys/hypervisor directory	20%	🐧	link
User Mode Linux CPU	Check for the "UML" string in the CPU brand	80%	🐧	link
kmsg logs	Check for any indications of hypervisors in the kernel message logs	5%	🐧	link
Xen VM processes	Check for a Xen VM process	10%	🐧	link
VBox kernel module	Check for a VBox kernel module	15%	🐧	link
sysinfo process	Check for potential VM info in /proc/sysinfo	15%	🐧	link
Device tree	Check for specific files in /proc/device-tree directory	20%	🐧	link
DMI scan	Check for string matches of VM brands in the linux DMI	50%	🐧	link
SMBIOS VM bit	Check for the VM bit in the SMBIOS data	50%	🐧	link
Podman file	Check for podman file in /run/	5%	🐧	link
WSL process	Check for WSL or microsoft indications in /proc/ subdirectories	30%	🐧	link
ANY.RUN driver	Check for any.run driver presence	65%	🪟	link
ANY.RUN directory	Check for any.run directory and handle the status code	35%	🪟	link
Driver names	Check for VM-specific names for drivers	100%	🪟	link
sidt base	Check for unknown IDT base address	100%	🪟	link
HDD serial	Check for serial numbers of virtual disks	100%	🪟	link
Port connections	Check for physical connection ports	25%	🪟	link
GPU capabilities	Check for GPU capabilities related to VMs	100%	🪟	link
GPU VM strings	Check for specific GPU string signatures related to VMs	100%	🪟	link
VM devices	Check for VM-specific devices	45%	🪟	link
idt and GDT scan	Check if the IDT and GDT virtual base addresses are equal across different CPU cores when not running under Hyper-V	50%	🪟	link
Processor count	Check for number of processors	50%	🪟	link
Core count	Check for number of cores	50%	🪟	link
ACPI temperature	Check for device's temperature	25%	🪟	link
Processor ID	Check if any processor has an empty Processor ID using SMBIOS data	25%	🪟	link
QEMU /sys/	Check for existence of "qemu_fw_cfg" directories within /sys/module and /sys/firmware	70%	🐧	link
lshw QEMU	Check for QEMU string instances with lshw command	80%	🐧	link
Virtual processors	Check if the number of virtual and logical processors are reported correctly by the system	50%	🪟	link
Hyper-V query	Check if a call to NtQuerySystemInformation with the 0x9f leaf fills a _SYSTEM_HYPERVISOR_DETAIL_INFORMATION structure	100%	🪟	link
VM memory pools	Check for system pools allocated by hypervisors	80%	🪟	link
AMD SEV	Check for AMD-SEV MSR running on the system	50%	🐧🍏	link
AMD thread count mismatch	Check for AMD CPU thread count database if it matches the system's thread count	95%	🐧🪟🍏	link
Native VHD	Check for OS being booted from a VHD container	100%	🪟	link
Virtual registry	Check for particular object directory which is present in Sandboxie virtual environment but not in usual host systems	65%	🪟	link
Firmware signatures	Check for VM signatures and patched strings by hardeners in firmware, while ensuring the BIOS serial is valid	75%	🪟🐧	link
File access history	Check if the number of accessed files are too low for a human-managed environment	15%	🐧	link
Audio device	Check if audio device is present	25%	🪟	link
Unrecognised physical x86 CPU manufacturer	Check if the CPU manufacturer is not known	50%	🐧🪟🍏	link
OSXSAVE	Check if running xgetbv in the XCR0 extended feature register triggers an exception	50%	🪟	link
nsjail PID	Check if process status matches with nsjail patterns with PID anomalies	75%	🐧	link
PCIe bridge name	Check for PCIe bridge names for known VM keywords and brands	100%	🐧	link

Contributing

Contributions are welcome! Please read the contribution guidelines first.