2019 LT: Novel VM Detection Tricks

### Overview In this talk, a security researcher from Nettitude's Research and Innovation (R&I) team presents novel and user-mode techniques for detecting virtual machines (VMs) on Windows systems. Building on earlier research and contributions to the open-source tool 'al-khaser' (maintained primarily by LordNoteworthy), the speaker explores how hypervisors fail to accurately emulate real physical hardware, creating distinct forensic footprints that malware authors, red teams, and security analysts can leverage.

### Key Topics - **Design Constraints of al-khaser**: The speaker details the strict operating rules used for the al-khaser project: zero custom or vulnerable kernel drivers (avoiding driver-signing hurdles and system compromise), no exploit-based breakouts, no modification of system settings, and pure user-mode C++ implementations for Windows. - **ACPI Firmware Table Inspection**: Utilizing Windows user-mode APIs like `EnumSystemFirmwareTables` to inspect ACPI tables, SMBIOS data, and missing firmware signatures (e.g., absence of HPET or WPBT tables, presence of vendor strings like 'VMware'). - **Direct ATA Commands**: Interacting with physical hard drives via ATA IDENTIFY commands to pinpoint inconsistent flags, obsolete SCSI versions, or hardcoded emulation artifacts. - **PCI Bus and Power Management Artifacts**: Identifying repetitive virtual PCI topologies and hypervisor omissions such as nonexistent ACPI sleep states (S1–S4). - **WMI Hardware Querying**: Probing Windows Management Instrumentation (WMI) for missing physical components, such as temperature sensors, fans, and voltage probes.

### Technical Details - **ACPI Tables and Firmware Quirks**: Real modern hardware consistently contains High Precision Event Timers (HPET) and vendor licensing tables (SLIC), whereas VMs generally omit them. Furthermore, SMBIOS binaries in virtual environments frequently leak default vendor strings directly in memory, such as 'VMware 2006'. - **Direct Disk Querying (`ATA IDENTIFY`)**: Running the `ATA IDENTIFY` command via the `DeviceIoControl` API against physical disk handles exposes inconsistencies in virtual device controllers (e.g., VirtualBox returning conflicting capability flags where features are reported unsupported yet enabled). Furthermore, virtualized platforms often emulate archaic interfaces (like 1993-era SCSI) never found on modern physical systems. The speaker created a helper tool called `ata_identify_dump` to map these anomalies across hypervisors. - **PCI Topologies**: Using SetupAPIs and WMI, user-mode applications can inspect PCI routes, multiplexers, and vendor/device IDs. Hypervisors (VirtualBox, VMware, Hyper-V) share predictable, hardcoded virtual PCI device layouts. - **Sleep States (`GetPwrCapabilities`)**: Hypervisors rarely implement physical power management. Calling `GetPwrCapabilities` reveals that ACPI sleep states S1, S2, S3, and S4 are entirely unsupported on almost all virtualization platforms. - **WMI Inconsistencies**: User-mode queries against WMI reveal fake CPU cache sizes, fixed memory array configurations, and a complete absence of thermal zones, fan controllers, and voltage probes.

### Takeaways Hardware emulation in hypervisors focuses on functional minimums rather than absolute parity with physical hardware. As a result, virtual environments can be reliably detected entirely from user mode without specialized kernel privileges or exploits. While user-mode API hooking and hypervisor updates can attempt to mask these signs, emulating every physical quirk remains a persistent cat-and-mouse challenge.