search

Air14 / HyperHide

Hypervisor based anti anti debug plugin for x64dbg
MIT License
1.23k stars 279 forks source link

The program has been detected by VMP virtualization, is there any way to bypass it? #52

Open barluc opened 3 months ago

barluc commented 3 months ago

image image

barluc commented 3 months ago

When I enable VT-x on my Win10 system and successfully start the HyperHide service, launching the exe will be detected virtual machine.

barluc commented 3 months ago

VMP may detect virtual machines through the __cpuid instruction. Is there any way to bypass virtualization detection? Below is a partial implementation of the VMP code. https://github.com/jmpoep/vmprotect-3.5.1/blob/d8fcb7c0ffd4fb45a8cfbd770c8b117d7dbe52b5/runtime/loader.cc#L2463