libvirt users - Jun 2017 - vendor_id state='off' not working as expected

Hi All,

I'm trying to counter VM detection methods for a malware sandbox, using
Pafish as a benchmark tool.

https://github.com/a0rtega/pafish

I have <hyperv><vendor_id state='off'/></hyperv>
defined in a Windows 7
domain on Ubuntu 17.10, but for some reason this just changes the
hypervisor vendor to "Microsoft Hv" instead of the default
"KVMKVMKVM"
vendor.

How can I remove the hypervisor vendor completely?

On Tue, Jun 06, 2017 at 04:34:09PM -0400, Sean Whalen
wrote:
>Hi All,
>
>I'm trying to counter VM detection methods for a malware sandbox, using
>Pafish as a benchmark tool.
>
>https://github.com/a0rtega/pafish
>
>I have <hyperv><vendor_id state='off'/></hyperv>
defined in a Windows 7
>domain on Ubuntu 17.10, but for some reason this just changes the
>hypervisor vendor to "Microsoft Hv" instead of the default
"KVMKVMKVM"
>vendor.
>
<vendor_id state='off'/> is the same as not putting the tag there
at
all.  The state refers to the tag, it doesn't change the configuration.
It it were 'on', you would then be able to change it with
value="XXX"
where XXX is the value.
>How can I remove the hypervisor vendor completely?
I'm not sure, but you can set

<kvm><hidden state='on'/></kvm>

if that's what you mean.
>_______________________________________________
>libvirt-users mailing list
>libvirt-users@redhat.com
>https://www.redhat.com/mailman/listinfo/libvirt-users