Способи виявлення віртуалізації систем приманок

Abstract

The general belief is that system emulators (such as Qemu) are more difficult to detect than traditional virtnesual mashines (such as VMware)because they handle allinstructions in software. In this paper, we seek to answer the question whether this belief is justified. In practicular, we analyze a number of possibilities to detect system emulators. Our results shows that emulation can be successfully detected, mainly because the task of perfectly emulating real hardware is complex. This paper describes known attacks agaist the most widely used virtual machine emulators (VMware and Qemu).