Fake output of CPUID instruction

Question

I am trying to analyze a malware in a virtual machine (linux), but it uses the cpuid output to verify if it is in a virtual machine/sandbox, and refuses to run malign code if inside a virtualized environment.

Is it possible to change/fake the output of the cpuid instruction, so that when the malware checks for the cpuid flags, it sees the cpuid of a non-virtualized machine?

I know that I can bypass that by changing the KVM config (like in section 'VM Detection countermeasures' from this tutorial), but I want to know if it is possible to do so from inside the guest machine, without changing the config in the host computer?

I thought about this possible solution:

1- $ set cpuid instruction output to X

2- $ run malware

3- when malware calls cpuid, it will see the flags of a non-virtualized environment and will execute malign code

Is there a command that does item 1? Or is there any other way that I can accomplish this without changing the KVM config from the host?

Answer 1

The CPUID returned value need to be store somewhere before being check against some known virtualization CPUID value.

It's hard to change your "hardware" sandbox CPUID value, but you can always fool the malware by editing the CPUID that your system is returning.

In a disassembler, try to locate where the cpuid instruction is used. You should see something like:

 xor    eax, eax
 mov    eax,0x40000000
 cpuid
 cmp ecx,0x4D566572
 jne <somewhere_else>

The cpuid syscall description is the following:

Returns processor identification and feature information to the EAX, EBX, ECX, and EDX registers, according to the input value entered initially in the EAX register.

In the above code snippet, the cpuid instruction is initialize with the AEX argument = "0x40000000", witch will ask to return the "Hypervisor brand" of your system.

Then, after the cpuid syscall, the ECX register's value is checked against "0x4D566572", which is a VMware related CPUID value.

In order to bypass this verification, set a breakpoint right after the cpuid instruction, and edit the registers as you want in to simulate a "non-virtual" environment.

You can also patch the malicious binary by replacing the cpuid code by some NOPs. This will completely remove the cpuid check.

Or you can edit the conditional jump that follow the cpuid value comparison, and make it useless.

Answer 2

CPUID values are stored in a model specific register (MSR) platforms.

Reading and writing to these registers is handled by the rdmsr and wrmsr instructions, respectively. As these are privileged instructions, they can be executed only by the operating system. Use of the Linux msr kernel module creates a pseudo-file /dev/cpu/xID/msr (with a unique xID for each processor or processor core). A user with permissions to read and/or write to this file can use the file I/O API to access these registers.

Alternate example: VC++ __readmsr Generates the rdmsr instruction, which reads the model-specific register specified by register and returns its value, but the function is only available in kernel mode, and the routine is only available as an intrinsic.