I am trying to analyze a malware in a virtual machine (linux), but it uses the cpuid output to verify if it is in a virtual machine/sandbox, and refuses to run malign code if inside a virtualized environment.
Is it possible to change/fake the output of the cpuid instruction, so that when the malware checks for the cpuid flags, it sees the cpuid of a non-virtualized machine?
I know that I can bypass that by changing the KVM config (like in section 'VM Detection countermeasures' from this tutorial), but I want to know if it is possible to do so from inside the guest machine, without changing the config in the host computer?
I thought about this possible solution:
1- $ set cpuid instruction output to X
2- $ run malware
3- when malware calls cpuid
, it will see the flags of a non-virtualized environment and will execute malign code
Is there a command that does item 1? Or is there any other way that I can accomplish this without changing the KVM config from the host?