Re: VMware hardening or VMX file change to achive similar effect to VMRay.com solution

My VMX file contain data:

cpuid.disable_apicExtRegs = "TRUE"
monitor_control.enable_fullcpuid="TRUE"
cpuid.1.eax = "0---:----:----:----:----:----:----:----"
cpuid.1.ecx = "0---:----:----:----:----:----:----:----"
cpuid.1.edx = "0---:----:----:----:----:----:----:----"
monitor_control.restrict_backdoor = "true" 
monitor_control.disable_directexec = "true"
monitor_control.disable_chksimd = "true"
monitor_control.disable_ntreloc = "true"
monitor_control.disable_selfmod = "true"
monitor_control.disable_reloc = "true"
monitor_control.disable_btinout = "true"
monitor_control.disable_btmemspace = "true"
monitor_control.disable_btpriv = "true"
monitor_control.disable_btseg = "true"
monitor_control.enable_extended_core = "true"
monitor_control.enable_paravirt = "true"
monitor_control.virtual_rdtsc = "false"
isolation.tools.getPtrLocation.disable = "true"
isolation.tools.getVersion.disable = "true"
SMBIOS.reflecthost = "TRUE"
SMBIOS.assettag = "IBM Corporation"
SMBIOS.useShortSerialNumber = "TRUE"

monitor_control.virtual_rdtsc = "false"

This should turn off TSC virtualisation

Unfortunately, it didn't works for me. Pafish still shows red line for Checking the difference between CPU timestamp counters (rdtsc) forcing VM exit. It could be change in some way?

1. HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier 

 

If there's a string that has "VMware" ---> you've found another reason why pafish marks that as not passed.

Note that the port numbers etc.. might be different.

You are right. Do you know how to change / rename / delete information about VMware from data?

For pseudo devices...

Pafish main.c contain:

exec_check("Looking for pseudo devices", &vmware_devices, NULL,           "hi_vmware");