rdtsc compensation for cpuid call

[igor_ver]

CPUID inside VirtualBox takes around 6000-8000 cycles while on hardware it takes 100-200. Is there any way, a settings perhaps that can just compensate value returned by RDTSC to make it seem like cpuid took less cycles than it actually did?

[michaln]

What problem would that solve?

[igor_ver]

It would help pass VMProtect check for execution inside VM.

[socratis]

Are you seriously asking for a method to bypass legitimate software protection mechanisms?

[igor_ver]

Well, yes. What if a malware use this trick? Or what if a malware is protected by VMProtect?

[socratis]

There are a lot of techniques to identify if a program runs in a virtual machine or not. Even if you get that fixed (which I don't think you can), you're going to be facing more detection techniques.

A malware protected by a legitimate protection software? That would be a first...

[michaln]

It would help pass VMProtect check for execution inside VM.

If you're asking for software that doesn't refuse to run in a VM, you need to ask the vendor of that software, not Oracle.

[SamASR]

Found this: github . com / vektort13 / antiRTSC

The commands executed:

VBoxManage setextradata "mage.dev" VBoxInternal/TM/TSCMode RealTSCOffset
VBoxManage setextradata "mage.dev" VBoxInternal/CPUM/SSE4.1 1
VBoxManage setextradata "mage.dev" VBoxInternal/CPUM/SSE4.2 1

Hope this helps someone