Nothing is perfect. Therefore, malware authors use certain characteristics of the virtual machines' implementations in some of the assembly instructions. Examples of these are as follows:
- CPUID hypervisor bit: The CPUID instruction returns information about the CPU and provides a leaf/ID of this information in eax. For leaf 0x01 (eax = 1), the CPUID sets bit 31 to 1, indicating that the operating system is running inside a virtual machine or a hypervisor.
- Virtualization brand: With the CPUID instruction, for some virtualization tools, given eax = 0x40000000, it could return the name of the virtualization tool, such as Microsoft HV or VMware in EBX, EDX, and ECX.
- MMX registers: MMX registers are a set of registers that were introduced by Intel that help speed up graphics calculations. Some virtualization tools don't support them. Some malware or packers use them for unpacking in order to detect or avoid running on a...
