|
Hyper-V reversing
Thinking about a project I would like to start, but I'm not sure how feasible it is. Also, my environment isn't quite set up right now, so I'm not being lazy, just curious if anyone else here has delved into Hyper-V territory before.
Basically, I want a Hyper-V VM which will get past all VM detections for the purpose of reversing and malware analysis.
The first thing I want to do is modify what CPUID returns. So I'll need to modify WRMSR data. Assuming Hypervisor Code Integrity and Device Guard are off, is disabling DSE enough to be able to run patched Hyper-V binaries?
|