Values in HKLM\Hardware are reset after reboot about vmcloak HOT 4 CLOSED

Would probably make sense ;)

from vmcloak.

i put .bat into startup dir, and after reboots i have patched machine :)

from vmcloak.

@jbremer sense is that when a malware reload machine, then look that is a VM, also Cuckoo has problems when VM reload during analysis.

@doomedraven is one solution, problem is that a malware search in startup dir or in run or runonce registry keys, then it look .bat and know that is a VM for malware analysis. One step more is that .bat change name random each time, but still a malware can search into .bat content or only when not look .bat run reality.

from vmcloak.

This functionality has since moved to Cuckoo itself, so going to close this issue now. Thanks!

from vmcloak.