vfio-native drops a standard KVM virtual machine's detectability score from 10/85 to 1/85 against common VM detection tools. Built by a developer called sandwich, the tool works by patching the Linux kernel to suppress the hypervisor's self-identification, correcting timing and instruction-execution anomalies, and forcing CPU behavior to match bare metal. It is available now in the AUR for Arch Linux.
The technical argument is in the details. KVM VMs leak their identity through multiple channels: subtle timing differences on obscure instructions, direct hypervisor announcements in CPU flags, and measurable latency gaps. vfio-native attacks all of these vectors simultaneously with kernel patches, not userspace hacks. The gap between 10/85 and 1/85 is the measurable result of closing those channels.
The use cases go well past gaming anti-cheat evasion. Security researchers need malware to behave as it would on production hardware, and many malware samples deliberately go dormant inside detected VMs. Legacy industrial software tied to unsupported operating systems or discontinued hardware creates a second pressure: VM detection that kills a license is a real operational problem. The full write-up explains which specific kernel patches address which detection vectors, and that breakdown alone is worth the read.
[READ ORIGINAL →]