0

I would like to spoof as much information about my host (Windows 10 x64) on my guest (Windows 10 x64) as possible in VirtualBox. I'm already spoofing the CPU brand string using this. However, applying the same strategy to spoofing CPU frequency (cpuid with 0x16 in EAX) does not seem to do the trick.

I've written a small test program in MSVC++ to print the frequency cpuid reports:

int freq[3];
__asm {
    mov eax, 0x16
    cpuid
    mov freq[0], eax
    mov freq[1], ebx
    mov freq[2], ecx
}

for (int i : { 0, 1, 2 }) {
    std::cout << freq[i] << std::endl;
}

This works as expected and gets spoofed correctly, however, the guest still shows the correct information pretty much everywhere you look, suggesting there is an alternative source for it. Is it possible to identify and potentially spoof this source?

music2myear
  • 41,771
Salvage
  • 101
  • 2

2 Answers2

0

You may modify the entire CPU profile in VirtualBox by a command such as:

VBoxManage modifyvm "<VM name>" --cpu-profile "Intel Core i7-5600U"

See the article Where is the list of supported CPU profiles in VirtualBox?

In the accepted answer, some types were found in the .rdata section of Oracle\VirtualBox\VBoxVMM.dll.

See also the post specifying the processor-type the VM sees.

More advanced settings can be done using the cpuidset parameter of the command VBoxManage modifyvm. See an example here. However, I haven't found documentation for the included commands.

harrymc
  • 480,290
  • From my limited testing it appears that cpu profiles fail to spoof the frequency as well. It appears they're just preset data of what the answer I linked to is doing manually with the CPU brand string, besides being pretty much undocumented. cpuidset also seems to be doing exactly what I'm doing, just via a different (more modern?) command parameter. – Salvage Jul 15 '22 at 00:11
0

On my side, I remove "Nested paging" in "CPU - Hardware acceleration" And it fixed the issue

Bidou
  • 1