Detecting Virtual Machine Environments (VMEs) is the purpose of which of the following pieces of software?

The correct answer is A. Red Pill. To detect a virtual machine, an attacker has numerous options. There are several categories of local VME detection used today. One method includes looking for VME artifacts in memory, which is a technique used by Joanna Rutkowska's Red Pill to look for a shifted Interrupt Descrip

Malware Analysis & Advanced Persistent Threats

Question

Options

ARed Pill
BWhite Pill
CGreen Pill
DBlack Pill

How the community answered

(26 responses)

A
88% (23)
B
4% (1)
D
8% (2)

Explanation

To detect a virtual machine, an attacker has numerous options. There are several categories of local VME detection used today. One method includes looking for VME artifacts in memory, which is a technique used by Joanna Rutkowska's Red Pill to look for a shifted Interrupt Descriptor Table, a critical data structure in the operating system.

Topics

#VM detection#Red Pill#anti-analysis#malware evasion

Community Discussion

No community discussion yet for this question.

Full GCIH Practice