A new mechanism for preventing HVM-Aware Malware

Hardware-based Virtual Machine (HVM), for its high efficiency and good simulation, has played an important role in the course of building honeypots and debuggers. But some malwares called HVM-Aware Malware can identify the virtualized environment which they are processing in and then stop themselves to avoid being analysed. One of the most efficient HVM-Aware technologies is called "Counter-Based Detection". It\´s a very risky challenge to HVM-based honeypots and debuggers. In this paper a new mechanism based on operation interception and return value distortion is presented to solve this problem, it can prevent HVM from being identified so that it can protect honeypots and debuggers very well. At last some experiments demonstrate the effectiveness and practicality of the mechanism.