Component
VBoxManage CLI
What problem are you facing?
The string "VBOX" is hardcoded for the first 4 bytes of the table id in many ACPI headers that are generated at runtime. Malware will sometimes query system firmware tables and look for that OemTabId specifically. Currently, there's no way to avoid detection by changing the VM config.
How can we fix this?
We will submit a PR that adds a configuration option for the string.
What alternatives or workarounds exist?
An approach people have used in the past is patching VirtualBox binaries or injecting code at runtime.
Anything else we should know?
No response
Component
VBoxManage CLI
What problem are you facing?
The string "VBOX" is hardcoded for the first 4 bytes of the table id in many ACPI headers that are generated at runtime. Malware will sometimes query system firmware tables and look for that OemTabId specifically. Currently, there's no way to avoid detection by changing the VM config.
How can we fix this?
We will submit a PR that adds a configuration option for the string.
What alternatives or workarounds exist?
An approach people have used in the past is patching VirtualBox binaries or injecting code at runtime.
Anything else we should know?
No response