On 02.07.2025 01:45, Petr Beneš wrote:
> From: Petr Beneš <w1benny@gmail.com>
>
> Resubmitting patch from Anton Belousov and addressing review comments
> from Jan: https://old-list-archives.xen.org/archives/html/xen-devel/2022-01/msg00725.html
In which case shouldn't this submission have a version number, explicitly
larger than 1?
Jan
> Original message:
>> SMBIOS tables like 7,8,9,26,27,28 are neccessary to prevent sandbox detection
>> by malware using WMI-queries. New tables can be mapped to memory from binary
>> file specified in "smbios_firmware" parameter of domain configuration.
>> If particular table is absent in binary file, then it will not be mapped to
>> memory. This method works for Windows domains as tables 7,8,9,26,27,28 are not
>> critical for OS boot and runtime. Also if "smbios_firmware" parameter is not
>> provided, these tables will be skipped in write_smbios_tables function.
>
> Further explanation:
> Some malware samples are known to check presence of various hardware components
> (like CPU fan, CPU temperature sensor, etc.) by WMI queries. If these components
> are not present, then malware can assume that it is running in a sandbox and
> will not execute its payload.
>
> This patch will allow security researchers to create a custom SMBIOS
> firmware binary file that contains these tables.
>
> Petr Beneš (3):
> hvmloader: fix code style violations
> hvmloader: fix SMBIOS table length checks
> hvmloader: add new SMBIOS tables (7,8,9,26,27,28)
>
> tools/firmware/hvmloader/smbios.c | 204 ++++++++++++++++++++----
> tools/firmware/hvmloader/smbios_types.h | 83 +++++++++-
> 2 files changed, 254 insertions(+), 33 deletions(-)
>