qemu-spoof: seed-driven per-VM hardware-identity anti-detection for pve-qemu

2026-06-11 17:34:09 +03:00
commit 06463ee65c
33 changed files with 1788 additions and 0 deletions
@@ -0,0 +1,41 @@
+qemu-spoof: route ACPI table header identity through the spoof module
+
+acpi_table_begin(): OEM id / OEM table id / creator id now come from
+spoof_acpi_*(); build_fadt(): blank the "QEMU" hypervisor-vendor when spoofing.
+All inert (return the stock default) unless a spoof-seed is set.
+diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
+index 4b37405..8bc3f4d 100644
+--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
+@@ -20,6 +20,7 @@
+  */
+ 
+ #include "qemu/osdep.h"
+#include "hw/misc/spoof.h"
+ #include <glib/gprintf.h>
+ #include "hw/acpi/aml-build.h"
+ #include "hw/acpi/acpi.h"
+@@ -1725,11 +1726,11 @@ void acpi_table_begin(AcpiTable *desc, GArray *array)
+     build_append_int_noprefix(array, 0, 4); /* Length */
+     build_append_int_noprefix(array, desc->rev, 1); /* Revision */
+     build_append_int_noprefix(array, 0, 1); /* Checksum */
+-    build_append_padded_str(array, desc->oem_id, 6, '\0'); /* OEMID */
+    build_append_padded_str(array, spoof_acpi_oem_id(desc->oem_id), 6, '\0'); /* OEMID */
+     /* OEM Table ID */
+-    build_append_padded_str(array, desc->oem_table_id, 8, '\0');
+    build_append_padded_str(array, spoof_acpi_oem_table_id(desc->oem_table_id), 8, '\0');
+     build_append_int_noprefix(array, 1, 4); /* OEM Revision */
+-    g_array_append_vals(array, ACPI_BUILD_APPNAME8, 4); /* Creator ID */
+    g_array_append_vals(array, spoof_acpi_creator_id(ACPI_BUILD_APPNAME8), 4); /* Creator ID */
+     build_append_int_noprefix(array, 1, 4); /* Creator Revision */
+ }
+ 
+@@ -2370,7 +2371,7 @@ void build_fadt(GArray *tbl, BIOSLinker *linker, const AcpiFadtData *f,
+     }
+ 
+     /* Hypervisor Vendor Identity */
+-    build_append_padded_str(tbl, "QEMU", 8, '\0');
+    build_append_padded_str(tbl, spoof_enabled() ? "" : "QEMU", 8, '\0');
+ 
+     /* TODO: extra fields need to be added to support revisions above rev6 */
+     assert(f->rev == 6);