[PDF] Protecting VM Register State with SEV-ES.pdf

What is a VM archive?

Virtual Machine archives The VM is made available as an industry-standard OVA (Open Virtualization Archive) file that contains a compressed, installable version of a virtual machine. You use your virtualization software program to open / import and extract the OVA file.

How do you detect a virtual machine?

detecting the presence of a virtual machine: 1. Look for VME artifacts in processes, file system, and/or registry 2. Look for VME artifacts in memory 3. Look for VME-specific virtual hardware 4. Look for VME-specific processor instructions and capabilities • Covers nearly all of the elements of the virtual machine • Goal: Detect if you are

What is virtual machine memory?

Virtual Machine (VM) memory can be acquired as if the VM were a running bare metal system, or in some cases through the hypervisor itself. For example, VMware can create memory dump files in its own format by taking a snapshot or suspending the virtual machine.

How does VMware create memory dump files?

For example, VMware can create memory dump files in its own format by taking a snapshot or suspending the virtual machine. Depending on the version of VMware and how the files are created, RAM data may be found in files with extensions .vmem, .vmss, or .vmsn.