I wonder how feasible it is to remove such fingerprints - find a way to make the VM be functionally indistinguishable from the host.
At that point, it seems to me that there isn't much left to distinguish the virtual machine from the physical. Behavioral properties of the CPU? Anyway, that's what I meant when I said it seems like after a certain point, it becomes impossible to tell the difference.
EDIT: based on the link above, it looks like current state-of-the-art doesn't go far beyond making sure names and common virtualbox performance shortcuts aren't present. https://github.com/hfiref0x/VBoxHardenedLoader/blob/master/B...
What else is there that could possibly indicate virtualization? Available instruction sets? Strange limitations of the given CPU? (e.g., the cpu presents itself as some Intel chip that's known to have 4 cores, but there's only 2 available)
[0] https://secret.club/2020/04/13/how-anti-cheats-detect-system...
- You run into performance issues - virtualization's speed depends on paravirtualized drivers, which are readily identifiable (e.g. "virtio" disk controller). These can be emulated instead of paravirtualized but will cost performance. Windows drivers are signed so you can't just change names of things.
- Chipsets - some are often emulated by VMs. For example, if you are running a system in 2020 and are using an Intel 440BX chipset, it's probably a VM.