This has a lot to do with the time the article was written. 2008 was a time where ring0 had gone out of fashion (SoftIce dead, nothing usable to replace it), and virtual machines weren't quite that common yet for debugging.
Today you'll find lots of anti-VM tricks, and if you go a few more years back, lots of ring0/SoftIce tricks.
That said, they are what they are, tricks. Good protections can't simply rely on tricks, which simply temporarily inconvenience whoever is not aware of them.
Today you'll find lots of anti-VM tricks, and if you go a few more years back, lots of ring0/SoftIce tricks.
That said, they are what they are, tricks. Good protections can't simply rely on tricks, which simply temporarily inconvenience whoever is not aware of them.