Frequently asked questions

An open-source fork of Oracle VirtualBox 7.2 OSE focused on privacy-audit research. It makes every hardware-identity signal commercial software and malware read from the host — CPUID brand, SMBIOS/DMI tables, ACPI OEM IDs, disk model and serial, NIC OUI — a visible, per-VM Settings toggle you can document and reproduce. GPL v3, Windows x64, no telemetry.

A shallow fork. OpenHuizeBox adds a Realistic Hardware Identity groupbox across five Settings tabs, an audit menu, a rebranded installer, and a project-CA-signed kernel driver. It does not patch the VMM core — no RDTSC smoothing, SIDT/SGDT redirection, MSR masking or SUPDRV tampering. Those are out-of-reach on docs/DETECTOR_COVERAGE.md.

No, and the project will not accept contributions that move in that direction. The four intended-use categories (authorised privacy-audit research, malware analysis on samples you're licensed to possess, teaching, compliance reproduction) and the explicit out-of-scope list are on /governance.html.

Privacy researchers, compliance auditors, malware analysts, educators. Anyone documenting what a piece of software profiles about its host, under legal authority to do so on hardware they own or are contracted for.

Windows x64 hosts: Windows 10 22H2 or newer, Windows 11. Guest OS support matches Oracle VirtualBox 7.2. Linux/macOS hosts are post-1.0 and not currently in development.

Yes — the stock Oracle VBoxSup.sys is required for VMs to power on. The OpenHuizeBox installer generates a self-signed RSA CA, signs the driver and every ring-0 module with it, installs the CA into LocalMachine\Root + TrustedPublisher, enables Windows test-signing, and registers the service. A reboot is required. An EV-cert / Microsoft-attested path is planned for 0.5.0.

No. The installer doesn't register with any backend, submits no hardware IDs, and doesn't check for updates. Release checking is opt-in and fetches a single static JSON. Crash reporting is opt-in and manual. Full disclosure on /privacy.html.

On a reference Dell-OptiPlex profile at L1+L2: Pafish ~53%→~88%, Al-Khaser ~61%→~85%, VMAware ~58%→~88%, InviZzzible ~22%→~92%. The remaining 5–8% needs VMM-level counter-measures we deliberately don't ship. Numbers and methodology on TESTING.md §6.

Yes. Items marked [ ] in docs/ROADMAP.md and 🔴/🟡 in TESTING.md are open. Start at DEVELOPING.md. Every PR declares which audit layer (L1/L2/L3) and which intended-use category it serves.

No. No sponsor, no paid contractors, no support SLAs. Response-time expectations are best-effort and published on /support.html. The project is a research tool, not a product.

OpenHuizeBox is a GPL v3 derivative of Oracle VirtualBox OSE. Oracle copyright headers in individual source files are preserved verbatim. The project is not affiliated with or endorsed by Oracle. "VirtualBox" and "Oracle" are trademarks of Oracle Corporation.