Change vendor, product and etc. for Red Hat VirtIO SCSI Disk Device

[Nitr0-G]

Hi everyone! I'm working with malware samples, and I'm facing a problem where the viruses detect RedHat's VirtIO and VENDOR ID like 1AF4 (specifically, the Red Hat VirtIO SCSI Disk Device) - how can I change it?

[Nitr0-G]

I Found this:

1. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/build/Driver.Vendor.props#L37
2. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/build/Driver.VZ.props#L62-L65
3. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/build/Driver.VZ.props#L85-L102
4. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/build/Driver.RHEL.props#L60-L80
5. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/build/rhel.ver#L52-L58
6. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/build/vz.ver#L44-L56
7. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/build/vz.ver#L69-L73
8. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/viostor/txtsetup-amd64.oem#L8
9. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/viostor/txtsetup-i386.oem#L8
10. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/viostor/txtsetup.oem#L10-L14
11. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/viostor/viostor.inx#L110-L112
12. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/viostor/virtio_stor.rc#L37-L39
13. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/viostor/virtio_stor.c#L731-L734

From all of this, I was able to figure out, through constant attempts, which variables belong to the controller name:

1. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/build/Driver.RHEL.props#L66-L71

[Nitr0-G]

It seems to be responsible for the name of the disk

1. https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/viostor/virtio_stor.c#L731-L734

[YanVugenfirer]

It is written in the comment of one of the files:

1. Uses RHEL as default vendor.
Set $(Feature_AlwaysDefaultVendor) to false and set $(_VENDOR_) to override.

You can create vendor specific files.