Are there any virtualization platforms that will create a fake vTPM that isn't actually locked down?

Like, the VM thinks it has a TPM but I can still see and modify bitlocker keys and UEFI variables etc arbitrarily from the host system

vmware vTPMs seem to encrypt all of the config and make it very annoying to mess with things

The entire point of a virtual machine is lying to the guest OS, why can't i lie to it about having a TPM?

@azonenberg Qemu uses an external swtpm process connected over a pipe; The EFI variables are stored in a simple flash file on the host, you can reboot to a fresh VM and tweek them

@penguin42 ok that seems saner. I should check how xcp-ng does it, it nominally supports vTPMs but I haven't tried using one on it yet.

I just know that vTPMs on vmware are a huge pain in the butt

@azonenberg Proxmox even has GUI for that (tested with Windows guests)

@penguin42 (being able to create a windows VM to sandbox MS products without having a TPM at *all* would be nice, but apparently we can't have nice things)

@azonenberg
Is pluto do the job?
(pluto is the vtpm embedded in AMD processor and used heavily by xbox one s/x console)

There also virtualbox that manage vtpm.

@jenesuispersonne as a guess, if it's part of a CPU as a firmware TPM it probably is legitimately locked down and defeats the point of "something I as the outer OS have full access to but that the VM thinks is locked down"

@buherator @azonenberg proxmox is qemu under the hood, last I checked.

@xabean @azonenberg It is! The nice thing is that you can clicky-click the UI the look at `ps` to see how the magic (in this case: vTPM) happens.

@azonenberg you should be able to do that with libvirt /virtmanager and swtpm i used it with --log level=20 so i could extract all the tpm traffic from the log when i was investigating bitlocker. The only thing you wont have is a factory signed EK

@azonenberg bitlocker keys are not stored directly in the tpm but they are encrypted with a key derived from the SRK and PCR registers. I found converting the swtpm log to a pcap and viewing in wireshark helpful. My scripts for that are here https://github.com/en4rab/SPITkey