Bugtraq mailing list archives
Re: Generically Determining the Prescence of Virtual Machines
From: Jeff Epler <jepler () unpythonic net>
Date: Sat, 18 Mar 2006 11:00:47 -0600
I ran the code at the end of 'vm.pdf' inside qemu 0.8.0 running a debian linux system. The host system was a single core amd64 machine running fedora linux. I believe that 'kqemu' acceleration may be in use, but I'm not sure. I modified the source code to use gcc-style inline assembly, e.g., asm("sidt %0" : "=m" (m)); Over 1000 runs, it consistently reported a native system, even though it is running under emulation. I don't feel that I was able to follow the paper, but I don't understand why this is claimed to detect (any) virtualization, as opposed to detecting some detail of vmware and virtual pc's emulation software. The results I got with qemu reinforce this impression. Jeff PS here's the output from the last run of the detection program: (transcribed, so there may be errors) (none):/mnt# ./a.out IDTR: ff 07 00 c0 44 c0 GDTR: ff 00 80 d9 48 c0 LDTR: 88 00 80 d9 48 c0 Native machine detected.
Current thread:
- Generically Determining the Prescence of Virtual Machines valsmith (Mar 17)
- Re: Generically Determining the Prescence of Virtual Machines Jeff Epler (Mar 20)
- RE: Generically Determining the Prescence of Virtual Machines Burton Strauss (Mar 20)
- <Possible follow-ups>
- RE: Generically Determining the Prescence of Virtual Machines Thomas Guyot-Sionnest (Mar 20)