Re: Generically Determining the Prescence of Virtual Machines

[Joanna Rutkowska <joanna () invisiblethings org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

listlurker () doctorunix com wrote:
> Quoting valsmith <valsmith () metasploit com>:
>
> > At OffensiveComputing we were looking at ways to detect virtual
> > machines and
> > had found and discarded many unsophisticated methods such as looking for
>
> <snip>
>
> I read your paper with interest.   At the risk of being obtuse, why not
> query the list of adapters connected to the PCI bus?  They are all fake
> and are very predictable in how they behave and identify themselves
> according to each release of VMware.  For example, the video card is
> always set to a mfg id of "vmware" and does not seem to be changeable.
It will work, but is just not as generic and funny as the other
techniques IMHO... And it's all about having some fun from life, isn't
it? ;)

j.
-----BEGIN PGP SIGNATURE-----

iD8DBQFEHzgRORdkotfEW84RAiTYAJ0es4rQQ21sDv/dNBZQ2VeImqiraACePsNO
Rom/Du7osgRIqY4yy6r5d/k=
=gNhX
-----END PGP SIGNATURE-----