views:

3899

answers:

8

I need to detect whether my application is running within a virtualized OS instance or not.

I've found an article with some useful information on the topic. The same article appears in multiple places, I'm unsure of the original source. VMware implements a particular invalid x86 instruction to return information about itself, while VirtualPC uses a magic number and I/O port with an IN instruction.

This is workable, but appears to be undocumented behavior in both cases. I suppose a future release of VMWare or VirtualPC might change the mechanism. Is there a better way? Is there a supported mechanism for either product?

Similarly, is there a way to detect Xen or VirtualBox?

I'm not concerned about cases where the platform is deliberately trying to hide itself. For example, honeypots use virtualization but sometimes obscure the mechanisms that malware would use to detect it. I don't care that my app would think it is not virtualized in these honeypots, I'm just looking for a "best effort" solution.

The application is mostly Java, though I'm expecting to use native code plus JNI for this particular function. Windows XP/Vista support is most important, though the mechanisms described in the referenced article are generic features of x86 and don't rely on any particular OS facility.

+3  A: 

Under Linux, you can report on /proc/cpuinfo. If it's in VMware, it usually comes-up differently than if it is on bare metal, but not always. Virtuozzo shows a pass-through to the underlying hardware.

warren
+3  A: 

Try by reading the SMBIOS structures, especially the structs with the BIOS information.

In Linux you can use the dmidecode utility to browse the information.

Jonas Gulle
+4  A: 

No. This is impossible to detect with complete accuracy. Some virtualization systems, like QEMU, emulate an entire machine down to the hardware registers. Let's turn this around: what is it you're trying to do? Maybe we can help with that.

Just Some Guy
This is possible. Although you can emulate every instructions a virtual machine executes, the application can still discover the truth by resourse limitation, etc,.
ZelluX
+14  A: 

Have you heard about blue pill, red pill?. It's a technique used to see if you are running inside a virtual machine or not. The origin of the term stems from the matrix movie where Neo is offered a blue or a red pill (to stay inside the matrix = blue, or to enter the 'real' world = red).

The following is some code that will detect wheter you are running inside 'the matrix' or not:
(code borrowed from this site which also contains some nice information about the topic at hand):

 int swallow_redpill () {
   unsigned char m[2+4], rpill[] = "\x0f\x01\x0d\x00\x00\x00\x00\xc3";
   *((unsigned*)&rpill[3]) = (unsigned)m;
   ((void(*)())&rpill)();
   return (m[5]>0xd0) ? 1 : 0;
 }

The function will return 1 when you are running inside a virutal machine, and 0 otherwise.

Actually the topic this question belongs to is really interesting from a security perspective, and some of the best pieces of information can be found there.

Sven
Correction: it will return 1 when you are running inside some of the virtual machines that are available today, on some bits of hardware.
Just Some Guy
yes, it indeed uses the fact that the virtual machine is not an entirely accurate representation of a real pc. If it was then there is no (good) way to detect you are running virtual
Sven
How does this work?
Erik Forbes
@erik: it uses the fact that a virutalised OS is a 'second' OS on a machine. This means that resources needs to be shared. In this code it's the IDTR (Interrupt descriptor table register: check wikipedia) that will be checked against, if it is not in the usual place, then we know that we are virtual
Sven
Just to note. This code fails in Windows XP Pro running in VMWare Fusion (Version 2.0 (116369)) on OSX 10.5
epochwolf
Is there a reason this code is so cryptic? Why isn't just some asm code in a c function?
vanja.
Is there a standard (cross compiler) way of writing asm inside a C function?
Martin Beckett
Note that RedPill and the initial scoopy_doo techniques will return false positives on multi-core CPUs. For example: on a quad-core system running natively, 75% of the time it will tell you it is running in a VM. Google for things like "NoPill" to get additional details.
Stéphane
+6  A: 

I think that going forward, relying on tricks like the broken SIDT virtualization is not really going to help as the hardware plugs all the holes that the weird and messy x86 architecture have left. The best would be to lobby the Vm providers for a standard way to tell that you are on a VM -- at least for the case when the user has explicitly allowed that. But if we assume that we are explicitly allowing the VM to be detected, we can just as well place visible markers in there, right? I would suggest just updating the disk on your VMs with a file telling you that you are on a VM -- a small text file in the root of the file system, for example. Or inspect the MAC of ETH0, and set that to a given known string.

jakobengblom2
Your solution (at the end of your paragraph) won't work if you don't have control over the VM you're running in. =\
Erik Forbes
No, but if you do not have control over the VM, all bets are off anyway. Then it might well deliberately hide. So the question is really why and when and in which situation you want to do this.
jakobengblom2
+2  A: 

I'd like to recommend a paper posted on Usenix HotOS '07, Comptibility is Not Transparency: VMM Detection Myths and Realities, which concludes several techniques to tell whether the application is running in a virtualized environment.

For example, use sidt instruction as redpill does(but this instruction can also be made transparent by dynamic translation), or compare the runtime of cpuid against other non-virtualized instructions.

ZelluX
+1  A: 

While installing the newes Ubuntu I discovered the package called imvirt. Have a look at it at http://micky.ibh.net/~liske/imvirt.html

StarWind Software
+1  A: 

VMware has a Mechanisms to determine if software is running in a VMware virtual machine Knowledge base article which has some source code.

Microsoft also has a page on "Determining If Hypervisor Is Installed". MS spells out this requirement of a hypervisor in the IsVM TEST" section of their "Server Virtualization Validation Test" document

The VMware and MS docs both mention using the CPUID instruction to check the hypervisor-present bit (bit 31 of register ECX)

The RHEL bugtracker has one for "should set ISVM bit (ECX:31) for CPUID leaf 0x00000001" to set bit 31 of register ECX under the Xen kernel.

So without getting into vendor specifics it looks like you could use the CPUID check to know if you're running virtually or not.

David