RE: Generically Determining the Prescence of Virtual Machines

["Thomas Guyot-Sionnest" <Thomas () zango com>]

I suggest you make sure you're using the accelerator mode, which should put
qemu in "Virtualization" mode.

If you're doing full CPU emulation then the result you get was correct: you
weren't doing any virtualization inside qemu.

Thomas

> -----Original Message-----
> From: Jeff Epler [mailto:jepler () unpythonic net] 
> Sent: March 18, 2006 12:01
> To: valsmith () metasploit com
> Cc: bugtraq () securityfocus com
> Subject: Re: Generically Determining the Prescence of Virtual Machines
>
> I ran the code at the end of 'vm.pdf' inside qemu 0.8.0 
> running a debian
> linux system.  The host system was a single core amd64 machine running
> fedora linux.  I believe that 'kqemu' acceleration may be in use, but
> I'm not sure.
>
> I modified the source code to use gcc-style inline assembly, e.g.,
>     asm("sidt %0" : "=m" (m));
>
> Over 1000 runs, it consistently reported a native system, 
> even though it
> is running under emulation.
>
> I don't feel that I was able to follow the paper, but I don't 
> understand
> why this is claimed to detect (any) virtualization, as opposed to
> detecting some detail of vmware and virtual pc's emulation software.
> The results I got with qemu reinforce this impression.
>
> Jeff
> PS here's the output from the last run of the detection program:
> (transcribed, so there may be errors)
> (none):/mnt# ./a.out
> IDTR: ff 07 00 c0 44 c0
> GDTR: ff 00 80 d9 48 c0
> LDTR: 88 00 80 d9 48 c0
> Native machine detected.

Attachment: smime.p7s
Description: