Detecting Microsoft virtual machines

re: Detecting Microsoft virtual machines

AC — Fri, 28 Oct 2005 08:53:43 GMT

Minor correction -- I think you meant "tenets", not "tenants", in this sentence:

"One of the key tenants of virtual machine design..."

re: Detecting Microsoft virtual machines

Virtual PC Guy — Fri, 28 Oct 2005 09:05:45 GMT

Thanks - you are right (I have fixed it up).

Cheers,
Ben

re: Detecting Microsoft virtual machines

gedoe — Fri, 28 Oct 2005 09:52:48 GMT

Actually I hopen Microsoft never decides to create a motherboard now as this might mess up detection :) .

I hink it would have been nice to have the motherboard echo Microsoft Virtual PC somewhere as this assures that it will not collide with other activities Microsoft might consider (Microsoft corporation is quite big I guess)

re: Detecting Microsoft virtual machines

zzz — Fri, 28 Oct 2005 10:53:41 GMT

How can that be changed, so that for example if the VM was running as a honeypot, the bad guy couldn't use that script to determine if it the machine, for example, was a microsoft honeypot for trapping spammers and decide not to try spamming?

re: Detecting Microsoft virtual machines

Alessandro Perilli — Fri, 28 Oct 2005 12:14:38 GMT

Ben,
thank you for this new script.

I posted during 2004 other three methods you could check:

1) http://www.virtualization.info/2004/03/how-application-can-detect-if-is.html

2) http://www.virtualization.info/2004/03/how-application-can-detect-if-is_17.html

3) http://www.virtualization.info/2004/11/how-to-detect-virtual-machines.html

HTH
Alessandro

re: Detecting Microsoft virtual machines

mikeb — Fri, 28 Oct 2005 22:14:31 GMT

>> One of the key tenets of virtual machine design is to ensure that the virtual machine is completely isolated from other virtual machines and from the host operating system. This means that there should be nothing that can be done inside of a virtual machine to adversely affect the host or other virtual machines. <<

However, we have the example of the 'Additions' or 'Tools' that show that interaction between the host & guest is in fact possible. It's clear that the mechanisms used by the Additions could be used for evil purposes.

But, VMs would be so very much less nice to use without them (ah, those damn tradeoffs!).

I'd actually like it if the mechanisms for host/guest interaction used by the additions were documented, because I think that many interesting and useful technologies could be built on them.

If this were done (and even if not), there might be a need for the VM implementation to be able to configure that the communication mechanism be disabled (which would also disable the additions) in the interest of making the host secure from the guest.

re: Detecting Microsoft virtual machines

Patrick M. Slattery — Sat, 29 Oct 2005 02:11:17 GMT

Here's a portion of a CMD script that I use to detect if it's running in a VM. It uses DEVCON, a command line version of Device Manager. It's really useful for detecting exactly what hardware is in a system.

REM Virtual Server and Virtual PC both have the device named "Virtual HD" for their IDE disks
devcon hwids * | xgrep -c "Virtual HD"
IF %errorlevel% EQU 0 CALL VMAdditions.Exe

REM In the case the disk is SCSI then the disk device is named differently so we need to check for that too.
devcon hwids * | xgrep -c "MS Virtual SCSI Disk Device"
IF %errorlevel% EQU 0 CALL VMAdditions.exe

re: Detecting Microsoft virtual machines

Norman Diamond — Mon, 31 Oct 2005 05:13:19 GMT

> Yes - there are various methods out there.
> They usually rely on detecting common
> shortcuts taken by today's virtualization
> offerings. But just because these shortcuts
> are common doesn't mean that they are
> necessary - nor does it mean that they will
> always be reliable

Not always reliable, of course. But they are necessary. Microsoft doesn't make all VMs. Once upon a time they didn't even make yours.

re: Detecting Microsoft virtual machines

mike — Tue, 01 Nov 2005 21:09:22 GMT

Interesting - so this is how Virtual PC knows that isn't not supposed to run one virtual machine inside another?

Is there any way to hack this so that you can do that, nevermind the performance and possible stability issues that might arise?

re: Detecting Microsoft virtual machines

SJ — Wed, 02 Nov 2005 06:43:21 GMT

Ah, I was worried for a while there.

Ben's blog just wouldn't be the same without Norman's negative posts, and its been a while.