Re: Generically Determining the Prescence of Virtual Machines

[Jeff Epler <jepler@xxxxxxxxxxxxxx>]

I ran the code at the end of 'vm.pdf' inside qemu 0.8.0 running a debian
linux system.  The host system was a single core amd64 machine running
fedora linux.  I believe that 'kqemu' acceleration may be in use, but
I'm not sure.

I modified the source code to use gcc-style inline assembly, e.g.,
    asm("sidt %0" : "=m" (m));

Over 1000 runs, it consistently reported a native system, even though it
is running under emulation.

I don't feel that I was able to follow the paper, but I don't understand
why this is claimed to detect (any) virtualization, as opposed to
detecting some detail of vmware and virtual pc's emulation software.
The results I got with qemu reinforce this impression.

Jeff
PS here's the output from the last run of the detection program:
(transcribed, so there may be errors)
(none):/mnt# ./a.out
IDTR: ff 07 00 c0 44 c0
GDTR: ff 00 80 d9 48 c0
LDTR: 88 00 80 d9 48 c0
Native machine detected.