<<< Date Index >>>     <<< Thread Index >>>

RE: Generically Determining the Prescence of Virtual Machines



I suggest you make sure you're using the accelerator mode, which should put
qemu in "Virtualization" mode.

If you're doing full CPU emulation then the result you get was correct: you
weren't doing any virtualization inside qemu.

Thomas

> -----Original Message-----
> From: Jeff Epler [mailto:jepler@xxxxxxxxxxxxxx] 
> Sent: March 18, 2006 12:01
> To: valsmith@xxxxxxxxxxxxxx
> Cc: bugtraq@xxxxxxxxxxxxxxxxx
> Subject: Re: Generically Determining the Prescence of Virtual Machines
> 
> I ran the code at the end of 'vm.pdf' inside qemu 0.8.0 
> running a debian
> linux system.  The host system was a single core amd64 machine running
> fedora linux.  I believe that 'kqemu' acceleration may be in use, but
> I'm not sure.
> 
> I modified the source code to use gcc-style inline assembly, e.g.,
>     asm("sidt %0" : "=m" (m));
> 
> Over 1000 runs, it consistently reported a native system, 
> even though it
> is running under emulation.
> 
> I don't feel that I was able to follow the paper, but I don't 
> understand
> why this is claimed to detect (any) virtualization, as opposed to
> detecting some detail of vmware and virtual pc's emulation software.
> The results I got with qemu reinforce this impression.
> 
> Jeff
> PS here's the output from the last run of the detection program:
> (transcribed, so there may be errors)
> (none):/mnt# ./a.out
> IDTR: ff 07 00 c0 44 c0
> GDTR: ff 00 80 d9 48 c0
> LDTR: 88 00 80 d9 48 c0
> Native machine detected.
> 

Attachment: smime.p7s
Description: S/MIME cryptographic signature