18 ms·
That's interesting - I would have guessed that after a certain point, a VM and a physical computer are indistinguishable from the POV of software running inside
by ColanR 6y ago
That's interesting - I would have guessed that after a certain point, a VM and a physical computer are indistinguishable from the POV of software running inside.
- lights0123 6y agoIt's easy to make the core device indistinguishable. It's the additional hardware that becomes a problem: QEMU/libvirt hardcodes its hard drive model to include the word "QEMU" (although there is an unmerged patch to make that configurable), and although I don't know how graphics work in a VM, it's far easier to create a higher-level graphics device than e.g. emulating Intel graphics.
- ColanR 6y agoI imagine a script could be used with qemu - given that patch you mentioned, which I would love a source for if you have it - to match the names of the virtual devices with names of devices on the physical host. Then there's no way for software to check the device names against a list of VM tools, since it always matches real, physical hardware. At that point, it seems to me that there isn't much left to distinguish the virtual machine from the physical. Behavioral properties of the CPU? Anyway, that's what I meant when I said it seems like after a certain point, it becomes impossible to tell the difference. EDIT: based on the link above, it looks like current state-of-the-art doesn't go far beyond making sure names and common virtualbox performance shortcuts aren't present. https://github.com/hfiref0x/VBoxHardenedLoader/blob/master/Binary/howto.md https://github.com/hfiref0x/VBoxHardenedLoader/blob/master/B...
- WrtCdEvrydy 6y agoThis is a classic computer science question of whether the OS should be aware that it's being virtualized.
- cosmie 6y agoOne of the other telltale signs of a VM are "things VMs can do that physical devices can't" - such as weird screen resolutions (when running in windowed mode rather than full screen), weird CPU core counts, physical ram values that aren't cleanly divisible into DIMM slots, etc.
- ColanR 6y agoGood point. I guess that would be relatively easy to check for programmatically. What else is there that could possibly indicate virtualization? Available instruction sets? Strange limitations of the given CPU? (e.g., the cpu presents itself as some Intel chip that's known to have 4 cores, but there's only 2 available)
- lights0123 6y agopatch is https://lists.gnu.org/archive/html/qemu-devel/2012-03/msg02132.html https://lists.gnu.org/archive/html/qemu-devel/2012-03/msg021...
- ColanR 6y agoThanks!
- userbinator 6y agoI know of malware long ago that would attempt to time how long CPU instructions take, based on the theory that a VM would be significantly slower, but more recently, especially with hardware-assisted virtualisation, the differences have become close to indistinguishable.
- fuyu 6y agoThe video game anti-cheat world has been playing this cat and mouse game for a while. A few months back I saw an interesting article [0] describing some of the detection methods being used. It's fascinating to think about how much effort gets put into this. [0] https://secret.club/2020/04/13/how-anti-cheats-detect-system-emulation.html https://secret.club/2020/04/13/how-anti-cheats-detect-system...