Groups > comp.os.msdos.programmer > #1400

Re: detecting emulation or console windows

From	CN <qmbmnp3799@pacbell.net>
Newsgroups	alt.os.development, comp.os.msdos.programmer, alt.lang.asm
Subject	Re: detecting emulation or console windows
Date	2014-06-03 18:39 -0700
Organization	A noiseless patient Spider
Message-ID	<lmltd0$cb9$1@dont-email.me> (permalink)
References	<op.xgqwuvss6zenlw@localhost> <6c46281f-f4cf-4dea-af19-096ad8cc6038@googlegroups.com> <op.xgq6omrc6zenlw@localhost> <lmg9hf$qmu$1@dont-email.me> <lmlgg3$qdb$1@dont-email.me>

Cross-posted to 3 groups.

Show all headers | View raw

On 6/3/2014 2:59 PM, James Harris wrote:
> Rod doesn't seem to have responded to this but the info below looks
> promising. Copying to the other two groups.
>
> "CN" <qmbmnp3799@pacbell.net> wrote in message
> news:lmg9hf$qmu$1@dont-email.me...
>> On 5/31/2014 7:03 PM, Rod Pemberton wrote:
>>> On Sat, 31 May 2014 21:31:25 -0400, Alexei A. Frounze
>>> <alexfrunews@gmail.com> wrote:
>>>> On Saturday, May 31, 2014 3:31:33 PM UTC-7, Rod Pemberton wrote:
>>>
>>>>> Do you guys have any pointers on detecting whether or not code
>>>>> is executing in an emulator or in console window?
>>>>
>>>> I'd try looking at timing. Disable interrupts and see how many cycles
>>>> (TSC) and seconds (RTC) certain instructions take when repeated many
>>>> times. See the distribution. If it's got multiple distinct peaks or
>>>> some other oddity, your code is likely running in a virtual
>>>> environment. Power modes/frequency changes in the CPU may complicate
>>>> things, though.
>>
>> As a person working for a company that makes virtualization software, I
>> can say that this is the most sure-fire way of checking for a modern
>> emulator that uses a hardware virtualization technology like VT-x or AMD
>> Pacifica. I don't think any of them bother to adjust guest TSC to hide
>> themselves. Simply use TSC to benchmark an instruction that is always
>> trapped by modern emulators, like CPUID.
>>
>> Now if you wanted to check for military-grade malicious hypervisors that
>> people say come planted into the BIOS of Chinese-made motherboards with
>> the purpose of spying on us, that's a different story. You'd want to use
>> an external timer rather than TSC, because the TSC is likely compromised.
>>
>> The same test probably won't work for older stuff like DOS emulators and
>> DPMI. They probably don't need, don't bother or don't have the capability
>> to trap CPUID. They must trap something else, though. Not being very
>> familiar with it, I'm sure there's something that will work well just for
>> that specific subclass, maybe like SGDT. I think you should split the task
>> of detecting old emulators from the task of detecting modern
>> virtualization software, due to the difference in what is emulated.
>>
>
> So comparing two time sources: TSC and a real-world timer like the PC's PIT
> ought to give good, i.e. fairly reliable, results. The question is what
> operation or operations to time.

Inside a virtual machine, the PIT is almost surely virtualized as well. 
It may or may not work the way you want.

You can just use common sense. Normally, CPUID or any other common 
instruction that doesn't talk to external devices takes a few hundred 
TSC cycles max. If it's trapped, it'll go into thousands. Just the 
VM-exit/VM-entry sequence takes more than (or at least close to) a 
thousand cycles on any modern Intel CPU.

Thread

detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-05-31 18:31 -0400
  Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-05-31 19:59 -0400
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-05-31 20:54 -0400
      Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-05-31 21:43 -0400
        Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-01 22:48 +0100
          Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:46 -0400
            Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-02 06:15 +0100
              Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 03:21 -0400
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 03:32 -0400
                Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-02 09:51 +0100
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 09:27 -0400
                Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-02 17:05 +0100
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 19:25 -0400
                Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-04 07:55 +0100
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-04 03:20 -0400
      Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-06-01 14:03 -0400
        Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:53 -0400
          Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-06-02 15:55 -0400
            Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 19:27 -0400
              Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-06-03 17:00 -0400
  Re: detecting emulation or console windows Sjouke Burry <burrynulnulfour@ppllaanneett.nnll> - 2014-06-01 06:25 +0200
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-01 02:50 -0400
  Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-01 07:53 +0100
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-01 04:53 -0400
      Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-01 20:57 +0100
        Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:48 -0400
      Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 03:20 -0400
  Re: detecting emulation or console windows JJ <duh@nah.meh> - 2014-06-02 03:43 +0700
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:34 -0400
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-03 07:06 -0400
      Re: detecting emulation or console windows JJ <duh@nah.meh> - 2014-06-03 20:25 +0700
  Re: detecting emulation or console windows "wolfgang kern" <nowhere@never.at> - 2014-06-03 20:52 +0200
  Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-03 22:59 +0100
    Re: detecting emulation or console windows CN <qmbmnp3799@pacbell.net> - 2014-06-03 18:39 -0700
      Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-04 07:06 +0100
        Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-04 03:07 -0400
          Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-04 09:16 +0100
  Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-03 23:00 +0100
  Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-10 17:37 -0400
    Re: detecting emulation or console windows Wildman <best_lay@yahoo.com> - 2014-06-11 00:37 +0000
      Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-07-27 12:11 -0400

csiph-web