Groups > comp.os.msdos.programmer > #1398

Re: detecting emulation or console windows

From	"James Harris" <james.harris.1@gmail.com>
Newsgroups	alt.os.development, comp.os.msdos.programmer, alt.lang.asm
Subject	Re: detecting emulation or console windows
Date	2014-06-03 23:00 +0100
Organization	A noiseless patient Spider
Message-ID	<lmlgib$ra7$1@dont-email.me> (permalink)
References	<op.xgqwuvss6zenlw@localhost> <6c46281f-f4cf-4dea-af19-096ad8cc6038@googlegroups.com> <lmgdai$j4m$1@dont-email.me>

Cross-posted to 3 groups.

Show all headers | View raw

Copying this post to the other two groups.

"CN" <qmbmnp3799@pacbell.net> wrote in message 
news:lmgdai$j4m$1@dont-email.me...
> On 5/31/2014 6:31 PM, Alexei A. Frounze wrote:
>
>> Certain instructions (e.g. IN/OUT) always cause a context switch to
>> the hypervisor (AMD Pacifica and Intel VT) and thus take lots of
>> cycles. Btw, there's a bit in CPUID that may tell you that there's a
>> hypervisor running/available.
>
> A funny thing, that bit. Invented by Microsoft and allegedly required for 
> some certifications from MS. They've pretty much stepped on Intel's 
> territory by creating it, and you won't find it documented anywhere, 
> except maybe some obscure help pages at microsoft.com. Intel has it 
> "reserved" in their docs. Some hypervisors do implement it, some don't. I 
> wouldn't rely on it.
>
>> Another thing to try is to exploit unspecified behavior of
>> instructions, e.g. shift and rotate instructions, e.g. when the shift
>> count is large. Several years ago I found that there are typically 3
>> implementations: AMD, Intel non-hyperthreaded CPUs, Intel
>> hyperthreaded CPUs. Things may have changed since (we've got newer
>> CPUs, we've got Intel Atom, etc) and I don't know where VIA and other
>> compatible x86 CPUs stand. Nonetheless, if shifts and rotates are
>> done in software, they are likely to differ in behavior from those
>> executed natively.
>
> Who emulates shift and rotate instructions nowadays? The only things that 
> come to mind are complete emulators that implement every instruction in 
> software, like libx86 that's used in the X server to run video card option 
> ROMs. Pretty much everybody else will directly execute them.
>
>> Yet another thing to look at is executing the same instruction using
>> different memory locations, regular RAM vs memory-mapped device (e.g.
>> video buffer). See, if there's emulation/virtualization that tries to
>> execute code natively whenever possible, but otherwise does it in
>> software, you may be able to spot inconsistency, just like with those
>> shift/rotate instructions.
>
> This does bring about an interesting point that one can't possibly emulate 
> all x86 instructions that access memory, because their name is legion. 
> It's not PowerPC where you could count all of them using fingers on your 
> two hands. And you do have to emulate them when you emulate MMIO. So, find 
> an area of device memory that the emulator must emulate, such as the Local 
> APIC page or the VGA buffer (assuming VGA is emulated). The emulator most 
> likely emulates all MOVs, TESTs, ORs, ANDs, bit ops, etc. But what happens 
> if you do an SSE store to that memory? If you SGDT to that memory? If you 
> SMSW to that memory? Compare that to what happens on bare hardware.

Thread

detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-05-31 18:31 -0400
  Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-05-31 19:59 -0400
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-05-31 20:54 -0400
      Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-05-31 21:43 -0400
        Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-01 22:48 +0100
          Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:46 -0400
            Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-02 06:15 +0100
              Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 03:21 -0400
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 03:32 -0400
                Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-02 09:51 +0100
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 09:27 -0400
                Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-02 17:05 +0100
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 19:25 -0400
                Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-04 07:55 +0100
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-04 03:20 -0400
      Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-06-01 14:03 -0400
        Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:53 -0400
          Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-06-02 15:55 -0400
            Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 19:27 -0400
              Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-06-03 17:00 -0400
  Re: detecting emulation or console windows Sjouke Burry <burrynulnulfour@ppllaanneett.nnll> - 2014-06-01 06:25 +0200
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-01 02:50 -0400
  Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-01 07:53 +0100
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-01 04:53 -0400
      Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-01 20:57 +0100
        Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:48 -0400
      Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 03:20 -0400
  Re: detecting emulation or console windows JJ <duh@nah.meh> - 2014-06-02 03:43 +0700
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:34 -0400
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-03 07:06 -0400
      Re: detecting emulation or console windows JJ <duh@nah.meh> - 2014-06-03 20:25 +0700
  Re: detecting emulation or console windows "wolfgang kern" <nowhere@never.at> - 2014-06-03 20:52 +0200
  Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-03 22:59 +0100
    Re: detecting emulation or console windows CN <qmbmnp3799@pacbell.net> - 2014-06-03 18:39 -0700
      Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-04 07:06 +0100
        Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-04 03:07 -0400
          Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-04 09:16 +0100
  Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-03 23:00 +0100
  Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-10 17:37 -0400
    Re: detecting emulation or console windows Wildman <best_lay@yahoo.com> - 2014-06-11 00:37 +0000
      Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-07-27 12:11 -0400

csiph-web