How to tell if app runs in virtual PC ?

Hi,

is it somehow possible an application to know whether it runs in a virtual
PC or on a 'normal' physically existing PC ?
What would be the best method to detect a virtual PC ?

thanks

On Fri, 30 Oct 2009 23:29:47 +0200, "Hotmail_H_" <harpo_@hotmail.com>
wrote:

>Hi,
>
>is it somehow possible an application to know whether it runs in a virtual
>PC or on a 'normal' physically existing PC ?
>What would be the best method to detect a virtual PC ?
>

That is actually very difficult, but there are methods that might
work, at least for the majority of cases.
One is to use WMI calls to Windows and read things like the BIOS
name/version, the Disk maker etc.
For example if you ask for Win32_DiskDrive in a VMWare virtual machine
you will get this as Model: VMWare Virtual IDE Hard Drive
Win32_BIOS reports: VMWare + a long string of hex code

This is a clue to the fact that you are running in a virtual machine.

There are also other ways, for example you can get a more direct way
of detection by reading this:
http://www.invisiblethings.org/papers/redpill.html

I used this and made a detection application that properly detects
both VPC2007 and VMWare Workstation guests.

--

Bo Berglund (Sweden)

Hotmail_H_ wrote:

> is it somehow possible an application to know whether it runs in a virtual
> PC or on a 'normal' physically existing PC ?
> What would be the best method to detect a virtual PC ?

Yes, a process can detect if it is running in VirtualPC. While VMs make
good platforms to test untrusted software, some malware can detect they
are running inside a VM, a sandbox, or under reduced permissions (which
are not defined in the OS but instead by other security software, like
GeSWall). They can then choose to remain quiescent to not expose
themselves. So you don't see the pest engage in its activity inside the
VM but once it is outside and on your host OS then its activates. There
isn't a lot of malware that detects if it is running inside a VM but
there is some.

http://taviso.decsystem.org/virtsec.pdf
http://www.seclab.tuwien.ac.at/papers/detection.pdf
http://www.eecs.umich.edu/virtual/papers/king06.pdf

VMs are primarily designed for isolation. They provide good
anti-malware protection when testing unknown software but they are not
perfect protection. Same pretty much goes for all security software.
If the security software completely prohibited the introduction of
malware, the host would be unusable to you as a general-purpose
computing platform.