Is There an Os Command I Can Run to Determine If Running Inside a Xen Based Virtual Machine

Is there an OS command I can run to determine if running inside a Xen based virtual machine

Dmesg may give some hints from the kernel message buffer, here is output on a virtualized Ubuntu instance from Slicehost:

bvm@qdbp:~$ sudo dmesg | grep Xen
[    0.000000]  Xen: 0000000000000000 - 00000000000a0000 (usable)
[    0.000000]  Xen: 00000000000a0000 - 0000000000100000 (reserved)
[    0.000000]  Xen: 0000000000100000 - 0000000010000000 (usable)
[    0.000000] Booting paravirtualized kernel on Xen
[    0.000000] Xen version: 3.1.2-rc1
[    0.000000] Xen: using vcpu_info placement
[    0.000000] Xen: using vcpuop timer interface
[    0.000000] installing Xen timer for CPU 0
[    0.021223] installing Xen timer for CPU 1
[    0.046157] installing Xen timer for CPU 2
[    0.046157] installing Xen timer for CPU 3
[    0.265880] Initialising Xen virtual ethernet driver.

Detect virtualized OS from an application?

Have you heard about blue pill, red pill?. It's a technique used to see if you are running inside a virtual machine or not. The origin of the term stems from the matrix movie where Neo is offered a blue or a red pill (to stay inside the matrix = blue, or to enter the 'real' world = red).

The following is some code that will detect whether you are running inside 'the matrix' or not:

(code borrowed from this site which also contains some nice information about the topic at hand):

 int swallow_redpill () {
   unsigned char m[2+4], rpill[] = "\x0f\x01\x0d\x00\x00\x00\x00\xc3";
   *((unsigned*)&rpill[3]) = (unsigned)m;
   ((void(*)())&rpill)();
   return (m[5]>0xd0) ? 1 : 0;
 } 

The function will return 1 when you are running inside a virutal machine, and 0 otherwise.

How to detect if my application is running in a virtual machine?

According to Virtual PC Guy's blog post "Detecting Microsoft virtual machines", you can use WMI to check the manufacturer of the motherboard. In PowerShell:

 (gwmi Win32_BaseBoard).Manufacturer -eq "Microsoft Corporation"

Determine when running in a virtual machine

I wrote a series of articles last year on this, with source code. VMware and Wine detection are here. Virtual PC is here. All three of these have pretty iron-clad detection because there are documented callbacks to the hypervisor (in the case of Wine, an extension to a standard DLL). I put up an untested VirtualBox detector (don't have it installed to test with) in the comment section. Parallels might be detectable using a callback also but I don't have it installed. The link for the documentation (which is poor since it's from a security researcher focusing on exploits) but located here if you have it installed and are interested. There's also a PPT here that has some information on detecting Sandbox, Bochs, and Xen. Not a lot of code in it but it might give you a starting point if you have to detect those.

How to identify that you're running under a VM?

A lot of the research on this is dedicated to detecting so-called "blue pill" attacks, that is, a malicious hypervisor that is actively attempting to evade detection.

The classic trick to detect a VM is to populate the ITLB, run an instruction that must be virtualized (which necessarily clears out such processor state when it gives control to the hypervisor), then run some more code to detect if the ITLB is still populated. The first paper on it is located here, and a rather colorful explanation from a researcher's blog and alternative Wayback Machine link to the blog article (images broken).

Bottom line from discussions on this is that there is always a way to detect a malicious hypervisor, and it's much simpler to detect one that isn't trying to hide.

How to make sure a xen DomU is HVM or PV

Run

virsh edit VM_NAME

Then look for the element inside the element. If the value is linux is PVM.

---

Related Topics