Re: How do I find out if my dedicated server is a VM

<johnwallace4@xxxxxxxxxxx> wrote in message news:b5cc9058-bd84-46c9-b0b6-1c011e5a1da0@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
On Nov 25, 9:35 am, Johnny Billquist <b...@xxxxxxxxxxxx> wrote:
Bill Gunshannon skrev:



> In article <3MudnVJvRJG3-7rUnZ2dnUVZ_uydn...@xxxxxxxxxxxxx>,
> "Michael D. Ober" <obermd.@.alum.mit.edu.nospam.> writes:
>> "Bill Gunshannon" <billg...@xxxxxxxxxxx> wrote in message
>>news:6onqloF4jh9vU2@xxxxxxxxxxxxxxxxxxxxx
>>> In article
>> Actually you can tell if it's a VM simply by looking at the devices.
>> Properly set up VMs (both MS and VMWare) use special device drivers to
>> improve performance. You just have to look for these device drivers.
>> Commonly replaced drivers are display adapters, disk drives, >> keyboards,
>> NICs, and mice. Of course, not all VMs will have all of these >> replaced, but
>> if you find even one with a VM or "Virtual" in the name, you can be >> pretty
>> sure you're running in a Virtual Machine. For instance, assuming MS >> Windows
>> clients, MS Virtual PC hard drives are "Virtual HD" and VMWare 1.07 >> clients
>> have VMWare Virtual drives, display adapters, and network adapters.

> Don't kow if that is the case all the time. I have worked with a > number of
> virtualization systems. I have seen emulated Tulip Ethernet, IDE and > SATA
> disks and other hardware that gives no indication of emulated hardware.
> And then there is E11. I am fairly certain that if you are not in the
> room with it you could not tell the emulation from the real thing. All
> devices appear to be real hardware. I am sure as time progresses this > will
> in fact become the new Turing Test. The virtualization packages will
> move more and more to indistinguishability from real hardware.

It is actually very easy to tell if you're running on real hardware or a
simulation, but for normal life it don't matter.
The easiest way to tell is to write a program that tries to analyze cache
behavior. This has very much to do with timing, and emulated hardware don't
extend to cache behavior. It would also be very difficult to emulate at that
lever, not to mention very slow.
And for normal life, it's not relevant either.
But it's a very telling giveaway.

With a good cache behavior analyze program you can tell cache size, cache line
size, cache associativity, page size, TLB size, TLB associativity and I can't
remember what more. Oh yeah, you'll also see if you have several levels of
cache, of course. :-)

So no, it's not likely to become anything like a turing test thing about this.
It's easy to tell, if you just want to. And to try and hide info at that level
will just cost, with the only gain being to fool such analysers. And with a
performance hit of several hundred percent, who would want it?

Johnny

--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: b...@xxxxxxxxxx || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol

Continuing the philosophical discussion then, given that I like the
sound of that cache idea in principle...

Are you doing this analysis using strictly user mode code?

If it is purely from user mode: isn't it going to be tricky (if not
impossible) to reliably work out cache-related properties in the
presence of other unknown uncontrollable activities on the system,
even on what we call a "real" machine? And in a VM, if it's pure user
mode code hosted and guesting on the same architecture (eg x86 guest
on x86 host, rather than VAX code on x86 host), surely it is executed
not emulated????

If you need kernel mode code for this, and your guest VM account
doesn't permit it, then what? If your guest account has got kernel
mode access anyway, there might be easier ways (albeit perhaps less
interesting).


You can get the list of device drivers from user mode. You may not be able to change them, but you can enumerate them.

Mike.


.

Relevant Pages

  • Re: How do I find out if my dedicated server is a VM
    ... room with it you could not tell the emulation from the real thing. ... The virtualization packages will ... move more and more to indistinguishability from real hardware. ... This has very much to do with timing, and emulated hardware don't extend to cache behavior. ...
    (comp.os.vms)
  • Re: How do I find out if my dedicated server is a VM
    ... You just have to look for these device drivers. ... The virtualization packages will ... move more and more to indistinguishability from real hardware. ... The easiest way to tell is to write a program that tries to analyze cache ...
    (comp.os.vms)
  • Re: Cached IO Synchronization Question
    ... The read path does not take the page lock. ... It also does an atomic copy from user mode into the ... page cache page. ... single processor, not across processors. ...
    (Linux-Kernel)
  • Re: FlushFileBuffers in non-privileged user mode
    ... H> that need to flush file cache before the software end. ... In Windows 2000 and XP user mode, if the working device that I am ... they have data corruption problem even though OS ...
    (microsoft.public.win32.programmer.kernel)
  • Re: Instruction Cache Lockdown for ARM926EJ-S
    ... cahce and 16KB of data cahce. ... We want to lock some portion of the code in the cache permanently so ... cache locking will not work in user mode. ...
    (comp.sys.arm)