Comments on: Virtual Machine Detection http://bprasetio.wordpress.com/2008/04/29/virtual-machine-detection/ Exploring the Possibilities Thu, 05 Nov 2009 02:16:28 +0000 http://wordpress.com/ hourly 1 By: Marshall Fryman http://bprasetio.wordpress.com/2008/04/29/virtual-machine-detection/#comment-415 Marshall Fryman Tue, 06 May 2008 20:26:06 +0000 http://blog.bprasetio.or.id/2008/04/29/virtual-machine-detection/#comment-415 np, let me know if you need anything. m np, let me know if you need anything.

m

]]> By: bprasetio http://bprasetio.wordpress.com/2008/04/29/virtual-machine-detection/#comment-414 bprasetio Tue, 06 May 2008 02:38:08 +0000 http://blog.bprasetio.or.id/2008/04/29/virtual-machine-detection/#comment-414 Thank you for pointing me to the article, first I have to get Parallels and others described in the article. I think it will be a lot of funs (and stresses??) about detecting many virtual machines. :D Thank you for pointing me to the article, first I have to get Parallels and others described in the article. I think it will be a lot of funs (and stresses??) about detecting many virtual machines. :D

]]> By: Marshall Fryman http://bprasetio.wordpress.com/2008/04/29/virtual-machine-detection/#comment-413 Marshall Fryman Mon, 05 May 2008 16:05:53 +0000 http://blog.bprasetio.or.id/2008/04/29/virtual-machine-detection/#comment-413 Do you have a Parallels install? I found a security researcher who claimed that you could detect Parallels using an interrupt. I haven't found anyone who has shown specifically how the call works (or even anyone else who documents that this exists). Since I really don't do asm very well, I haven't been able to decide what xxxxx should be. Well, that plus I don't have a Parallels install. :) The article is here : http://www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf (pages 5 & 6). Any chance you grok asm enough to decipher what should be passed ? Do you have a Parallels install? I found a security researcher who claimed that you could detect Parallels using an interrupt. I haven’t found anyone who has shown specifically how the call works (or even anyone else who documents that this exists). Since I really don’t do asm very well, I haven’t been able to decide what xxxxx should be. Well, that plus I don’t have a Parallels install. :)

The article is here : http://www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf (pages 5 & 6). Any chance you grok asm enough to decipher what should be passed ?

]]>