Is it possible to make VirtualBox undetectable in guest OS?

zcld · Post by **zcld** » 18. May 2007, 14:15

Hi,

Recently I've heard from friends about VirtualBox. They say it's a very nice product. The installation base is small, while the speed is amazing. I haven't used it yet, but feel excited about it and would like to have a try.

Before the try, I have some questions to ask. Does anyone know if it's possible to make VirtualBox undetectable in guest OS?
If yes, how? If no, why?
AFAIK, Vmware can be detected in guest OS. What about VirtualBox regarding this aspect?

Thank you.

Technologov · Post by **Technologov** » 18. May 2007, 14:44

VirtualBox can also be detected. Try to use emulator such as Bochs/Qemu to be undetectable.

VirtualBox has the following devices that are detectable:

chipset (Intel chipset with AMD CPU for example)
BIOS
Video card
CD-ROM
Hard Disk

Some devices are undetectable:
Sound card
Network card

Post by **sandervl** » 18. May 2007, 14:58

One way or the other you can detect whether you're running in a VM. That goes for Bochs or QEmu too.

zcld · Post by **zcld** » 24. May 2007, 12:18

Thank you, Technologov and sandervl.

@sandervl:
Could you be more specific? Do you mean it's impossible to have a virtual machine that is undetectable to guest OS?
Although I didn't know if Virtualbox was detectable or not, I originally share the same thought with Technologov, i.e, at least software emulation is undetectable. Do you mean this idea is incorrect?
How is software emulation also detectable? Virtual machines using software emulation can even have a different hardware architecture, for example power pc virtual machine running on intel. It's hard to imagine that virtual machine environment can still be detected. Really curious about that.

Post by **sandervl** » 24. May 2007, 13:03

In theory you can detect virtualization software by looking for gaps in time. Certain operations take much longer and time is lost when switching between guest and host.

As for detecting specific devices in the guest. It seems quite obvious to me the same applies to emulators. That has nothing to do with the host.

With Intel-VT and AMD SVM you can also properly hide the host cpu from the guest.