[C] Identifying Virtualization - Linux Guest

[Bitshift]

I'm trying to identify if my program is being run in a virtualized environment and I was successfully able to do for VMWare that with the information provided here [1], but I'm unable to do that for Virtual Box - because of this [2].

Are there any identifying factors (besides dmidecode because it requires root access) that I can access to determine if the program is being run in a VM or not?

[1] Mechanisms to determine if software is running in a VMware virtual machine (1009458)
[2] Virtual Box Ticket #12731

[noteirak]

This has nothing to do with the API (or you did not say what) - Moving to "Linux Guests".

[Bitshift]

This has nothing to do with the API (or you did not say what) - Moving to "Linux Guests".

Would the API not help? I thought it fell under the general Programming umbrella for that section.

[noteirak]

Using the API means using a library provided by VirtualBox - either in host or guest - to perform whatever your task is. So having the VirtualBox library and a piece of it doing what you want is a requirement.
The API does not provide such way of checking. What you have at your disposal is VBoxControl which a tool only present in the guest after installing the guest additions for which no API access is provided.
On the other hand you can use it via regular command line (but requires root) to directly know if you are inside a VM or not.

That's why I moved your topic - API is not what you would go for in this particular case. This is especially true since nowadays distros even install the guest additions on real hardware so their presence is not even a real indication that you are in a VM...

All in all, a difficult question which has been asked few times on the forums

[Bitshift]

Using the API means using a library provided by VirtualBox - either in host or guest - to perform whatever your task is. So having the VirtualBox library and a piece of it doing what you want is a requirement.
The API does not provide such way of checking. What you have at your disposal is VBoxControl which a tool only present in the guest after installing the guest additions for which no API access is provided.
On the other hand you can use it via regular command line (but requires root) to directly know if you are inside a VM or not.

That's why I moved your topic - API is not what you would go for in this particular case. This is especially true since nowadays distros even install the guest additions on real hardware so their presence is not even a real indication that you are in a VM...

All in all, a difficult question which has been asked few times on the forums

Alright, no worries. Still need to figure out if VBox does anything special like VMWare =S. I'd even push for setting bit 31 of cpuid to make things compatible across all virtualization platforms.

[noteirak]

I'm no expert about this but often a suggestion has been to do a timing test (whatever that is). I also notice that a specific CPU feature/flag is enabled in the guest : HVP
You might want to check that out, but I'm not sure what it means exactly.

For any proper advise, I leave that to others who might be more knowledgeable than me.

[Bitshift]

Alright no worries. One last question though, do you know if VBox sets any specific flags in /proc/cpuinfo?

These are set for me

fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx lm constant_tsc xtopology nonstop_tsc pni monitor lahf_lm

And HVP isn't there =/

Edit: Just went through all of the flags on host and guest and there were guest flags that weren't set on host.

[Martin]

Why don't you just check for the Vbox video adapter?

[Bitshift]

Why don't you just check for the Vbox video adapter?

How do I check for that/where is it located?

[Martin]

lspci on the command line

[Bitshift]

lspci on the command line

Thanks that really helps, my only gripe is that it isn't in the kernel. It's from the pciutils package and the source for it is thousands of lines of spaghetti code. =/ I guess i'll just have to find a way.

[Bitshift]

I tried to recode lspci by taking the bits and pieces I needed, but that failed so hard so I just wrote a small function to check if VirtualBox is loaded. I'm a little peeved that there wasn't/isn't a better way, but I'll take what I get.

Code: Select all

#include <stdio.h>

VirtualBox_Check(){
  const char command[] = "if ( lspci | grep 'VirtualBox' >/dev/null ); then return 1; fi";
  int i = system(command);
  i = ((i & 0xff00) >> 8);
  return i; //i = 0, not VirtualBox. i = 1, VirtualBox
}

int main(){
  int ret = VirtualBox_Check();
  if ( ret == 1 ){ printf("Hooray it's a VBox!\n"); return 0; }
  else { 
      // finish the rest of the program 
  }
  return 0;
}

[mpack]

What is the objective here? Frankly I find the discussion rather misplaced - I suspect you have mistaken the purpose of the VMware function, and the VBox equivalent which also must exist: but neither tricks are for detecting the presence of a VM, they are for detecting the presence of an API, e.g. for people writing guest tools. Such tests would fail if the guest has no GAs support, and of course you need a separate check for each VM platform.

If your objective is to test whether your app is running under any VM then I would consider DMI strings (not recommended), presence of obsolete hardware, or do latency tests on hardware.

[doktor5000]

FWIW I suggest to take a look at systemd-detect-virt command as this basically does what you want if I understood correctly.