0 Replies Latest reply on Nov 27, 2011 5:16 AM by igor.korkin

    CPUID-HyperCall detection of hardware virtual machine monitors by Microsoft

    igor.korkin

      Hi all!

      Microsoft has published a CPUID-HyperCall interface of interaction with VMMs, which are based on hardware virtualization.

       

      Determining If Hypervisor Is Installed. Hypervisor-present bit
      Before it uses any hypervisor interface functions, software should first determine whether it runs within a virtualized environment. On x64 platforms, software verifies that it runs within a virtualized environment by executing the CPUID instruction with an input (EAX register) value of 1. When the CPUID instruction is executed, code should check bit 31 of register ECX. Bit 31 is the hypervisor-present bit. If the hypervisor-present bit is set, the hypervisor is present. In a non-virtualized environment, the hypervisor-present bit is clear.

       

      I have several concerns.

       

      • I wonder if vendors will support this mechanism.
      • Will malware writers follow this rule?
      • Will it work for nested virtualization (eg. some legal VMMs and one malware VMM)?
      • Is it possible to prevent cheating VMM IDs?

       

      Determining If Hypervisor Is Installed

       

       

      Igor Korkin

      sites.google.com/site/igorkorkin