Virtual Machine Detection

Detection logic inspects low-level hardware identifiers that virtualization platforms fail to perfectly emulate. MAC address prefixes are cross-referenced against the IEEE OUI registry for known vendors like VMware (00:0C:29) or VirtualBox (08:00:27). CPUID instruction execution reveals hypervisor signatures; the ECX register bit 31 indicates a hypervisor presence when the leaf function 0x1 is called. ACPI tables and SMBIOS data are parsed for strings containing 'VMware', 'QEMU', or 'VirtualBox', which are absent on physical hosts.

The operating system's driver stack and configuration database contain definitive proof of virtualization. On Windows, the presence of C:\Windows\System32\drivers\vm3dmp.sys or vmmouse.sys confirms VMware Tools installation. Registry keys under HKLM\SYSTEM\CurrentControlSet\Services are enumerated for disk and network adapter drivers unique to virtual environments. Linux systems are probed via lspci and lsmod for kernel modules like virtio_pci or vboxguest, which expose paravirtualized hardware.

Instruction execution timing diverges measurably between physical and virtualized silicon. The RDTSC (Read Time-Stamp Counter) x86 instruction is invoked before and after a lightweight operation; a significant delta indicates the overhead of VM exit events trapping to the hypervisor. Similarly, SGDT and SLDT instructions read descriptor table registers, which are relocated by the hypervisor to avoid conflicts. The base address of the Interrupt Descriptor Table (IDT) is compared against known physical machine ranges—virtualized IDTs are typically placed at higher memory addresses.

Userland detection methods scan the running process list for virtualization tooling. vmtoolsd.exe and VBoxService.exe are high-fidelity indicators of VMware and VirtualBox environments respectively. On Linux, systemd-detect-virt provides a standardized query interface, while manual inspection of /proc/scsi/scsi reveals virtual disk model strings like 'QEMU HARDDISK'. The absence of expected physical hardware processes, such as laptop battery management services, further reinforces a virtual machine verdict.

Virtualization platforms expose specific network interfaces and communication channels. VMware's VMCI (Virtual Machine Communication Interface) socket family is probed for connectivity to the host. Open I/O ports, such as the 'VX' backdoor port 0x5658 used by VMware for host-guest commands, are queried with the IN instruction. Network adapter names like 'Intel(R) PRO/1000 MT' combined with a virtual MAC prefix provide a dual-confirmation signal for sandbox environments.

Automated sandboxes often lack genuine human interaction signals. Detection routines check for mouse movement history and recent file access records; a pristine desktop with zero user documents suggests an ephemeral analysis environment. Screen resolution is compared against common automated analysis defaults (e.g., 800x600 or 1024x768). Uptime queries via GetTickCount() returning very low values indicate a freshly booted sandbox, while the absence of USB device insertion history in registry hives confirms a non-interactive, disposable instance.