Determining if a Guest OS is running over a VMware hypervisor

In this post, we give some clues on how to determine hypervisor properties by running commands in the guest operating system, without any special privileges in the host machine running the hypervisor. This can be useful for penetration testing and information gathering, as well as for determining the best software configuration for virtualization-sensitive and virtualization-aware software.

Determining if the Guest OS is running over a VMware hypervisor

There are several methods to determine whether a machine is running as a virtual machine OS inside a VMware hypervisor.
The most popular one is the VMware “backdoor”. This “backdoor” will respond to certain “interrupt calls”, which would crash a user mode application in a physical machine. It provides both an API and a communication layer between a guest OS and the hypervisor. [1] [2]

Even if the backdoor is disabled, you can use any of the hardware “clues” described in [7].
When the VMware guest tools are installed, you can also use them to check whether the machine is running over a VMware hypervisor, using one of the supplied command line utilities. This is a high level option. [3] [4]

The Guest API is another option, we can easily use it inside an application. Some of the VMware Guest Tools use the Guest API. [5] [6]

vm deep arch.PNG
Image 1: VMware guest tools modules