Recently, I found a way to detect a hypervisor’s presence as I was reading the AMD64 Architecture Programmer’s Manual. The algorithm is easy. What we need to do is to set function leaf as one and execute the cpuid instruction. Examine the 31st bit of ecx register. The value is the sufficient, not necessary however, condition to indicate the hypervisor’s presence.

We may write a function in assembly like the following:

xor eax,eax
inc eax
cpuid
bt ecx,1fh
setc al
ret

The return value is 8-bit, stored in al register.

In the C compiler by Microsoft Visual C++, we may write partial code like the following:

int data[4];
__cpuid(data,1);
return _bittest(&data[2],31);

The function is not defined. Note that __cpuid and _bittest are intrinsic macros and they are compiler-specific. You might want to have some revision in order to use on other C compilers.

 

In order to avoid the detection, the simple way is to change the configuration file of the virtual machine. For VMware Virtual Machines, you may open the .vmx file by Notepad++ and add one line of configuration to the bottom of file:

hypervisor.cpuid.v0 = "FALSE"

In the default case, there is no such line of configuration. Thus guest software may detect the hypervisor’s presence in this way.