1

They are all privileged(??) x86 instructions.

  • sidt : Stores the Interrupt Descriptor Table Register (IDTR) content. (Red pill)
  • sldt : Stores the segment selector from the Local Descriptor Table Register
  • sgdt : Stores the Global Descriptor Table Register (GDTR) content.
  • str : Stores the segment selector from the Task Register (TR).

Their values are supposed to be different on VM compared to host. I've already run my tests and these techniques do not seem to work on a VMware Workstation 12.

All I'm asking is if someone else has encountered the same behavior.

Improve this question
5
  • 1
    can you explain a bit more about the topic?
    – Paweł Łukasik
    Jun 19, 2018 at 9:03
  • 1
    Uhm, why not actually try it out? @PawełŁukasik the inquirer is referring to Redpill as devised by Rutkowska in or around 2007 to detect (not counter!) the presence of a VMM. Oh and aside from that it's not exactly about reverse engineering.
    – 0xC0000022L ♦
    Jun 19, 2018 at 11:46
  • @0xC0000022L thx. I've just wanted to author to update the post so it will be better quality but since it's not RE then it doesn't matter.
    – Paweł Łukasik
    Jun 19, 2018 at 13:00
  • @0xC0000022L Ok, hypothetically, you try to reverse a malware, and does not seem to run inside a vm, what do you do to neutrilise the anti-vm functionality??? black magic?? This have something to do with RE, right?except if you are a hardore elitist reverse engineer...
    – n1h1l
    Jun 19, 2018 at 14:23
  • @n1h1l fair point. Still not exactly about RCE, but should be on topic. With four reopen votes, I'll cast the fifth so you can get an answer. Sorry, was offline for a few days, but there was actually just one vote missing now from high-rep users to reopen your question (without a moderator)!
    – 0xC0000022L ♦
    Jun 24, 2018 at 20:00

1 Answer 1

Reset to default
1

These are not privileged instructions. What has changed is the manner in which the VM is running. Now with hypervisors, those values could well be the same inside and outside of the VM. They were never particularly reliable methods to detect VMs anyway.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.