#vm #detect #timing

inside-vm

detect virtual machine using timing

2 unstable releases

0.2.0 Jul 11, 2021
0.1.0 Jul 9, 2021

#203 in Emulators

Download history 12/week @ 2024-11-15 21/week @ 2024-11-22 3/week @ 2024-11-29 51/week @ 2024-12-06 36/week @ 2024-12-13 5/week @ 2024-12-20 1/week @ 2024-12-27 3/week @ 2025-01-10 7/week @ 2025-01-17 24/week @ 2025-01-24 28/week @ 2025-01-31 10/week @ 2025-02-07 26/week @ 2025-02-14 32/week @ 2025-02-21 38/week @ 2025-02-28

107 downloads per month
Used in rsmount

MIT/Apache

7KB

rtw crate rtw documentation

inside-vm

Detect if code is running inside a virtual machine.

Only works on x86 and x86-64.

How does it work

Measure average cpu cycles when calling cpuid and compare to a threshold, if the value is high assume code is running inside a VM.

Quick Start

git clone https://github.com/PicoJr/inside-vm
cd inside-vm/
cargo run --example test-inside-vm

output: avg cycles for __cpuid: 108

vs inside VM

[vagrant@archlinux vagrant]$ ./target/release/examples/test-inside-vm 

output: avg cycles for __cpuid: 30578

API

use inside_vm::inside_vm;

let inside = inside_vm();
println!("inside vm: {}", inside);

Credits

https://evasions.checkpoint.com/techniques/timing.html#difference-vm-hosts

Changelog

Please see the CHANGELOG for a release history.

License

Dual-licensed under MIT or the Apache License V2.0.

No runtime deps