Compatibility Is Not Transparency: VMM Detection Myths and Realities

Tal Garfinkel, Keith Adams, Andrew Warfield, Jason Franklin
2007 USENIX Workshop on Hot Topics in Operating Systems  
Recent work on applications ranging from realistic honeypots to stealthier rootkits has speculated about building transparent VMMs -VMMs that are indistinguishable from native hardware, even to a dedicated adversary. We survey anomalies between real and virtual hardware and consider methods for detecting such anomalies, as well as possible countermeasures. We conclude that building a transparent VMM is fundamentally infeasible, as well as impractical from a performance and engineering standpoint.
dblp:conf/hotos/GarfinkelAWF07 fatcat:xwwhhadslzet3imzgannklltm4