24 Jul
2008
24 Jul
'08
2:03 p.m.
Tony Mountifield wrote:
Does anyone know how a program, script or shell user can best determine whether the machine is running on bare metal or is a VMware guest?
This paper show some very interesting tricks:
http://handlers.sans.org/tliston/ThwartingVM*Detection*_Liston_Skoudis.pdf
One simple (but not really foolproof, and only for VMWare) is testing the MAC address, and look at the OUI bytes; these are assigned to VMWare:
00-05-69 00-0C-29 00-1C-14 00-50-56