46

How can I detect (.NET or Win32) if my application is running in a virtual machine?

3
  • I ran an app the other day, and it wouldn't run in a Virtual Machine.. . it said it couldn't. I was wondering how it knew.
    – Jason
    Jan 31, 2009 at 6:06
  • 7
    There are a number of things that don't work in VMs: some parts of MS SQL Server, the C# for devices emulator, and gasp Virtual PC/Server. Being able to plan for that in programs and scripts is valuable.
    – Jay Bazuzi
    Jan 31, 2009 at 6:18
  • 1
    ...so if you have a dependency on something that doesn't work in some environments (i.e. VMs), then you should query that dependency to see if it's functional in the current environment. Or perhaps I missed your point?
    – reuben
    Jan 31, 2009 at 22:38

12 Answers 12

51

This is what I use:

using (var searcher = new System.Management.ManagementObjectSearcher("Select * from Win32_ComputerSystem"))
{
  using (var items = searcher.Get())
  {
    foreach (var item in items)
    {
      string manufacturer = item["Manufacturer"].ToString().ToLower();
      if ((manufacturer == "microsoft corporation" && item["Model"].ToString().ToUpperInvariant().Contains("VIRTUAL"))
          || manufacturer.Contains("vmware")
          || item["Model"].ToString() == "VirtualBox")
      {
        return true;
      }
    }
  }
}
return false;

Edit 2014-12-02: Updated code so that it no longer detects a Microsoft Surface Pro as a VM. Thanks to Erik Funkenbusch for pointing this out.

Edit 2017-06-29: Updated code so that it also checks the value of the HypervisorPresent property.

Edit 2018-02-05: removed check for the HypervisorPresent property since it's incorrect. This property could return true if running on the host O/S on a hyper-V server.

7
  • 3
    Some quick tests looks like the test expression can be simplified (for some definition of 'simplified') to item["Model"].ToString().ToLower().Contains("virtual"). Mar 13, 2013 at 0:20
  • You can cast "items" as IEnumerable<ManagementBaseObjects> like this: var managementItems = items.OfType<ManagementBaseObject>(); for use with IEnumerable extension methods. May 11, 2014 at 3:34
  • 2
    I would think this code would detect Microsoft computer hardware as VM's, such as Surface Pro's. Nov 29, 2014 at 17:08
  • this code will not detect virtual machine run under Parallels Desktop, Xen and KVM
    – Dennis
    Aug 4, 2016 at 7:10
  • 1
    You can easily fake model in Virtualbox by running command "C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" setextradata "VM_NAME" "VBoxInternal/Devices/pcbios/0/Config/DmiSystemProduct" "Latitude E5400" . And after this code won't going to detect. Jul 12, 2021 at 12:35
20

According to Virtual PC Guy's blog post "Detecting Microsoft virtual machines", you can use WMI to check the manufacturer of the motherboard. In PowerShell:

 (gwmi Win32_BaseBoard).Manufacturer -eq "Microsoft Corporation"
4
  • 25
    Er, what about the non-MS VMs? Jun 21, 2012 at 20:08
  • 5
    Also, as mentioned by commenter @ErikFunkenbusch on my answer to this question, this check will incorrectly identify the MS Surface Pro as a VM.
    – RobSiklos
    Dec 9, 2014 at 14:54
  • 2
    To be fair, for MS Virtual Machines, the Surface variety of products was released after this answer was posted. Jan 15, 2017 at 17:49
  • 1
    SO answers are not about being fair or unfair, they are about being helpful or not. This answer was undoubtedly useful at the time it was posted, but it is not anymore and RobSiklos (updated) answer should be marked as the correct one. Reputation points should be seen as an incentive to be helpful, not an ultimate goal to become a reputation millionaire ;)
    – Ama
    Dec 11, 2019 at 12:01
5

This C function will detect VM Guest OS: (Tested on Windows, compiled with Visual Studio)

#include <intrin.h>

    bool isGuestOSVM()
    {
        unsigned int cpuInfo[4];
        __cpuid((int*)cpuInfo,1);
        return ((cpuInfo[2] >> 31) & 1) == 1;
    }
2
  • 3
    To clarify, this piece of code uses the cpuid instruction to detect if the feature bit is set that indicates the code is running on a hypervisor. There is, of course, no requirement that an actual hypervisor always sets this bit, especially for software hypervisors. Sep 4, 2017 at 11:13
  • 2
    I would not use this. Tested false positive (Windows 10, VS) on my PC. I have virtualization support turned on in BIOS, but not running in VM, so it might be that (?). May 6, 2020 at 15:34
4

Jay Abuzi showed the solution in powershell. Here's the same as a c# function:

   /// <summary>
    /// Detect if this OS runs in a virtual machine
    /// 
    /// http://blogs.msdn.com/b/virtual_pc_guy/archive/2005/10/27/484479.aspx
    /// 
    /// Microsoft themselves say you can see that by looking at the motherboard via wmi
    /// </summary>
    /// <returns>false</returns> if it runs on a fysical machine
    public bool DetectVirtualMachine()
    {
        bool result = false;
      const  string  MICROSOFTCORPORATION ="microsoft corporation";
        try
        {
            ManagementObjectSearcher searcher =
                new ManagementObjectSearcher("root\\CIMV2","SELECT * FROM Win32_BaseBoard");

            foreach (ManagementObject queryObj in searcher.Get())
            {
               result =  queryObj["Manufacturer"].ToString().ToLower() == MICROSOFTCORPORATION.ToLower();
            }
            return result;
        }
        catch (ManagementException ex)
        {
            return result;
        }
    }
3
  • Sadly, this and similar techniques do not work in my W7 system running a VMWare ThinApp to test. The queryObj.Properties are identical in both environments. May 26, 2013 at 16:06
  • 2
    @JesseChisholm - not only that, but this will falsely report that Microsoft non-vm hardware is a VM, such as a Surface Pro. I'd suggest that you've got a setting wrong if your ThinApp is virtualizing the WMI data. Nov 29, 2014 at 17:29
  • @ErikFunkenbusch - The whole point of virtualization is so the code need not know or care whether it is live or virtual. So each VM manufacturer works very hard to make it impossible to know. So far, the only way I have found for my app to know, is to have the VM execution pass in a command line parameter telling me I am running virtual. Sigh. Dec 16, 2014 at 17:09
3

Remember you should not just check popular VM model,manufacturer name from wmi, You should also check difference between reality and virtualization.
VM don't have much features.
1) check-if-cpu-temperature-information-is-available

wmic /namespace:\\root\WMI path MSAcpi_ThermalZoneTemperature get CurrentTemperature
//On Real PC
//CurrentTemperature
//3147

//On VM
//Node - Admin
//Error:
//Description not supported

Tested on vmware,virtualbox,windows server,app.any.run sandbox.

2) Win32_PortConnector

Get-WmiObject Win32_PortConnector
//On Vm it is null

//On real pc it looks something like that
Tag                         : Port Connector 0
ConnectorType               : {23, 3}
SerialNumber                :
ExternalReferenceDesignator :
PortType                    : 2

1
  • the idea is good, but querying the temperatures requires admin rights; checking the port connector seems to work without
    – niyou
    May 18, 2022 at 7:13
2
public static bool isVirtualMachine()
{
    const string MICROSOFTCORPORATION = "microsoft corporation";
    const string VMWARE = "vmware"; 

    foreach (var item in new ManagementObjectSearcher("Select * from Win32_ComputerSystem").Get())
    {
        string manufacturer = item["Manufacturer"].ToString().ToLower();
        // Check the Manufacturer (eg: vmware, inc)
        if (manufacturer.Contains(MICROSOFTCORPORATION) || manufacturer.Contains(VMWARE))  
        {
            return true;
        }

        // Also, check the model (eg: VMware Virtual Platform)
        if (item["Model"] != null)
        {
            string model = item["Model"].ToString().ToLower();
            if (model.Contains(MICROSOFTCORPORATION) || model.Contains(VMWARE)) 
            {
                return true;
            }
        }
    }
    return false;
}
1
  • Sadly, this and similar techniques do not work in my W7 system running a VMWare ThinApp to test. The queryObj.Properties are identical in both environments. May 26, 2013 at 16:07
2

For Lower level Tests I recommend looking at ScoopyNG [1]. It is a collection of known low-level, well working vm detection methods, albeit being a little dated.

If you really want to rely on other things, like installed tools (VM* Additions) , these are much easier to "fake".

This [2] Blog Post also has a pretty nice overview, from low level asm stuff, checking for specific DLLs, filepaths and registry keys to check.

[1] http://trapkit.de/research/vmm/scoopyng/index.html

[2] http://securitykitten.github.io/vm-checking-and-detecting/

1

The easiest way I found to figure out whether my C# app is running on a vmware VM or not is to check the MAC address of the NIC card(s). If it's a VMware VM it would always be: 00:50:56:XX:YY:ZZ

You may enumerate through the NICs as resolved here.

2
  • 12
    -1: of course VMware is free to change their MAC address format whenever they like, without telling you in advance Feb 18, 2012 at 12:44
  • 1
    According to standards.ieee.org VMWare uses: 00:05:69, 00:0C:29, 00:1C:14 as well as 00:50:56 for the Organization portion of the MAC Address. And as @John_Saunders said, they may add a new number to the list whenever they wish. May 26, 2013 at 14:09
1

this C++ code will detect Vmware Products such as express,esx,fusion or workstation

// VMWareDetector.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include "windows.h"
#include <conio.h>
void CheckVM(void); 
int main()
{
    CheckVM(); 
    _getch(); 
    return 0;
}

void CheckVM(void)
{
    unsigned int    a, b;

    __try {
        __asm {

            // save register values on the stack
            push eax
            push ebx
            push ecx
            push edx

            // perform fingerprint
            mov eax, 'VMXh' // VMware magic value (0x564D5868)
            mov ecx, 0Ah // special version cmd (0x0a)
            mov dx, 'VX' // special VMware I/O port (0x5658)

            in eax, dx // special I/O cmd

            mov a, ebx // data 
            mov b, ecx // data (eax gets also modified
                       // but will not be evaluated)

                       // restore register values from the stack
                       pop edx
                       pop ecx
                       pop ebx
                       pop eax
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {}
    printf("\n[+] Debug : [ a=%x ; b=%d ]\n\n", a, b);
    if (a == 'VMXh') { // is the value equal to the VMware magic value?
        printf("Result  : VMware detected\nVersion : ");
        if (b == 1)
            printf("Express\n\n");
        else if (b == 2)
            printf("ESX\n\n");
        else if (b == 3)
            printf("GSX\n\n");
        else if (b == 4)
            printf("Workstation\n\n");
        else
            printf("unknown version\n\n");
    }
    else
        printf("Result  : Not Detected\n\n");
}
1
  • you can also use pushad and popad instead of pushing and popping all registers manually
    – Toma
    Jun 26, 2021 at 19:22
0

I have tested for 3 types - VirtualBox,Wmware and Huper-V

foreach (var mo in "Select * from Win32_ComputerSystem")
{
    var model = (string)mo["Model"];

    if (model == "VirtualBox" ||
        model == "Virtual Machine" ||
        model.StartsWith("VMware"))
    {
        return true;
    }
}
return false;
0

I wanted to make this configurable so I converted @RobSiklos answer to a WMI query. Now I can put the query in a config location and change it when needed.

private static bool IsVirtual()
{
    using (var searcher = new System
        .Management
        .ManagementObjectSearcher(@"SELECT * from Win32_ComputerSystem 
                                    WHERE (Manufacturer LIKE '%microsoft corporation%' AND Model LIKE '%virtual%')
                                    OR Manufacturer LIKE '%vmware%'
                                    OR Model LIKE '%VirtualBox%'"))
    {
        using (System.Management.ManagementObjectCollection items = searcher.Get())
        {
            if (items.Count > 0)
            {
                return true;
            }
        }
    }

    return false;
}

WQL Reference:

https://learn.microsoft.com/en-us/windows/win32/wmisdk/wql-sql-for-wmi

0

From Super User, this is the answer: look at the graphics driver. This is the code:

Dim driver As New ManagementObjectSearcher("Select * from Win32_PnPSignedDriver")
Dim driver_info As ManagementObject
Dim name As String
For Each driver_info In driver.Get()
    caption = driver_info("DeviceName").ToString()
    If caption.Contains("Standard") and caption.Contains("VGA") Then
        ' it's virtual machine
        ' do anything you need
    End If
Next

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.