On Windows Performance Counter Frequency, VMs and guest OSes

amit — Mon, 05 Oct 2015 19:59:23 +0000

The following table summarizes the values of Windows Performance Counter Frequency in various Windows guest OS and VM implementations. In all cases, Windows (8.x/10) was the host OS - do note that very different results may be obtained on non-Windows host OS. Data was gathered in Q3 2015 with current versions at that time.

Guest OS and VM implementation (with Windows 8.x/10 as host OS)
	VMware player 7.0.0 build-2305329	Oracle VirtualBox 4.3.28 r100309	Microsoft Hyper-V 6.3.9600.16384
Win 10 64-bit	3579545 (PMtimer)	Nominal speed / 1024 (TSC)	10000000 (synthetic HPET)
Win 8.1/8.0 Ent. 32-bit	Turbo speed / 1024 (TSC-like)	Nominal speed / 1024 (TSC)	10000000 (synthetic HPET)
Win 7 Ent. SP1 32-bit	10000000 (synthetic HPET)	3579545 (PMtimer)	10000000 (synthetic HPET)

In green - entries (combinations) that are detectable (as VM) using Windows Performance Counter Frequency.

In red - entries (combinations) that are undetectable (as VM) using Windows Performance Counter Frequency.

ADDITION (January 2016): tested with Microsoft Azure hypervisor (host), guest operating system Windows Server 2012 R2 Datacenter, IE11 browser - the performance counter frequenct is close to 10000000 (synthetic HPET) - the observed deviation was few dozen Hz. So Microsoft Azure is detectable. Not a big surprise since Microsoft Azure hypervisor is said to be a customized version of Microsoft Hyper-V.

Amit Klein's security corner - guest

On Windows Performance Counter Frequency, VMs and guest OSes

Tags: