Submitted by amit on Mon, 05/10/2015 - 15:59
The following table summarizes the values of Windows Performance Counter Frequency in various Windows guest OS and VM implementations. In all cases, Windows (8.x/10) was the host OS - do note that very different results may be obtained on non-Windows host OS. Data was gathered in Q3 2015 with current versions at that time.
|
VMware player 7.0.0 build-2305329 |
Oracle VirtualBox 4.3.28 r100309 |
Microsoft Hyper-V 6.3.9600.16384 |
Guest OS and VM implementation (with Windows 8.x/10 as host OS)
Win 10 64-bit |
3579545 (PMtimer) |
Nominal speed / 1024 (TSC) |
10000000 (synthetic HPET) |
---|
Win 8.1/8.0 Ent. 32-bit |
Turbo speed / 1024 (TSC-like) |
Nominal speed / 1024 (TSC) |
10000000 (synthetic HPET) |
---|
Win 7 Ent. SP1 32-bit |
10000000 (synthetic HPET) |
3579545 (PMtimer) |
10000000 (synthetic HPET) |
---|
In green - entries (combinations) that are detectable (as VM) using Windows Performance Counter Frequency.
In red - entries (combinations) that are undetectable (as VM) using Windows Performance Counter Frequency.
ADDITION (January 2016): tested with Microsoft Azure hypervisor (host), guest operating system Windows Server 2012 R2 Datacenter, IE11 browser - the performance counter frequenct is close to 10000000 (synthetic HPET) - the observed deviation was few dozen Hz. So Microsoft Azure is detectable. Not a big surprise since Microsoft Azure hypervisor is said to be a customized version of Microsoft Hyper-V.