www.mamboteam.com
Home arrow Blog arrow Blog::Tech Stuff arrow Red Pill vs Blue Pill
Thursday, 28 August 2008
 
 
Newsflash

Oh, I love Ruby yes I do!
I love Ruby, yes it's true!

Rails makes coding fast and really fun,
Fifteen minutes and the admin side is done!

 AJAX is really where it's at...
Sweet UI effects, you can't beat that!

Red Pill vs Blue Pill Print E-mail
User Rating: / 0
PoorBest 
Written by Joshua Gitlin   
Friday, 24 August 2007

Well this is pretty scary. Want to see if the Matrix is real? Quote:

Swallowing the Red Pill is more or less equivalent to the following code (returns non zero when in Matrix):

     int swallow_redpill () {
       unsigned char m[2+4], rpill[] = "\x0f\x01\x0d\x00\x00\x00\x00\xc3";
       *((unsigned*)&rpill[3]) = (unsigned)m;
       ((void(*)())&rpill)();
       return (m[5]>0xd0) ? 1 : 0;
     }

Just read an article in NetworkWorld talking about "Red Pill" and "blue Pill", two supposed exploits for virtual machines. Since I am  very gung-hoo on virtualization, I decided to check them out. Well I came across the above code on this site, and I had to test it immediately. Sure enough, the code inside my Development VM said "Inside Matrix!" and the same code, when run outside VMWare Workstation 5.5.4 build-44386 said "Not in matrix".

 Scary to think about exactly what this might mean... The red pill program itself doesn't have that many disastrous side-effects... so what if an attacker can learn that he's inside a virtual machine? (It's not quite that simple. Of course, the goal is to prevent attackers from learning anything about the systems they're on, because the more you know the more likely you will be able to successfully cause damage...) There are some concerns that come to mind off the top of my head: If I'm trying to test a piece of software and I want to truly test it, I may not want it knowing it's running in a VM, and RedPill is a proof-of-concept that software can (very easily!) see if it's running on real hardware or not...

 More to come on this issue as I look into it further!

Last Updated ( Thursday, 06 September 2007 )
Next >

Number of comments (0) - Add your comments to this article...

You are not authorized to leave comments - please login.
 
Top! Top!