In my class, we are discussing virtual machine based root kits.

I've research root kits, but could not find any information specifically talking about how root kits work inside of virtual machines

Can someone explain me in a few words how an attacker would carry a rootkit attack against the virtual machine and how he would implement malicious services or anything regarding how installing a root kit in a virtual machine is different than on a physical machine?

  • 4
    You might have misunderstood something. When people talk about virtual-machine based rootkits, they often talk about things like Blue Pill - a rootkit which targets bare-metal machines and compromises them by putting them into a virtual machine around them without them (or the user) noticing.
    – Philipp
    Commented May 6, 2014 at 18:49

3 Answers 3


As stated above, root kits work similar on a virtual host as they do on a normal host EXCEPT that many malware/virus/rootkit authors have developed mechanisms to detect whether or not they are in a virtual machine, so they can be scripted/programmed to behave differently than they would on a normal machine.

This is highly evident when reverse engineering malware, where malware will behave different if it detects it is virtualized. Some of the behavior may be to stop from doing its normal routines/functions, try to delete itself. This is similar to malware checking to see if a host is running reverse engineering tools, e.g., IDA Pro, OllyDBG, Immunity Debugger, Redline, etc.

VMWare has an "antirootkit" approach to certain things since the vmware agent will monitor things like changes to the SSDT and IDT (system service descriptor table, and interrupt descriptor tables). At the end of the day though, the behavior is MOSTLY the same.


It's not quite clear from your question, but it sounds like you may have been discussing malware which is programmed to "escape" from the virtual machine and affect the host machine. There are attacks which are more focused on virtual machines; it may be possible to affect other virtual machines besides the one guest where the malware runs.

For example, the "blue pill" attack and other forms of "hyperjacking". You may also be able to exploit the services which would only be running in a virtual machine.

However, a traditional root kit in many cases will also run against a virtual machine.


They work just as they do within a regular machine. Zero difference. The root kit would infect key files within the OS and potentially the boot partition. These principles apply to both physical and virtual machines. A regular server has key system files in the OS and a boot partition, a virtual machine has key system files in the OS and a boot partition. Most root kits within a virtual machine are not aware that they are on a virtual machine, as such they just infect the virtual machine and not the physical server hosting it.

The above only references standard root kits. There are special exploits and root kits that will not only infect the virtual machine but the machine that is hosting it, look up bluepill and virtualization for that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .