[deleted]
Detecting DOSBox from Within the Box
11–20 of 20 posts
Re: Detecting DOSBox from Within the Box
#12It never really occurred to me that you'd want to be able to detect if something is running in DOSBox, since I figured that the point was to be as compatible as possible with MS-DOS. I guess it makes sense to try it anyway. Now I'm wondering how I'd be able to detect something like Concurrent DOS or REAL/32 or REAL/NG.
For me the opposite. I would have never though that there would be a point to trying to "detect" DOSBox since it would be trivial to do so. After all, DOSBox is not really designed to run MS-DOS, but its own DOS-like thing, and there must be a million small details that you can use to distinguish it from MS-DOS, if you really wanted to. I mean, the default filesystem is not even FAT... _Even_ if you run the MS-DOS ke…
DOSBox-X might fake it well enough.
Re: Detecting DOSBox from Within the Box
#13Earlier quoted context omitted.
For me the opposite. I would have never though that there would be a point to trying to "detect" DOSBox since it would be trivial to do so. After all, DOSBox is not really designed to run MS-DOS, but its own DOS-like thing, and there must be a million small details that you can use to distinguish it from MS-DOS, if you really wanted to. I mean, the default filesystem is not even FAT... _Even_ if you run the MS-DOS ke…
DOSBox-X might fake it well enough.
I encountered this and hadn’t realized that DOSBox’s main goal was to play games - and that lots of “non game things” didn’t work. But DOSbox-X covered some; I ended up running DOS 5 in VMware.
Re: Detecting DOSBox from Within the Box
#14Earlier quoted context omitted.
Sorry, Western Governors University. It's an online school. When taking a test they have a proctor that's watching you on a webcam, and they make you pan the webcam around the room to ensure that there's no obvious way to cheat, and they make you share your screen to ensure you only have a browser running.
> and they make you pan the webcam around the room to ensure that there's no obvious way to cheat, and they make you share your screen to ensure you only have a browser running. Well that level of intrusiveness would just make me come up with something overly complicated just so I could prove that I could cheat if I wanted.
The proctors are bored college students or similar - you don’t have to do much to defeat it.
They just want to make it difficult enough to catch most.
Re: Detecting DOSBox from Within the Box
#15The other way to detect DosBox is a one line Qbasic program PRINT VAL("5").
If it's a 64-bit build made using Visual Studio, you get 4.99999999999. Visual Studio doesn't support legacy 80-bit floating point math for that target. Visual Studio also does not support inline assembly to let you make use of the legacy 80-bit floating point instructions.
But if you set the CPU core to "Dynamic", then you get the proper value of "5". Or if you use the MingW builds, those also support 80-bit floating point math and give the correct value of "5".
It is quite embarrassing to ship a CPU emulator with broken floating point math as the default.
Re: Detecting DOSBox from Within the Box
#16Earlier quoted context omitted.
Sorry, Western Governors University. It's an online school. When taking a test they have a proctor that's watching you on a webcam, and they make you pan the webcam around the room to ensure that there's no obvious way to cheat, and they make you share your screen to ensure you only have a browser running.
> and they make you pan the webcam around the room to ensure that there's no obvious way to cheat, and they make you share your screen to ensure you only have a browser running. Well that level of intrusiveness would just make me come up with something overly complicated just so I could prove that I could cheat if I wanted.
I think it's more about just trying to keep honest people honest. I could think of a dozen or so ways that I could have cheated, some more convoluted than others, but it's enough effort to where I don't seriously consider it, and I did all my exams legitimately.
That's why they make you share your screen; obviously there's plenty of ways to fool that but the goal is to make it so that cheating requires enough effort to where it's probably less effort just to study and do it right.
Re: Detecting DOSBox from Within the Box
#17Neat! I’ve detected it with a simple (less reliable) way in the past for a demo (I forget why I needed to do that). It didn’t occur to me to inspect something like a built in command!
Re: Detecting DOSBox from Within the Box
#18It never really occurred to me that you'd want to be able to detect if something is running in DOSBox, since I figured that the point was to be as compatible as possible with MS-DOS. I guess it makes sense to try it anyway. Now I'm wondering how I'd be able to detect something like Concurrent DOS or REAL/32 or REAL/NG.
Testing if you're running under virtualization or emulation is a whole thing. We wrote virt-what to do this for virt and containers. It could do emulators as well if someone was motivated enough. It's basically a giant shell script. https://people.redhat.com/~rjones/virt-what/ There's also an adversarial aspect to this. Some emulators try to avoid detection and a lot of software tries to detect if it's running under…
Also: malware often tries to detect a VM or an emulator too, for example Windows Defender uses an emulator internally to detonate samples, and there are attempts by malware to detect this and change the behavior to something benign.
Re: Detecting DOSBox from Within the Box
#19Earlier quoted context omitted.
Testing if you're running under virtualization or emulation is a whole thing. We wrote virt-what to do this for virt and containers. It could do emulators as well if someone was motivated enough. It's basically a giant shell script. https://people.redhat.com/~rjones/virt-what/ There's also an adversarial aspect to this. Some emulators try to avoid detection and a lot of software tries to detect if it's running under…
Also: malware often tries to detect a VM or an emulator too, for example Windows Defender uses an emulator internally to detonate samples, and there are attempts by malware to detect this and change the behavior to something benign.
Way back in the early 90s Thunderbyte Antivirus' TBCLEAN would use the x86 trap flag to single step viruses up to the point where they restored the original entrypoint of the infected program, then write the "cleaned" program back to disk. They used the CPU single-step as a hack to alleviate needing to write an emulator.
The virus writer Priest figured out he could detect being run under single-stepping, and manipulate the stack and trap flag to re-vector control from TBSCAN to a destructive routine that trash the user's hard disk (but otherwise just run normally when not in the presence of TBCLEAN).
He later used this idea as the basis for the "emulating tracer" (in Natas, for sure-- but I think present in some earlier code too-- I don't remember what, thought) using single-step interrupt calls to trace thru resident antivirus programs to find original BIOS and DOS interrupt vectors and "call past" them (to prevent detection and do stealth).
His tracer decoded the next instruction to detect every method by which the trap flag state could be leaked to or mutated bu the traced code. He would emulate and step over any of these "privileged" instructions", presenting a sanitized state to the code under trace. It wasn't a full x86 emulator and could not have handled code that used trap-based anti-debug. That would have required a full emulator (and that way lies madness).
When VMware virtualized x86 I thought about Priest's code. Defender and other AV running samples under emulation makes me think about it too. So does this article.
Re: Detecting DOSBox from Within the Box
#20The other way to detect DosBox is a one line Qbasic program PRINT VAL("5"). If it's a 64-bit build made using Visual Studio, you get 4.99999999999. Visual Studio doesn't support legacy 80-bit floating point math for that target. Visual Studio also does not support inline assembly to let you make use of the legacy 80-bit floating point instructions. But if you set the CPU core to "Dynamic", then you get the proper val…
> It is quite embarrassing to ship a CPU emulator with broken floating point math as the default.
It was also quite embarrassing to ship a real CPU with broken floating point math.