Author Topic: Help me understand Virtual Machine [VMWare] (Read 37937 times)

cyberdiva · « **Reply #25 on:** August 19, 2012, 08:18 AM »

Snapshots are managed and executed by the virtual machine software so it is really just a menu click away
-mouser (August 19, 2012, 08:11 AM)

Mouser, thanks very much for your fast and helpful reply! So the VM software has within it the ability to make these snapshots, rather than having to use something like Macrium Reflect or Acronis? If so, that's great.

mouser · « **Reply #26 on:** August 19, 2012, 08:21 AM »

Correct.

mouser · « **Reply #27 on:** August 19, 2012, 08:30 AM »

More advanced users could use snapshots to keep different saved states, but by far the most common use of a snapshot, for people who use a virtual machine to test software, is:

You make a snapshot of the machine after you do the operating system install and after you have updated the operating system.
This is your base snapshot of your known trusted good machine.
Then when you want to test something you install it, test it, and then eventually REVERT to your base clean snapshot.

That is, you are always going back to your known trusted good clean snapshot after you finish a round of testing.

As has been pointed out by others, in theory a virtual machine is immune to attack by malware, but you should consider a few things before unleashing known malware in a virtual machine:

You have to be careful if your virtual machine is able to access the network -- especially because it may look to your real host computer and others on the network, as if the virtual machine is a "trusted" machine on your LAN. One nice feature of a virtual machine however is that you can DISABLE network connectivity with a simple option, thus locking down the machine from any network access.
You also have to worry about any SHARED FOLDERS that the virtual machine software may set up. A malware could infect such shared folders.
Lastly, there is always the possibility that a malware will be specifically coded to exploit bugs in a virtual machine software and "break out" of the virtual machine. This is not a purely theoretical concern -- I have read about virtual machine exploits -- though I don't have any idea how rare they are. But you should always be cautious about assuming that a virtual machine provides 100% secure testing environment for truly malicious malware.

Shades · « **Reply #28 on:** August 19, 2012, 08:33 AM »

Yes, you could consider a copy of a virtual machine like an image made by the software you mentioned.

Snapshots are a lot smaller in size and apparently restore fast (I only have experience with VMWare Player).

My way of working is always to configure/finetune a virtual machine, then make a copy of it, then compress it (7zip) for storage on DVD. A whole lot more personal involvement, but it doesn´t require money to be separated from your wallet.

If you think this is too much of a hassle, the VMWare Workstation software would be your best option. Likely once you tried it, you wonder how you could have managed without it all this time.

cyberdiva · « **Reply #29 on:** August 19, 2012, 09:44 AM »

Thanks very much, mouser and Shades, for this very helpful additional info.

tomos · « **Reply #30 on:** August 19, 2012, 12:31 PM »

WMWare player does *not* have the snapshot ability, but simply copying the files seems to have worked fine - well, I haven't tried a "restore" yet -will only do so if thing screw up- but Ren says it works ;-)
Copying when it's not running is better: it's a lot smaller -minus the page file I guess, and the restore should work better.

@cyberdiva, my experience so far:

it *is* easy
avoid nlite
I didnt have to load any drivers - in spite of installing the original XP (no service packs) that AFAIK normally needs SATA drivers before it will install
I made the virtual machine 100GB - I remember original XP having problems with terabyte drives

40hz · « **Reply #31 on:** August 19, 2012, 12:32 PM »

@CD - if you get a chance (and can spare about an hour) do try to watch some of Eli the Computer Guy's Introduction to Virtualization video I mentioned earlier. It's a very gentle, but not dumbed-down, introduction to virtualization technology. And one of the better instructional vids I've ever seen.

tomos · « **Reply #32 on:** August 19, 2012, 02:09 PM »

what's the story then for licenses?

if you want to actually use an app on both virtual and real OS's, do I (technically) need two licenses, (say the license is for one machine),
or does it depend on the individual software?

f0dder · « **Reply #33 on:** August 19, 2012, 02:26 PM »

Lastly, there is always the possibility that a malware will be specifically coded to exploit bugs in a virtual machine software and "break out" of the virtual machine. This is not a purely theoretical concern -- I have read about virtual machine exploits -- though I don't have any idea how rare they are. But you should always be cautious about assuming that a virtual machine provides 100% secure testing environment for truly malicious malware.
-mouser (August 19, 2012, 08:30 AM)

I doubt you'd find that in a regular piece of malware.

First, the purpose of generic malware is to infect as many machines as possible, for botnet zombies or for harvesting passwords or CC data. There's not enough people running VMs that it makes sense putting VM-breakout exploits in a generic piece of malware. It's muuuuuuch more interesting to keep those exploits private, either to sell it to the highest bidder, or for doing your own very-targetted attacks.

As for snapshots vs. file-copying, snapshots are definitely prefarable, unless you're dealing with very small virtual drives, since snapshots don't copy the entire virtual disk image - instead, unless I've misunderstood things and the file sizes in my VM dirs

, it "freezes" the previous image and stores modified blocks in a new file.

tomos · « **Reply #34 on:** August 20, 2012, 03:43 AM »

As for snapshots vs. file-copying, snapshots are definitely prefarable, unless you're dealing with very small virtual drives, since snapshots don't copy the entire virtual disk image - instead, unless I've misunderstood things and the file sizes in my VM dirs , it "freezes" the previous image and stores modified blocks in a new file.
-f0dder (August 19, 2012, 02:26 PM)

with VMWare Workstation, I'm looking at a cost of 177.68 euros = almost US$220. (That's including tax.)
So I'll stick with the backup solution ;-)

I'm now using a backup programme that (after the initial backup) just backs up the modified blocks. I guess I could test it by restoring to a different folder and run it as a new VM. Maybe, sometime...

PS f0dder - 8,000 posts -

xtabber · « **Reply #35 on:** August 20, 2012, 09:28 AM »

Even if you can use snapshots for testing, I agree with Renegade that it is a good idea to keep backup copies of any original "clean" VMs you create. In many ways, a VM is like another computer available to work on when needed, and you really don't want to lose it by accident.

A VM is like a disk image. The difference is that the operating system on it has been modified to require a virtual environment in which to run. In some cases, it is possible to convert an image of a real system to run in a VM, or to convert a VM to run a real system. I have used Paragon's virtual manager (part of their Hard Disk Manager Pro but also available separately), to restore a backup image of an older system to a VMware VM, allowing me to run programs that were installed on it even though I no longer have the original computer.

Shades · « **Reply #36 on:** August 20, 2012, 02:09 PM »

Converting a VM to a real system again requires you to make an image from the running VM and use that image (plus all the required drivers for the real system) to create a real system again.

Just to add to the confusion...

tslim · « **Reply #37 on:** August 21, 2012, 01:27 PM »

There are two things about VMWare Workstation I think worth mentioning:

1. There are two VM states: either its O/S is alive or has been shutdown. Creating a snapshot of the latter is much quicker and much smaller in size. That is because a VM snapshot of a running O/S will include its "memory" state. e.g. if you run WinXP in a VM which has been setup with a 1 GB memory, the state of that 1 GB memory is always included in a snapshot unless you shutdown that WinXP before creating a snpshot.

2. It is a great fun to play with VMWare snapshots, like playing solitaire a game.
a) You can create multiple snapshots base on a parent snapshot.
b) If a1, a2, a3, ... aN is a series of snapshots where aN is based on aN-1, you may delete a snapshot in the mid. e.g. you can delete a2 without hurting a3 and the rest of the snapshots which all originated from a2
c) You can even edit and manipulate VM shnapshot file(s) (while it is not in use)...

cyberdiva · « **Reply #38 on:** August 21, 2012, 05:13 PM »

@CD - if you get a chance (and can spare about an hour) do try to watch some of Eli the Computer Guy's Introduction to Virtualization video I mentioned earlier. It's a very gentle, but not dumbed-down, introduction to virtualization technology. And one of the better instructional vids I've ever seen.
-40hz (August 19, 2012, 12:32 PM)

Thanks very much, 40hz, for the recommendation. I watched the shorter video you mentioned earlier, about VirtualBox, and found it helpful. I've now started to watch the longer video you mention here, and it may turn out to be really useful, but I wish Eli had broken it into two parts, one dealing with type 1 hypervisors and one dealing with type 2. I found it somewhat tedious listening to him go on and on about type 1, knowing that I'd probably never use that. I finally realized that there was a contents list below the video, and I was able to bail out of the rest of the type 1 discussion and move on to type 2. But by then I was getting a bit antsy, so I stopped the video and did other things. I definitely will go back to it later today, however, and I'm very grateful to you for letting me know about it.

40hz · « **Reply #39 on:** August 21, 2012, 05:59 PM »

^Sorry! Should have warned you. Being in IT, it didn't really occur to me to tell you to skip forward. And yes he can repeat himself a bit. But part of that is the old school way of presenting tech info to a mixed audience, to wit:

First, tell them what you're gonna tell them.

Next, tell them.

Finally, tell them what you just told them. $:-\$

Everybody hates it. But it does boost retention quite a bit (at least in males) doing it that way.

And the first 8-10 minutes are worth digesting regardless.

Anyway, glad some of it was helpful.

tomos · « **Reply #40 on:** August 22, 2012, 04:56 AM »

1. There are two VM states: either its O/S is alive or has been shutdown. Creating a snapshot of the latter is much quicker and much smaller in size. That is because a VM snapshot of a running O/S will include its "memory" state. e.g. if you run WinXP in a VM which has been setup with a 1 GB memory, the state of that 1 GB memory is always included in a snapshot unless you shutdown that WinXP before creating a snpshot.
-tslim (August 21, 2012, 01:27 PM)

that was my experience as well doing straight forward backup.

Does anyone know:

I'm wondering, can I restore my backup to a different location and use it as a new virtual OS, or would it confuse VMWare because it's exactly the same as the other? I see I can open a virtual machine "which will then be added to your library"

f0dder · « **Reply #41 on:** August 22, 2012, 04:58 AM »

I'm wondering, can I restore my backup to a different location and use it as a new virtual OS, or would it confuse VMWare because it's exactly the same as the other? I see I can open a virtual machine "which will then be added to your library"
-tomos (August 22, 2012, 04:56 AM)

If you make a copy of the VM files and open them, VMWare should ask you something to the effect of "is this a copy, or did you move the VM files?". It also does this after a reinstall (at least a full Windows reinstall, haven't reinstalled vmware on it's own).

tomos · « **Reply #42 on:** August 24, 2012, 06:11 AM »

I'm wondering, can I restore my backup to a different location and use it as a new virtual OS, or would it confuse VMWare because it's exactly the same as the other? I see I can open a virtual machine "which will then be added to your library"
-tomos (August 22, 2012, 04:56 AM)
If you make a copy of the VM files and open them, VMWare should ask you something to the effect of "is this a copy, or did you move the VM files?". It also does this after a reinstall (at least a full Windows reinstall, haven't reinstalled vmware on it's own).
-f0dder (August 22, 2012, 04:58 AM)

thanks f0dder (I missed that the other day).

BTW I ended up having to restore a backup (i.e. replace the current VM from a backup copy). It worked fine.

tomos · « **Reply #43 on:** August 24, 2012, 06:19 AM »

Anyone know about printers?
Can a printer be added? (I tried yesterday unsuccessfully -not looking for solutions here- just wondering if it *should* be possible).

If a printer is enabled in the virtual OS, is it then disabled in the main machine?

Stoic Joker · « **Reply #44 on:** August 24, 2012, 07:06 AM »

Anyone know about printers?
Can a printer be added? (I tried yesterday unsuccessfully -not looking for solutions here- just wondering if it *should* be possible).
-tomos (August 24, 2012, 06:19 AM)

Not that familiar with VMWare (I use MS's Virtual PC) but IIRC it does support USB, so yes it should be. Or if the printer used a parallel port it should be fine also. Network printers you can do anything you want with.

If a printer is enabled in the virtual OS, is it then disabled in the main machine?
-tomos (August 24, 2012, 06:19 AM)

No.

40hz · « **Reply #45 on:** August 24, 2012, 09:17 AM »

@tomos: Take a look at this article. (I'm assuming you're using Player rather than Workstation.)

Some additional resources:

Don't know if you're the reading type, but the proverbial "FMs" for Player can be downloaded from here.

VMWare hosts community forums which I've found helpful from time to time. And they also host interest and location specific groups although I've never joined one.

tomos · « **Reply #46 on:** August 24, 2012, 09:44 AM »

Thanks for the help/direction 40

I had just rooted out their forums myself ... there's an incredible range of forums there http://communities.vmware.com/community/

tomos · « **Reply #47 on:** August 24, 2012, 09:58 AM »

Just to note VMWare Player 5 has just been released
http://www.vmware.co...0-release-notes.html

(I havent installed it yet, wont get to it today anyway.)

xtabber · « **Reply #48 on:** September 26, 2012, 04:24 PM »

Both VMware Workstation and VirtualBox have just released major updates.

VMware Workstation 9 is an expensive ($119) upgrade barely a year after version 8 was released. It appears to bring some interesting new options, such as the ability to access a VM remotely or to mount a virtual disk as a drive on the host system, but it's getting harder to justify the cost versus the free (at least for personal use) of VirtualBox 4.2.

InfoWorld has a comparative review of VMware 9 and VirtualBox 4.2.

Screenshot - 9_26_2012 , 4_36_29 PM_thumb.png

mouser · « **Reply #49 on:** September 26, 2012, 04:36 PM »

Very nice find xtabber -- thanks for posting that link.