title: How does Windows 10 task manager detect a virtual machine?
body: <p>The Windows 10 task manager (taskmgr.exe) knows if it is running on a physical or virtual machine.  </p>
  
  <p>If you look in the <em>Performance</em> tab you'll notice that the number of processors label either reads <em>Logical processors:</em> or <em>Virtual processors:</em>.  </p>
  
  <p>In addition, if running inside a virtual machine, there is also the label <em>Virtual machine: Yes</em>.  </p>
  
  <p>See the following two screen shots:</p>
  
  <p><a href="https://i.stack.imgur.com/49Z8e.png" rel="noreferrer"><img src="https://i.stack.imgur.com/49Z8e.png" alt="taskmgr locical processors"></a></p>
  
  <p><a href="https://i.stack.imgur.com/QYm5Z.png" rel="noreferrer"><img src="https://i.stack.imgur.com/QYm5Z.png" alt="taskmgr virtual processors"></a></p>
  
  <p>My question is if there is a documented API call taskmgr is using to make this kind of detection?</p>
  
  <p>I had a very short look at the disassembly and it seems that the detection code  is somehow related to <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/dd405488(v=vs.85).aspx" rel="noreferrer">GetLogicalProcessorInformationEx</a> and/or <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/ms724482(v=vs.85).aspx" rel="noreferrer">IsProcessorFeaturePresent</a> and/or <a href="https://docs.microsoft.com/en-us/windows/desktop/api/winternl/nf-winternl-ntquerysysteminformation" rel="noreferrer">NtQuerySystemInformation</a>.</p>
  
  <p>However, I don't see how (at least not without spending some more hours of analyzing the assembly code).</p>
  
  <p>And: This question is IMO not related to other existing questions like <em>How can I detect if my program is running inside a virtual machine?</em> since I did not see any code trying to compare smbios table strings or cpu vendor strings with existing known strings typical for hypervisors ("qemu", "virtualbox", "vmware"). I'm not ruling out that a lower level API implementation does that but I don't see this kind of code in taskmgr.exe.</p>
  
  <p><strike>Update: I can also rule out that taskmgr.exe is using the <a href="https://en.wikipedia.org/wiki/CPUID#EAX=1:_Processor_Info_and_Feature_Bits" rel="noreferrer">CPUID</a> instruction (with EAX=1 and checking the <em>hypervisor</em> bit 31 in ECX) to detect a matrix.
  </strike></p>
  
  <p>Update: A closer look at the disassembly showed that there is indeed a check for bit 31, just not done that obviously.</p>
  
  <p>I'll answer this question myself below.</p>