Virtual PC and VMware: A Comparative Review
Date: Jun 16, 2006
Dueling Virtualization Tools
Years ago, my favorite co-consultant was the guy who shipped his own hub and four portables to each engagement. His security engagements were as much security tutorials as they were fast remedies, made all the more convincing given his dedication to maintaining a test environment.
These days, we security professionals can have it all. We can configure a hefty portable with subnets and with computer systems thanks to virtualization tools like Virtual PC and VMware workstation. Have you ever wondered which might be better? This article will help you decide.
My target installations are Windows XP Home and Damn Small Linux (DSL), a very likable, compact Linux that provides the best of Debian in a small system footprint. Choosing such different operating systems provides interesting comparisons:
- How responsive will the virtualization software be when running something as feature-rich as XP Home? Many of my presentations discuss home security, where XP and Windows 2000 are the predominant "kings of the hill."
- How well can the virtualization software accommodate an unknown Linux distribution that may have quirks? Does the software truly emulate a PC, or is it only able to run a special OS or two on a PC?
- Linux seems to prefer set hardware types, which you find out when you scour the Internet to get your brand new soundcard working. Will the virtual PC's emulated hardware be generic enough to run common Linux?
I'm sponsoring both software packages on a dual-core AMD HP portable with 1.25GB RAM, running Windows XP Pro (because the encryption and other features make it a must-have over mere XP Home).
Ease of Installation
Both products have easy installation processes. The VMware installation had a small flaw, though: It warns against keeping CD Autoplay enabled. I don't run CD Autoplay for security reasons. I confirmed that Autoplay is disabled in my Group Policy Editor (gpedit.msc) before continuing the installation. Figure 1 shows my policy.
)
Figure 1 Autoplay is off by default.
The installation process didn't enable Autoplay, but the fact that it couldn't sense that it was disabled is unnerving. It's an easy configuration to check. What other installation mistakes might there be?
Overall, though, I think that the two products are equally easy to install, with slight points to Virtual PC for a more comforting installation process.
Ease of DSL Installation
Virtual PC continued to install DSL, and all virtualized hardware items it provided were recognized by DSL. I can run a 700MB instance that's responsive and easily expanded through the use of apt or via the GUI tool synaptic.
On the other hand, VMware was unable to boot DSL reliably. If it did boot, the DSL hard drive installation process abended (abnormally ended) at odd inconsistent points, and VMware itself abended. It would consume increasingly massive amounts of memory. Regaining control required a forced power-down.
I tried fiddling with the myriad VMware options, but nothing worked. I tried to build an IDE disk instead of using a SCSI disk. I found no option for this approach. Not sure why the wizard built a SCSI disk—actually, there are many options I'm not sure about. I didn't see a disk "wizard" like Virtual PC's that would let me do what I wanted or allow me to get to the configuration options more directly.
In VMware's defense, it has many Linux templates set up for several popular distributions. Going to these flavors would require a lot more hard disk gigabytes per instance, though, which gets a bit trying on an 80GB hard drive used for security video production. I've set up White Box Linux quite well with both products, but that's overkill for my needs.
I wish I could report that Virtual PC is the perfect match, but it isn't. USB drives are only mountable directly if you install the Additions package. The Additions package doesn't support Linux directly. There is a workaround of sorts, but only if the virtual instances are configured to network with each other. The physical Windows instance will share out the USB drive as a shared drive. The DSL instance will use SAMBA to mount the drive. It's a lot like my car—it works, but it ain't pretty.
Oddly enough, Virtual PC's Additions package supports the world's worst brain-dead operating system, OS/2, an OS that became DOA in the face of the vastly superior Windows and Windows NT. My only hope is a recent announcement indicating that Virtual PC will support Linux installations more directly.
Windows XP Home Installation
VMware really rocked with this one. The installation was quick and efficient, and the response time only got better once the VMware Tools were loaded. Virtual PC was agonizingly slow when the instance was set to 128MB of virtualized RAM, the default setting. I think that one setting is a large mistake. Even with 128MB of physical RAM, installing XP Home would be s-l-o-w. So after abending the installation, I reset the virtual machine to use 256MB RAM, per the VMware settings.
After this one change, installation was much, much snappier and only got better once the Additions for Windows, DOS, and OS/2 were installed.
Both products run a mean, responsive Windows XP Home. One runs a mean, responsive suite of Windows and DSL instances. I wish both could, but I found it challenging to do with VMware what I can do simply and easily with Virtual PC. Sure, maybe I could try to install DSL with one of the other Linux templates. Maybe I could try the Windows templates to get my more generic IDE drive. Overall, I just don't think it needs to be this difficult, and it isn't with Virtual PC.
Other Abilities and Features
So, having built a good virtual instance, how easily can you clone it? After all, you don't want to suffer through multiple software installations. How complicated is it to clone a working instance in both products?
Figure 2 shows VMware's straightforward approach to replicating instances.
)
Figure 2 Send in the clones.
I like the multiple options and how clearly they're described. The "linked clone" option seems to provide some hard disk savings. I wonder about the impacts of using shared files across the instances, though. Windows stores many settings in the Registry; will those settings be shared across instances during a security demo that shows running with and without the screensaver password?
Why am I so nervous? Well, here's where that inability to detect Autoplay seems to come back to me.
I don't like Autoplay. I routinely disable it. But I now find that all my VMware instances have Autoplay enabled. I believe that the VMware panel asking about Autoplay preferences needs more explanation. I really don't want to fiddle to find how to disable it within VMware, nor do I want to create a policy manually, given XP Home's lack of support for Group Policy Manager.
So with this situation as background, is it likely that I'll have "linked clone" issues, with settings from common files bleeding into the separate instance? That may not be a concern. I quickly set the desktop to the "Windows Classic" template on my cloned instance. This arrangement makes it more responsive. This change in no way affected the baseline instance.
This exercise brings up another interesting difference between the two products. Virtual PC spawns multiple independent windows. VMware seems to spawn only child/MDI windows. This setup hurts my ability to display simultaneous machines, their settings, and their running script in real time. These abilities are vital when making presentations, and the lack makes VMware unusable for my purposes.
There's no official clone option in Virtual PC. I routinely make a copy of the settings and virtual hard disk directory. I then go into the admin console and configure a new Virtual PC to use the copied files. Again, it ain't pretty, but it works.
Final Judgment
Overall, I like Virtual PC. It's easy to whip up generic enough Virtual PCs that run with many of the oddball tools a security researcher needs to try out. The controls are elemental.
And that's also its main limitation: It's a bit elemental. There's no built-in support for Linux in the Additions package that improves performance. The templates have no support for trying out Vista, the next great version of Windows. Something as basic as USB drive support in the virtual instance is implemented with shared drives—and these only in DOS, Windows, and OS/2 Virtual PCs. (OS/2? Let the dinosaur die, please!)
But before you get out the money for VMware, understand that it offers a lot of features, but they work with mixed results. Sure, there's a template for Vista, but it doesn't work with Vista 5308. Yes, there's great Linux support, but not for something as generic as DSL. And with all of those abilities comes a dizzying array of knobs, features, and configurations to twist and turn into a working machine. That sort of unpredictability and specialized configuration tuning seems to hurt research. Was the effect truly representative of what will happen on common PCs?
In contrast to VMware's behavior, Virtual PC lets me do a majority of what I need to do—in just minutes. Testing on physical PCs shows high predictability. But I haven't been able to run Vista on it for some time, and even then it was slow. Imagine having the dual virtual-processor abilities that VMware advertises. No matter—Vista won't run on it as well without blue-screening the installation. Maybe it's something with my portable and its dual core? Maybe 1.25GB RAM isn't enough? Maybe going with a tool that's easier to diagnose is better?
Ultimately, the decision is yours. Overall, my experiences with Virtual PC have been very good. Now that Virtual PC Server 2005 R2 will be free, I think that the server versions of these tools will make for a good follow-up article. To do that, you'll need to indicate your interest in the comments below, and I'll need to max out the RAM in my test PC. Until then, I can't wait to remove VMware and its services that run at system startup, whether I run an instance or not. I should have known that this product would consume resources in a big way, when the installation required a reboot!
Meanwhile, here's hoping that Virtual PC comes out with an easier cloning process, support for Vista, and a few other goodies. It has a lot going for it now and can only get better.