Skip to content

vmware: add GETTIME backdoor command (23)#1590

Open
felixrieseberg wants to merge 1 commit into
copy:masterfrom
felixrieseberg:vmware-gettime-pr
Open

vmware: add GETTIME backdoor command (23)#1590
felixrieseberg wants to merge 1 commit into
copy:masterfrom
felixrieseberg:vmware-gettime-pr

Conversation

@felixrieseberg

@felixrieseberg felixrieseberg commented Jun 14, 2026

Copy link
Copy Markdown
Contributor

Just like the other VMWare-related PRs, no hard feelings if you don't want them - I just want to upstream stuff I've done for Windows. This one implements implements VMware backdoor command 23 (GETTIME) on port 0x5658.

Return values in registers after the IN EAX, DX:

Register Value
EAX Seconds since the Unix epoch (UTC), unsigned
EBX Remaining microseconds (0–999 999)
ECX Maximum time lag in microseconds (hardcoded 1 000 000)
EDX Host's UTC offset in minutes, east positive

Guests read the RTC only at boot. A VM resumed from a saved state continues running with whatever clock it was saved with, and the guest has no way to learn the correct time without rebooting.

With GETTIME, a small guest agent can issue a single backdoor call on a timer and compare its own time() against the host — no kernel driver, no full VMware Tools stack. The protocol is simple enough for a hand-rolled 16/32-bit DOS or Win9x TSR.

Notes on GETTIMEFULL

VMware deprecated GETTIME in favour of command 35 (GETTIMEFULL) because EAX wraps as a signed value in 2038. Read as unsigned (which is what >>> 0 gives JS, and what 32-bit C gives with unsigned long), EAX is valid until 2106. GETTIME is simpler for the guest to consume and is still the first thing open-vm-tools' Backdoor_GetTime wrapper tries. I think for our purposes her eis is probably fine :)

Returns the host's wall-clock time: EAX = seconds since the Unix epoch
(UTC), EBX = remaining microseconds, ECX = maximum time lag in
microseconds, EDX = host offset from UTC in minutes (east positive).

Guests only read the RTC at boot, so a VM resumed from a saved state
keeps running with the clock it was saved with. With this command a
small guest agent can periodically compare its clock against the host
and correct it without a reboot.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant