Step 16. Understanding Virtualization — Building a Computer Inside a Computer

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time 2–3 hours

Prerequisite: Step 15 complete. Today you need an internet connection (to download VirtualBox). Since the next Step picks up right where this one ends, finish the installation today.

What you need: a Windows PC, PowerShell, an internet connection. 8GB or more of memory (RAM) is plenty — check in advance with the Get-ComputerInfo you learned in Step 5.
Caution: today’s exercises are 100% safe. The program we install is a famous piece of free software, and since we won’t even create a virtual machine yet, not a fingertip will touch your files.

There’s a clear reason you don’t run firecracker experiments in your living room: the house would burn down. Hacking practice is the same. You cannot deliberately build a vulnerable system, attack it, and break it on your actual computer. What you need is a practice ground where the outside stays unharmed no matter what you do inside — a virtual machine. Today we break ground.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain what a virtual machine (VM) and a hypervisor are
Draw the relationship between host and guest as a diagram
Explain what isolation is and why it’s a prerequisite for hacking practice
Check your computer’s memory and free disk space, and apply the VM allocation guideline
Download and install VirtualBox from its official site

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language & environment	PowerShell 5.1 (for checking resources) + the VirtualBox installer
Today’s commands	`Get-CimInstance Win32_ComputerSystem` (check memory), `Get-CimInstance Win32_LogicalDisk` (check free disk space)
Concepts needed	Virtual machines (VMs), hypervisors (Type 1/Type 2), host and guest, isolation, NAT

2-1. Virtual Machines — A Computer Inside a Computer

A virtual machine (VM) is a "fake computer" made of software. It has a CPU, memory, and a disk, but those parts are all imitated by a program. Inside it, you can install a separate operating system (Linux or Windows), and from the outside it behaves like a fully independent computer.

Think of it as a practice room dressed up like a film set occupying an entire apartment floor. Paint the walls, tear them down inside that room — close the door, and the apartment (the real computer) is just fine.

2-2. Hypervisors — The Manager Who Splits the Resources

Where do the fake computer’s parts come from? They’re borrowed by splitting the real computer’s resources. The software managing that allocation is the hypervisor — like an apartment management office distributing electricity, water, and space.

There are two kinds of hypervisor:

Kind	How it operates	Examples
Type 1 (native)	Runs directly on the hardware (no OS underneath)	Enterprise servers (VMware ESXi, etc.)
Type 2 (hosted)	Runs as a program on top of an existing OS	VirtualBox ← the one we’ll use

The VirtualBox we’re using is Type 2 — it installs as a program on your Windows and runs virtual computers inside it. Easy to install and free, it’s the standard for beginners.

2-3. Host and Guest — Owner and Visitor

Pin down these two terms firmly:

Host — the real computer (your Windows PC). The owner
Guest — the computer inside the virtual machine (the Linux we’ll install soon). The visitor

"I deleted a file inside the guest, and the host is perfectly fine" — once that sentence feels natural, you’ve finished half of today’s concepts.

2-4. Why Virtual at All — Wouldn’t Two Real Computers Do?

"Why not just buy two computers?" is a natural question. Let me list the answers.

Money: buying an experiment computer every time means bankruptcy. VMs are free
Count: you need an attacking side and a victim side — sometimes three machines or more. With VMs, one click adds another
Rollback: when a physical computer breaks, reinstallation takes hours. With a VM, snapshots take seconds (the topic of Step 17)
Disposal: a finished VM is deleted like a file. No traces, no cost

Because of these advantages, virtually all of the security industry’s practice environments sit on top of virtualization. Personal practice labs, corporate breach-training facilities (called cyber ranges), and CTF competition servers alike.

2-5. Isolation — The Seatbelt of Hacking Practice

Today’s core concept. Guest and host are isolated from each other. Delete system files inside the guest, wreck the settings — the damage ends inside the virtual machine.

What this isolation makes possible:

Building deliberately vulnerable systems — safely operating practice targets to be attacked
Breaking things — changing settings, deleting, experimenting
Rolling back — restoring to the original state in seconds with Step 17’s snapshots

And it is also an ethical safety device. Every attack exercise in this book takes place only inside this isolated lab. Attacking real services outside the lab without authorization is a crime — a principle that never changes throughout this book.

3. Follow Along

3-1. Checking My Computer’s Resources

Let’s first see whether we have resources to share with a VM. In PowerShell:

Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory
Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object FreeSpace

TotalPhysicalMemory
-------------------
        17051418624

(Screen example — the numbers on your computer will differ.)

How to read the output: the number is too big to read easily, right? Drop the last nine digits and you get a rough GB figure — 17,051,418,624 bytes ≈ 16GB. 8GB of memory or more is sufficient; 16GB is comfortable. For free disk space, we recommend at least about 30GB (one VM occupies around 25GB).

Why do this: because VMs share real resources, allocating without checking your balance slows down the host. "Check the balance before allocating" is the first move every time you build a VM from now on.

3-2. Downloading VirtualBox

In your browser, go to virtualbox.org
Click the big "Download VirtualBox" button
From the platform list, choose Windows hosts (because our host is Windows)

Important — why the official site: make a habit of always downloading programs from the official site. The more popular a free tool is, the more likely a "repackaged" fake site appears as an ad at the top of search results, and those installers come with extras (adware, or in the worst case, malware). Double-checking the address bar — that one-second habit is security.

3-3. Installing

Run the downloaded installer and:

Next → Next → (leave every setting at its default)
A warning midway about "installing network interfaces; the connection may be temporarily interrupted" → Yes (it’s installing a virtual network card for VMs)
If a device software installation confirmation appears → Install
When finished, launch VirtualBox

Confirming success: if the VirtualBox Manager window opens, installation succeeded. The list is empty for now — this is where we’ll start building computers, one by one.

3-4. Knowing About Virtualization Features (VT-x/AMD-V) in Advance

When you later start a VM, an error like "VT-x is not available" may appear. It means the CPU’s virtualization support feature is turned off.

CPUs carry a dedicated feature that helps hypervisors work efficiently (Intel calls it VT-x, AMD calls it AMD-V), but on some computers it’s off by default. How to enable it:

Reboot the computer → when the manufacturer logo appears, repeatedly tap Del or F2 (varies by manufacturer) → enter BIOS/UEFI settings
In the Advanced or CPU Configuration menu, find the Intel VT-x / AMD-V / Virtualization entry
Change it to Enabled → save and exit (usually F10)

Hardware virtualization has no everyday use on consumer PCs, so some manufacturers ship it off. The error message tells you this kindly enough, so don’t be intimidated — just follow the instructions.

3-5. How Does Networking Work — A Preview of NAT

You might later marvel at the internet working inside the VM. To sketch the principle briefly: by default, VirtualBox uses a method called NAT (Network Address Translation). The VM sits on a virtual private network, and the host relays its communication with the outside. VirtualBox is doing in software the router role you learned in Step 6.

Why this default matters from a security standpoint: the path for the outside (the other devices on your home network) to reach directly into the VM is blocked. It’s a structure where outbound works but inbound doesn’t. For now, just remember that the default as-is is safe.

3-6. Drawing the Concept Diagram

With installation done, let’s draw today’s structure by hand (paper or Notepad):

┌─────────────────────────────────────┐
│  게스트 VM (리눅스) ← Step 17에서      │
│  가상 CPU 2개 / 가상 RAM 2GB /         │
│  가상 디스크 25GB                      │
├─────────────────────────────────────┤
│  하이퍼바이저 (VirtualBox)             │
├─────────────────────────────────────┤
│  호스트 OS (여러분의 윈도우)            │
├─────────────────────────────────────┤
│  진짜 하드웨어 (CPU, RAM 16GB, SSD)    │
└─────────────────────────────────────┘

Check questions: ① Where does the guest’s "virtual RAM 2GB" come from? (It’s carved out of the host’s real RAM) ② If the guest breaks down, how far up does the damage reach? (Only as far as the guest layer — isolation)

Predict this: if the host has 8GB of memory and you assign 6GB to a VM, what happens? (Answer: Windows struggles to survive on the remaining 2GB, and everything slows down. The rule of thumb for VM allocation is "half of the host or less." We’ll apply this guideline when we actually allocate in Step 17.)

4. Missions & Exercises

Mission — Writing a Lab Design Document

In Notepad, write a design document for the lab you’re about to build in earnest:

Record your computer’s total memory and the C: drive’s free space (use the Section 3-1 commands)
A resource plan for the first VM (Linux): how many MB of memory, how many GB of disk (apply the half-of-host rule)
One line on what this VM will be used for (e.g., "Linux practice and a target for future attack exercises")
In two lines, set for yourself "what may be done / what must not be done in this lab" (hint: free rein inside the lab / attacking real services outside the lab is forbidden)

How to verify yourself: if item 4 is written, you’re done. This design document will keep serving you when you build the Level 2 lab.

Exercises

Question 1. Explain the difference between Type 1 and Type 2 hypervisors in terms of "position relative to the operating system," and state which side VirtualBox is on.

Question 2. When the host has 16GB of memory, what is a sensible maximum to allocate to a VM, and what’s the reasoning behind that guideline?

Question 3. "Since anything goes inside a VM, it’s fine to attack someone’s website from inside a VM" — which part of this sentence is wrong?

Question 4. Translate "I spun up an instance" on a cloud service (AWS, Azure, etc.) into today’s concepts.

5. Model Answers & Completion Criteria

Mission Model Answer

Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory
Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object FreeSpace

Example design document:

[랩 설계서]
- 호스트: RAM 16GB / C: 여유 120GB
- VM 1(Ubuntu-Lab): RAM 4096MB / 디스크 25GB (호스트 절반 이하 규칙 충족)
- 용도: 리눅스 연습 및 향후 공격 실습용 표적
- 규칙: 랩 안에서는 설치·삭제·공격 실험 전부 자유.
        랩 밖의 실제 서비스·타인 시스템 공격은 절대 금지.

How to verify: ① is the allocated memory half of the host or less? ② is the free disk space comfortably larger than the VM size? ③ does the "must not do" section explicitly forbid attacks outside the lab? If all three check out, it’s complete.

Exercise Answers

Answer 1. Type 1 runs directly on the hardware with no operating system underneath (for enterprise servers); Type 2 installs and runs as an ordinary program on top of an existing operating system. VirtualBox, installed on Windows, is Type 2.

Answer 2. Half — 8GB — is the upper bound (for comfort, you usually start at 4GB). Since the memory a VM eats leaves the real RAM pool, leaving too little for the host slows Windows itself until neither side is usable.

Answer 3. Isolation is merely a technical guarantee that "damage doesn’t spread to the host" — it is not a legal or ethical license. Even an attack launched from inside a VM does its damage beyond the isolation if the target is a real service outside the lab, and that is a crime. What isolation protects is "my computer," not "responsibility for my actions."

Answer 4. Translate it as: "A hypervisor is running on someone else’s giant physical server, and I’ve been leased one guest (virtual machine) inside it." The essence of the cloud is cloud companies automating, at a scale of tens of thousands of machines, exactly what you did with VirtualBox today.

Completion Criteria Checklist

[ ] I can explain what a virtual machine is as "a computer inside a computer"
[ ] I can draw the relationship among hypervisor, host, and guest
[ ] I can explain what isolation is and why it’s essential for hacking practice
[ ] I checked my computer’s memory and free disk space
[ ] I downloaded VirtualBox from the official site and installed it
[ ] I know the "half of host or less" guideline for VM resource allocation
[ ] Mission: I wrote the lab design document

6. Common Pitfalls & Fixes

Wall 1. I’m not sure the download site is the real one

Symptom: a search turns up several similar-looking sites.
Cause: popular free software is always surrounded by fake and repackaged sites.
Fix: confirm the address bar says exactly virtualbox.org. Skip the topmost results that appear as ads (marked "Ad"); the safest habit is typing the official domain yourself.

Wall 2. A network warning during installation scares me

Symptom: a warning saying "network connections may be temporarily interrupted."
Cause: installing a virtual network card for VMs requires resetting the real network device.
Fix: it’s a normal part of the procedure. Click "Yes." The internet drops for a moment and returns a few seconds later.

Wall 3. Installation worked, but starting a VM throws a virtualization error

Symptom: errors like "VT-x is not available" or "AMD-V is disabled."
Cause: the CPU’s virtualization feature is turned off in BIOS/UEFI (Section 3-4).
Fix: enable it in the BIOS as described in Section 3-4. The entry key differs by manufacturer, so a search for "my laptop brand + enter BIOS" will give you the answer right away.

Wall 4. I’m worried my computer will slow down

Symptom: with a VM running, the fan spins up and things stutter.
Cause: a VM is a heavy guest that consumes real resources. Large memory allocations, in particular, strain the host.
Fix: the answer is to shut the VM down when you’re not using it. Keep allocations within the half-of-host rule, and if that’s still too much, start with the minimum spec of 2048MB of memory.

Wall 5. The question "is inside a VM really 100% safe?"

Symptom: you’re uneasy about trusting isolation.
Cause: a good suspicion.
Fix: the honest answer — isolation is very strong, but not theoretically 100% (an advanced class of attack called virtual machine escape exists). Still, for the level of exercises in our course it’s a sufficient safety device, and working malware analysts use VMs as their standard practice ground too. "Not perfect safety, but managed risk" — that perspective itself is fundamental security thinking.

7. Summary

Today’s Concepts

Concept	One-line description
Virtual machine (VM)	A computer inside a computer, made of software
Hypervisor	The manager that splits real resources and assigns them to guests
Type 1 / Type 2	Directly on the hardware / as a program on an existing OS
Host / Guest	The real computer / the virtual machine
Isolation	The property that damage inside the guest never reaches the host
NAT	The default network mode where the host relays the VM’s outside communication

Today’s Commands

Command	What it does
`Get-CimInstance Win32_ComputerSystem`	Checks total memory (balance check before allocation)
`Get-CimInstance Win32_LogicalDisk`	Checks drive free space

A Sense That Matters More Than Commands

There’s one reason VMs are used for hacking practice — no matter how badly things break inside, the outside stays unharmed. Isolation is both a technical safety device and an ethical fence that makes legal practice possible.

Keep two more things in mind. First, the essence of the clouds companies use, like AWS and Azure, is a giant-scale version of today’s lesson — translate "spun up an instance" as "received one guest on someone else’s hypervisor." Second, if a VM "imitates an entire computer," a container (Docker and the like) is a lighter cousin that isolates just one room of the operating system. The purpose is the same — isolation. Part of this book’s later exercise environments are delivered as containers, so for now just remember the name.

From today, your computer has a practice ground. The habit of asking, before installing or experimenting with anything, "is this a job for the lab, or a job for the outside?" — that is this chapter’s true deliverable.

Once every box is checked, Step 16 is complete. Click the checkbox in the sidebar to save your progress.