Red Pill (VM detection)
Joanna Rutkowska's 2004 trick for telling whether code runs inside a virtual machine using a single CPU instruction.
The SIDT instruction reveals where the interrupt descriptor table lives in memory, and it could be executed without privileges. A hypervisor on x86 before hardware virtualisation support had to relocate the guest's table, and under VMware it landed at a conspicuously high address. Read one byte and you had your answer. The name comes from The Matrix, where the red pill shows you what reality really looks like.
It was easy to fool and misfired on multi-core systems, but it showed how hard it is for a virtual machine to be invisible — something malware soon exploited to dodge analysis sandboxes. Two years later Rutkowska flipped the question around with Blue Pill.