VM Ware detection

[kimi]

jel moguce nekako detektovati da se program izvrsava na virtuelnoj masini (tipa u vmware-u)?

 

[zeleni_zub]

Google?

http://kb.vmware.com/selfservice/mi...nguage=en_US&cmd=displayKC&externalId=1009458

 

[kimi]

gugl mi je davao puno rezultata od ranije. problem je sto ni jedan od tih metoda nije sto posto siguran, pogotovo sto novije verzije programa za vm ispravljaju te starije "probleme".

enivej, hvala za link, pogledacu

 

[yooyo]

// vm_detect.h

#ifndef _vm_detect_h__
#define _vm_detect_h__

#ifdef __cplusplus
extern "C" {
#endif

extern int _cdecl IsInsideVMWare(void);
extern int _cdecl IsInsideVPC(void);

#ifdef __cplusplus
};
#endif

#endif // _vm_detect_h__

// vm_detect.cpp

#include <windows.h>

// IsInsideVPC's exception filter
DWORD __forceinline IsInsideVPC_exceptionFilter(LPEXCEPTION_POINTERS ep)
{
	PCONTEXT ctx = ep->ContextRecord;

	ctx->Ebx = -1; // Not running VPC
	ctx->Eip += 4; // skip past the "call VPC" opcodes
	return EXCEPTION_CONTINUE_EXECUTION; // we can safely resume execution since we skipped faulty instruction
}

// high level language friendly version of IsInsideVPC()
static bool x__IsInsideVPC()
{
	bool rc = false;

	__try
	{
		_asm push ebx
		_asm mov  ebx, 0 // Flag
		_asm mov  eax, 1 // VPC function number

		// call VPC 
		_asm __emit 0Fh
		_asm __emit 3Fh
		_asm __emit 07h
		_asm __emit 0Bh

		_asm test ebx, ebx
		_asm setz [rc]
		_asm pop ebx
	}
	// The except block shouldn't get triggered if VPC is running!!
	__except(IsInsideVPC_exceptionFilter(GetExceptionInformation()))
	{
	}

	return rc;
}

static bool x__IsInsideVMWare()
{
	bool rc = true;

	__try
	{
		__asm
		{
			push   edx
			push   ecx
			push   ebx

			mov    eax, 'VMXh'
			mov    ebx, 0 // any value but not the MAGIC VALUE
			mov    ecx, 10 // get VMWare version
			mov    edx, 'VX' // port number

			in     eax, dx // read port
			// on return EAX returns the VERSION
			cmp    ebx, 'VMXh' // is it a reply from VMWare?
			setz   [rc] // set return value

			pop    ebx
			pop    ecx
			pop    edx
		}
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		rc = false;
	}

	return rc;
}



extern "C"
int _cdecl IsInsideVMWare(void)
{
	if (x__IsInsideVMWare())
		return 1;
	return 0;
}

extern "C"
int _cdecl IsInsideVPC(void)
{
	if (x__IsInsideVPC())
		return 1;
	return 0;
}

Dodaj ova dva fajla u projekat i pozovi sa odgovarajuceg mesta proveru da li radi unutar VPC ili VMWare-a.

 

[kimi]

tnx.. probacemo sve 🙂

 

[nexilion]

static bool x__IsInsideVMWare()
{
	bool rc = true;

	__try
	{
		__asm
		{
			push   edx
			push   ecx
			push   ebx

			mov    eax, 'VMXh'
			mov    ebx, 0 // any value but not the MAGIC VALUE
			mov    ecx, 10 // get VMWare version
			mov    edx, 'VX' // port number

			in     eax, dx // read port
			// on return EAX returns the VERSION
			cmp    ebx, 'VMXh' // is it a reply from VMWare?
			setz   [rc] // set return value

			pop    ebx
			pop    ecx
			pop    edx
		}
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		rc = false;
	}

	return rc;
}

Pa sta radi u stvari VMWare? Stavlja informaciju o verziji na neki port VX? I zasto se ovde cuva sadrzaj registara edx, ecx i ebx na stek (a potom i restaurira sa steka) ako je ovo samo C funkcija koja ima deo tela radjenog u assembleru?