最近写程序,碰到要检测程序是否运行在虚拟机内的问题。在网上找了一下,找到下面两个函数,可以检测程序是否运行在virtual machine中,支持VMWARE 和virtual pc检测. 主要的原理,都是利用virtual machine往往支持一些真实PC不支持的指令.
// IsInsideVPC's exception filter DWORD __forceinline IsInsideVPC_exceptionFilter(LPEXCEPTION_POINTERS ep) { PCONTEXT ctx = ep->ContextRecord;
ctx->Ebx = -1; // Not running VPC ctx->Eip += 4; // skip past the "call VPC" opcodes return EXCEPTION_CONTINUE_EXECUTION; // we can safely resume execution since we skipped faulty instruction }
// High level language friendly version of IsInsideVPC() bool IsInsideVPC() { bool rc = false;
__try { _asm push ebx _asm mov ebx, 0 // It will stay ZERO if VPC is running _asm mov eax, 1 // VPC function number
// call VPC _asm __emit 0Fh _asm __emit 3Fh _asm __emit 07h _asm __emit 0Bh
_asm test ebx, ebx _asm setz [rc] _asm pop ebx } // The except block shouldn't get triggered if VPC is running!! __except(IsInsideVPC_exceptionFilter(GetExceptionInformation())) { }
return rc; }下面是检测virtual PC的.bool IsInsideVMWare() { bool rc = true;
__try { __asm { push edx push ecx push ebx
mov eax, 'VMXh' mov ebx, 0 // any value but not the MAGIC VALUE mov ecx, 10 // get VMWare version mov edx, 'VX' // port number
in eax, dx // read port // on return EAX returns the VERSION cmp ebx, 'VMXh' // is it a reply from VMWare? setz [rc] // set return value
pop ebx pop ecx pop edx } } __except(EXCEPTION_EXECUTE_HANDLER) { rc = false; }
return rc; }
(iwgh) |