VMWare (anti) detection EXCEPTION_PRIV_INSTRUCTION?

255 views Asked by At

Is it possible to avoid VMWare detection against the following method?

I found this code is used really often:

            push    edx
            push    ecx
            push    ebx
    
            mov     eax, 'VMXh'
            mov     ebx, 0          // anything but 'VMXh'
            mov     ecx, 10         // get VMWare version
            mov     edx, 'VX'       // port number
            in      eax, dx         // read port
            cmp     ebx, 'VMXh'     // is it a reply from VMWare?
            je      lblInVMWare
    
            xor     ecx, ecx        // not in VMWare - clear return value
    
        lblInVMWare:
            mov     [nVersion], ecx // vmware product type
            pop     ebx
            pop     ecx
            pop     edx

There is a description how it works: https://www.codeproject.com/Articles/9823/Detect-if-your-program-is-running-inside-a-Virtual

To be brief, that 'magic'/special port (in eax, dx // read port) gives something and that's impossible to run on a real computer because of the exception (privileged instruction)

According to this article I tried to use a few parameters in my VMX file:

monitor_control.disable_directexec = true"
monitor_control.disable_chksimd = "true"
monitor_control.disable_ntreloc = "true"
monitor_control.disable_selfmod = "true"
monitor_control.disable_reloc = "true"
monitor_control.disable_btinout = "true"
monitor_control.disable_brmemspace = "true"
monitor_control.disable_btpriv = "true"
monitor_control.disable_btseg = "true"
isolation.tools.getPtrLocation.disable = "true"
isolation.tools.setPtrLocation.disable = "true"
isolation.tools.setVersion.disable = "true"
isolation.tools.getVersion.disable = "true"

and removed VMWare Tools but failed

(I use x32dbg to see what's going on - the code works successfully on VM and doesn't give me any exceptions)

0

There are 0 answers