You are not logged in.
Hi,
I'm sharing code, enjoy!
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; VM - Detects if we're in a virtual mcahine like Virtual PC, VMWare, or ;; Bochs. If there are others, this is where they shall reside for ;; detecting them. ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; BochsDetectedMessage db 'Bochs detected',13,10,0 BochsNotDetectedMessage db 'Bochs not detected',13,10,0 BochsOn dd 0 DetectBochs: mov dx,0E9h in al,dx cmp al,0E9h je .InBochs mov eax,0 mov esi,BochsNotDetectedMessage jmp .Done .InBochs: mov eax,1 mov esi,BochsDetectedMessage .Done: mov [BochsOn],eax call PrintString ret ret align 4 VPCDetectedMessage db 'Virtual PC Detected',13,10,0 VPCNotDetectedMessage db 'Virtual PC Not Detected',13,10,0 align 4 VPCOn dd 0 DetectVPC: push ebx cli ; Turn off interrupts mov esi,VPCInvalidOpcodeException ; Store new Invalid Opcode Exception mov eax,6 ; Invalid Opcode is 6 call AddExceptionToIDT ; Call routine to replace it sti ; Turn on interrupts mov ebx,0 ; This will stay 0 if VPC running mov eax,1 ; VPC function number .CallVPC: db 0Fh,3Fh,07h,0Bh ; Call VPC test ebx,ebx jz .InVPC mov eax,0 mov esi,VPCNotDetectedMessage jmp .Done .InVPC: mov eax,1 mov esi,VPCDetectedMessage .Done: mov [VPCOn],eax call PrintString cli mov esi,UnhandledINT ; Restore original unhandled interrupt mov eax,6 ; Invalid Opcode is 6 call AddExceptionToIDT sti pop ebx ret ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; VPCInvalidOpcodeException - replaced invalid opcode exception handler with ;; this one to go past the VPC call in the above ;; procedure. ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; VPCInvalidOpcodeException: mov ebx,-1 ; Not running VPC add DWORD [esp],4 ; Fix the EIP in stack to skip past call VPC iret ;--------------------------------- ; We need this because ATA ; Identify command is NOT working ; under vmware ;) surprise! ;--------------------------------- align 4 VMWareDetectedMessage db 'VM Ware Detected',13,10,0 VMWareNotDetectedMessage db 'VM Ware Not Detected',13,10,0 ALIGN 4 VMWareOn dd 0 ; Default = 0 = OFF, 1 = ON DetectVMWare: mov eax,564D5868h ; 'VMXh' mov ebx,12345h ; This can be any number, but not 'VMXh' mov ecx,00Ah ; Get VMWare version mov edx,'VX' ; Port number IN eax,dx ; Read port 5658h cmp ebx,564D5868h ; Is this from the EAX? je .InVMWare ; Yes, goto flag it mov eax,0 mov esi,VMWareNotDetectedMessage jmp .Done .InVMWare: mov eax,1 mov esi,VMWareDetectedMessage .Done: mov [VMWareOn],eax call PrintString ret
I hope you all can use it...
Offline
Cool
( Here, too )
Axel
Offline
Thanks!
Offline
Pages: 1