Question

我想检查我的应用程序是否在VMWare上运行。有可靠的方法在C ++中执行此操作吗？

Answer 1

我刚在codeproject上找到了这个程序集。

http://www.codeproject.com/KB/system/VmDetect.aspx

Answer 2

我认为this link可能会帮助你。它是汇编而不是C ++，但你总是可以在C ++中创建一个汇编块......

////////////////////////////////////////////////////////////////////////////////
//
//  Simple VMware check on i386
//
//    Note: There are plenty ways to detect VMware. This short version bases
//    on the fact that VMware intercepts IN instructions to port 0x5658 with
//    an magic value of 0x564D5868 in EAX. However, this is *NOT* officially
//    documented (used by VMware tools to communicate with the host via VM).
//
//    Because this might change in future versions - you should look out for
//    additional checks (e.g. hardware device IDs, BIOS informations, etc.).
//    Newer VMware BIOS has valid SMBIOS informations (you might use my BIOS
//    Helper unit to dump the ROM-BIOS (http://www.bendlins.de/nico/delphi).
//
function IsVMwarePresent(): LongBool; stdcall;  // platform;
begin
  Result := False;
 {$IFDEF CPU386}
  try
    asm
            mov     eax, 564D5868h
            mov     ebx, 00000000h
            mov     ecx, 0000000Ah
            mov     edx, 00005658h
            in      eax, dx
            cmp     ebx, 564D5868h
            jne     @@exit
            mov     Result, True
    @@exit:
    end;
  except
    Result := False;
  end;
{$ENDIF}
end;

与互联网上的任何代码一样，请注意仅复制和播放。粘贴它并期望它完美地运作。

Answer 3

我相信这种聪明的，“简单的” C ++-汇编代码可以帮助其他任何人。您可以在github页面上阅读有关它的更多信息。

https://github.com/dretax/VMDetect

int IsVMRunning()
{
#if _WIN64 
    UINT64 time1 = rdtsc();
    UINT64 time2 = rdtsc();
    if (time2 - time1 > 500) {
        return 1;
    }
    return 0;
#else 
    unsigned int time1 = 0;
    unsigned int time2 = 0;
    __asm
    {
        RDTSC
        MOV time1, EAX
        RDTSC
        MOV time2, EAX

    }
    if (time2 - time1 > 500) {
        return 1;
    }
    return 0;
#endif
}

以编程方式检测VMWare

3 个答案: