反虚拟机代码

http://www.axvis.net/thread-1596.html#ixzz1I9toPX5P

 

#include "antibox.h"

DWORD __forceinline IsInsideVPC_exceptionFilter(LPEXCEPTION_POINTERS ep)
{
PCONTEXT ctx = ep->ContextRecord;
ctx->Ebx = -1; // Not running VPC
ctx->Eip += 4; // skip past the "call VPC" opcodes
return EXCEPTION_CONTINUE_EXECUTION;
}
bool IsVPC()
{
bool bVPCIsPresent = FALSE;

__try
{
_asm push ebx
_asm mov ebx, 0 // It will stay ZERO if VPC is running
_asm mov eax, 1 // VPC function number
_asm __emit 0Fh
_asm __emit 3Fh
_asm __emit 07h
_asm __emit 0Bh
_asm test ebx, ebx
_asm setz [bVPCIsPresent]
_asm pop ebx
}

__except(IsInsideVPC_exceptionFilter(GetExceptionI nformation()))
{
}
return bVPCIsPresent;
}
bool IsVMware2()
{
bool bVMWareIsPresent = TRUE;
__try
{
__asm
{
push edx
push ecx
push ebx

mov eax, 'VMXh'
mov ebx, 0 // any value but not the MAGIC VALUE
mov ecx, 10 // get VMWare version
mov edx, 'VX' // port number

in eax, dx // read port
// on return EAX returns the VERSION
cmp ebx, 'VMXh' // is it a reply from VMWare?
setz [bVMWareIsPresent] // set return value

pop ebx
pop ecx
pop edx
}
}

__except(EXCEPTION_EXECUTE_HANDLER)
{
bVMWareIsPresent = FALSE;
}

return bVMWareIsPresent;
}

bool IsAnubis()
{
char File[MAX_PATH];
bool Present = FALSE;

if (strstr(File, "C://InsideTm//"))
Present = TRUE;
return Present;
}

bool IsNorman()
{
CHAR szUserName[MAX_PATH];
DWORD dwUserNameSize = sizeof(szUserName);
GetUserName(szUserName, &dwUserNameSize);
if(!strcmp(szUserName, "CurrentUser"))
{
return TRUE;
}
else
{
return FALSE;
}
}

bool IsSunbelt()
{
CHAR szFileName[MAX_PATH];
GetModuleFileName(NULL, szFileName, MAX_PATH);
if(!strcmp(szFileName, "C://file.exe"))
{
return TRUE;
}
else
{
return FALSE;
}
}

bool IsVirtualPC()
{
__try
{
__asm
{
mov eax, 1
_emit 0x0F
_emit 0x3F
_emit 0x07
_emit 0x0B
_emit 0xC7
_emit 0x45
_emit 0xFC
_emit 0xFF
_emit 0xFF
_emit 0xFF
_emit 0xFF
}
}
__except(1)
{
return FALSE;
}
return TRUE;
}

bool IsVMware()
{
DWORD _EBX;
__try
{
__asm
{
push ebx
mov eax, 0x564D5868
mov ebx, 0x8685D465
mov ecx, 0x0A
mov dx, 0x5658
in eax, dx
mov _EBX, ebx
pop ebx
}
}
__except(1)
{
return FALSE;
}
return _EBX == 0x564D5868;
}

bool IsInVM()
{
bool bVMware;
bool bVMware2;
bool bVPC;
bool bAnubis;
bool bAnubis2;
bool bVirtualPC;
bool bSunbelt;
bool bInVPC;
bool bNorman;

bAnubis = IsAnubis();

bVMware = IsVMware();
bVMware2 = IsVMware2();

bVPC = IsVPC();
bNorman = IsNorman();
bSunbelt = IsSunbelt();
bVirtualPC = IsVirtualPC();

if (bVPC==TRUE || bVMware==TRUE || bAnubis==TRUE || bVirtualPC==TRUE || bVMware2==TRUE || bNorman==TRUE || bSunbelt==TRUE)
return TRUE;

return FALSE;
}

Source: http://www.axvis.net/thread-1596.html#ixzz1I9toPX5P