通过Firmware检测虚拟机环境

// 不支持XP 5.2 from Windows Server 2003 SP1, and higher
//
#define SystemFirmwareTableInformation 76
// 根据EnumSystemFirmwareTables与GetSystemFirmwareTable封装;
//
NTSTATUS
OSLibEnumSystemFirmwareTables(
__in ULONG FirmwareTableProviderSignature,
__out PSYSTEM_FIRMWARE_TABLE_INFORMATION* FirmWareTableInformation
)
{
    NTSTATUS Status = STATUS_SUCCESS;
    ULONG ReturnLength = 0;
    PSYSTEM_FIRMWARE_TABLE_INFORMATION FirmWareTable = NULL;

    do
    {
        FirmWareTable = (PSYSTEM_FIRMWARE_TABLE_INFORMATION)ExAllocatePoolWithTag(
            PagedPool,
            sizeof(SYSTEM_FIRMWARE_TABLE_INFORMATION),
            KLIB_KAPI_TAG
            );
        if (FirmWareTable == NULL)
        {
            Status = STATUS_INSUFFICIENT_RESOURCES;
            break;
        }

        while (TRUE)
        {
            FirmWareTable->ProviderSignature = FirmwareTableProviderSignature;
            FirmWareTable->TableID = 0;
            FirmWareTable->TableBufferLength = ReturnLength;
            FirmWareTable->Action = SystemFirmwareTable_Enumerate;

            Status = ZwQuerySystemInformation(
                SystemFirmwareTableInformation,
                FirmWareTable,
                ReturnLength + sizeof(SYSTEM_FIRMWARE_TABLE_INFORMATION),
                &ReturnLength
                );
            if (NT_SUCCESS(Status))
            {
                break;
            }

            if (Status == STATUS_BUFFER_TOO_SMALL || Status == STATUS_INFO_LENGTH_MISMATCH)
            {
                ReturnLength = FirmWareTable->TableBufferLength;
                ExFreePoolWithTag(FirmWareTable, KLIB_KAPI_TAG);
                FirmWareTable = NULL;

                FirmWareTable = (PSYSTEM_FIRMWARE_TABLE_INFORMATION)ExAllocatePoolWithTag(
                    PagedPool,
                    sizeof(SYSTEM_FIRMWARE_TABLE_INFORMATION) + ReturnLength,
                    KLIB_KAPI_TAG
                    );
                if (FirmWareTable == NULL)
                {
                    Status = STATUS_INSUFFICIENT_RESOURCES;
                    break;
                }
            }
            else
            {
                break;
            }

        }

    } while (FALSE);

    if (Status != STATUS_SUCCESS)
    {
        ExFreePoolWithTag(FirmWareTable, KLIB_KAPI_TAG);
        FirmWareTable = NULL;
    }
    else
    {
        *FirmWareTableInformation = FirmWareTable;
    }

    return Status;
}

NTSTATUS
OSLibGetSystemFirmwareTables(
__in ULONG FirmwareTableProviderSignature,
__in ULONG FirmwareTableID,
__out PSYSTEM_FIRMWARE_TABLE_INFORMATION* FirmWareTableInformation
)
{
    NTSTATUS Status = STATUS_SUCCESS;
    ULONG ReturnLength = 0;
    PSYSTEM_FIRMWARE_TABLE_INFORMATION FirmWareTable = NULL;

    do
    {
        FirmWareTable = (PSYSTEM_FIRMWARE_TABLE_INFORMATION)ExAllocatePoolWithTag(
            PagedPool,
            sizeof(SYSTEM_FIRMWARE_TABLE_INFORMA