Hi,
I'm sharing code, enjoy!
Code:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; VM - Detects if we're in a virtual mcahine like Virtual PC, VMWare, or
;; Bochs. If there are others, this is where they shall reside for
;; detecting them.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
BochsDetectedMessage db 'Bochs detected',13,10,0
BochsNotDetectedMessage db 'Bochs not detected',13,10,0
BochsOn dd 0
DetectBochs:
mov dx,0E9h
in al,dx
cmp al,0E9h
je .InBochs
mov eax,0
mov esi,BochsNotDetectedMessage
jmp .Done
.InBochs:
mov eax,1
mov esi,BochsDetectedMessage
.Done:
mov [BochsOn],eax
call PrintString
ret
ret
align 4
VPCDetectedMessage db 'Virtual PC Detected',13,10,0
VPCNotDetectedMessage db 'Virtual PC Not Detected',13,10,0
align 4
VPCOn dd 0
DetectVPC:
push ebx
cli ; Turn off interrupts
mov esi,VPCInvalidOpcodeException ; Store new Invalid Opcode Exception
mov eax,6 ; Invalid Opcode is 6
call AddExceptionToIDT ; Call routine to replace it
sti ; Turn on interrupts
mov ebx,0 ; This will stay 0 if VPC running
mov eax,1 ; VPC function number
.CallVPC:
db 0Fh,3Fh,07h,0Bh ; Call VPC
test ebx,ebx
jz .InVPC
mov eax,0
mov esi,VPCNotDetectedMessage
jmp .Done
.InVPC:
mov eax,1
mov esi,VPCDetectedMessage
.Done:
mov [VPCOn],eax
call PrintString
cli
mov esi,UnhandledINT ; Restore original unhandled interrupt
mov eax,6 ; Invalid Opcode is 6
call AddExceptionToIDT
sti
pop ebx
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; VPCInvalidOpcodeException - replaced invalid opcode exception handler with
;; this one to go past the VPC call in the above
;; procedure.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
VPCInvalidOpcodeException:
mov ebx,-1 ; Not running VPC
add DWORD [esp],4 ; Fix the EIP in stack to skip past call VPC
iret
;---------------------------------
; We need this because ATA
; Identify command is NOT working
; under vmware ;) surprise!
;---------------------------------
align 4
VMWareDetectedMessage db 'VM Ware Detected',13,10,0
VMWareNotDetectedMessage db 'VM Ware Not Detected',13,10,0
ALIGN 4
VMWareOn dd 0 ; Default = 0 = OFF, 1 = ON
DetectVMWare:
mov eax,564D5868h ; 'VMXh'
mov ebx,12345h ; This can be any number, but not 'VMXh'
mov ecx,00Ah ; Get VMWare version
mov edx,'VX' ; Port number
IN eax,dx ; Read port 5658h
cmp ebx,564D5868h ; Is this from the EAX?
je .InVMWare ; Yes, goto flag it
mov eax,0
mov esi,VMWareNotDetectedMessage
jmp .Done
.InVMWare:
mov eax,1
mov esi,VMWareDetectedMessage
.Done:
mov [VMWareOn],eax
call PrintString
ret
I hope you all can use it...