7 #define WRITE(x) write(1, x, strlen(x))
8 #define DWRITE(x) do{ \
17 * vmware IO backdoor: http://chitchat.at.infoseek.co.jp/vmware/backdoor.html
18 * http://www.honeynet.org/papers/bots/botnet-code.html
19 * http://www.codegurus.be/codegurus/Programming/virtualpc&vmware_en.htm
23 static inline char tohex(char c) {
24 return c>=10?c-10+'a':c+'0';
27 unsigned int fmt_xlong(char *dest,unsigned long i) {
28 register unsigned long len,tmp;
29 /* first count the number of bytes needed */
30 for (len=1, tmp=i; tmp>15; ++len) tmp>>=4;
32 for (tmp=i, dest+=len; ; ) {
33 *--dest = tohex(tmp&15);
34 if (!(tmp>>=4)) break;
40 void printIdtr(const unsigned char* idtr, unsigned size)
43 for(i=0; i<size; ++i) {
45 fmt_xlong(out, idtr[i]);
53 // i386 and x86-64 {{{
54 #if defined (__i386__) || defined (__x86_64__)
55 int checkVmware(const int debug)
57 unsigned char idtr[10] = {0};
58 asm("sidt %0" : "=m" (idtr));
60 printIdtr(idtr, sizeof(idtr));
61 // should normally be the case on amd64, but does not work
62 //return (0xff==idtr[9]) ? 1 : 0;
63 return (0xff==idtr[5]) ? 1 : 0;
67 unsigned int vmaj, vmin, magic, dout = 11;
69 "mov $0x564D5868, %%eax; /* magic number */"
70 "mov $0x3c6cf712, %%ebx; /* random number */"
71 "mov $0x0000000A, %%ecx; /* specifies command */"
72 "mov $0x5658, %%edx; /* VMware I/O port */"
78 : "=r"(vmaj), "=r"(magic), "=r"(vmin), "=r"(dout));
80 fprintf(stderr, "version: major=%x, minor=%x, magic=%x, dout=%x\n",
81 vmaj, vmin, magic, dout);
83 return (0x564D5868 == magic) ? 1 : 0;
89 // vmware runs only on the archs above
90 int checkVmware(const int) { return 0; }
91 int checkVmwareIO() { return 0; }
95 static int Killed = FALSE;
97 // returns 0 if running inside vmware, 1 otherwise
98 int main(int argc, char* argv[]) {
100 if(argc == 2 && !strcmp(argv[1], "--debug"))
104 // known to be false positives
105 a = checkVmware(debug);
106 DWRITE("idt-check: ")
114 // never returns if not running under vmware
115 void dummy() { Killed=TRUE; DWRITE("false\n"); exit(1); }
116 signal(SIGSEGV, dummy);
117 DWRITE("ioport-check: ");
124 // check unuseable or not implemented
126 DWRITE("Check not implemented, yet!\n");
127 return a ? EXIT_SUCCESS : EXIT_FAILURE;
130 WRITE("Error: IO check hasn't killed the program but no vmware found either!\n");
135 // vim: foldmethod=marker