7 #define WRITE(x) write(1, x, strlen(x))
8 #define DWRITE(x) do{ \
17 * vmware IO backdoor: http://chitchat.at.infoseek.co.jp/vmware/backdoor.html
18 * http://www.honeynet.org/papers/bots/botnet-code.html
19 * http://www.codegurus.be/codegurus/Programming/virtualpc&vmware_en.htm
23 static inline char tohex(char c) {
24 return c>=10?c-10+'a':c+'0';
27 unsigned int fmt_xlong(char *dest,unsigned long i) {
28 register unsigned long len,tmp;
29 /* first count the number of bytes needed */
30 for (len=1, tmp=i; tmp>15; ++len) tmp>>=4;
32 for (tmp=i, dest+=len; ; ) {
33 *--dest = tohex(tmp&15);
34 if (!(tmp>>=4)) break;
40 void printIdtr(const unsigned char* idtr, unsigned size)
43 for(i=0; i<size; ++i) {
45 fmt_xlong(out, idtr[i]);
52 #if defined (__i386__)
53 int checkVmware(const int debug)
55 unsigned char idtr[6] = {0};
56 asm("sidt %0" : "=m" (idtr));
59 return (0xff==idtr[5]) ? 1 : 0;
63 unsigned int vmaj, vmin, magic, dout = 11;
65 "mov $0x564D5868, %%eax; /* magic number */"
66 "mov $0x3c6cf712, %%ebx; /* random number */"
67 "mov $0x0000000A, %%ecx; /* specifies command */"
68 "mov $0x5658, %%edx; /* VMware I/O port */"
74 : "=r"(vmaj), "=r"(magic), "=r"(vmin), "=r"(dout));
76 fprintf(stderr, "version: major=%x, minor=%x, magic=%x, dout=%x\n",
77 vmaj, vmin, magic, dout);
79 return (0x564D5868 == magic) ? 1 : 0;
84 #elif defined (__x86_64__)
85 // only guessed, possible need to check against 0xffff?
86 int checkVmware(const int debug)
88 unsigned char idtr[10];
89 asm("sidt %0" : "=m" (idtr));
92 return (0xff==idtr[9]) ? 1 : 0;
94 int checkVmwareIO() { return 0; }
99 // vmware runs only on the archs above
100 int checkVmware(const int) { return 0; }
101 int checkVmwareIO() { return 0; }
105 // returns 0 if running inside vmware, 1 otherwise
106 int main(int argc, char* argv[]) {
108 if(argc == 2 && !strcmp(argv[1], "--debug"))
112 // known to be false positives
113 a = checkVmware(debug);
114 DWRITE("idt-check: ")
122 // never returns if not running under vmware
123 void dummy() { DWRITE("false\n"); exit(1); }
124 signal(SIGSEGV, dummy);
125 DWRITE("ioport-check: ");
132 WRITE("Error: IO check hasn't killed the program but no vmware found either!\n");
135 // vim: foldmethod=marker