Advertisement
Madmouse

Windows vmware detection POC for Evil1

Feb 15th, 2015
98
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.07 KB | None | 0 0
  1. // ------------------------------------------------------------------------------
  2. // THE BEER-WARE LICENSE (Revision 43):
  3. // <aaronryool@gmail.com> wrote this file. As long as you retain this notice you
  4. // can do whatever you want with this stuff. If we meet some day, and you think
  5. // this stuff is worth it, you can buy me a beer in return
  6. // ------------------------------------------------------------------------------
  7.  
  8. #include <iostream>
  9. #include <windows.h>
  10.  
  11. unsigned vmware(void)
  12. {
  13. __asm{
  14.     mov eax, 0x564d5868
  15.     mov cl, 0xa
  16.     mov dx, 0x5658
  17.     in eax, dx
  18.     cmp ebx, 0
  19.     jne matrix
  20.     xor eax, eax
  21.     ret
  22.     matrix:
  23.     mov eax, 1};
  24. }
  25.  
  26. int seh_filter(unsigned code, struct _EXCEPTION_POINTERS* ep)
  27. {
  28.     return EXCEPTION_EXECUTE_HANDLER;
  29. }
  30.  
  31. int _tmain(int a, _TCHAR* argv[])
  32. {
  33.     __try
  34.     {
  35.         if(vmware()) goto matrix;
  36.     }
  37.     __except(seh_filter(GetExceptionCode(), GetExceptionInformation()))
  38.     {
  39.         goto stage2;
  40.     }
  41.  
  42. stage2:
  43.     std::cout << "Isn't real life boring?"<<std::endl;
  44.     exit(0);
  45.  
  46. matrix:
  47.     std::cout << "The Matrix haz you Neo..."<<std::endl;
  48.     exit(1);
  49. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement