如何判断当前程序是否运行在虚拟机内

如何判断当前程序是否运行在虚拟机内

最近写程序，碰到要检测程序是否运行在虚拟机内的问题。在网上找了一下，找到下面两个函数，可以检测程序是否运行在virtual machine中，支持VMWARE 和virtual pc检测. 主要的原理，都是利用virtual machine往往支持一些真实PC不支持的指令.

// IsInsideVPC 's exception filter

DWORD __forceinline IsInsideVPC _exceptionFilter(LPEXCEPTION_POINTERS ep)

{

PCONTEXT ctx = ep->ContextRecord;

ctx->Ebx = -1; // Not running VPC

ctx->Eip += 4; // skip past the "call VPC" opcodes

return EXCEPTION_CONTINUE_EXECUTION;

// we can safely resume execution since we skipped faulty instruction

}

// High level language friendly version of IsInsideVPC ()

bool IsInsideVPC ()

{

bool rc = false;

__try

{

_asm push ebx

_asm mov ebx, 0 // It will stay ZERO if VPC is running

_asm mov eax, 1 // VPC function number

// call VPC

_asm __emit 0Fh

_asm __emit 3Fh

_asm __emit 07h

_asm __emit 0Bh

_asm test ebx, ebx

_asm setz [rc]

_asm pop ebx

}

// The except block shouldn't get triggered if VPC is running!!

__except(IsInsideVPC _exceptionFilter(GetExceptionInformation()))

{

}

return rc;

}下面是检测virtual PC的.bool IsInsideVMWare()

{

bool rc = true;

__try

{

__asm

{

push edx

push ecx

push ebx

mov eax, 'VMXh'

mov ebx, 0 // any
value but not the MAGIC
value

mov ecx, 10 // get VMWare version

mov edx, 'VX' // port number

in eax, dx // read port

// on return EAX returns the VERSION

cmp ebx, 'VMXh' // is it a reply from VMWare?

setz [rc] // set return
value

pop ebx

pop ecx

pop edx

}

}

__except(EXCEPTION_EXECUTE_HANDLER)

{

rc = false;

}

return rc;

}