Jump to content
davornik

Detect virtual machine in 64bit?

Recommended Posts

// VMware detection as described by Elias Bachaalany
function IsInsideVMware: Boolean;
//------------------------------
procedure ChkVMware;
asm
  push edx;
  push ecx;
  push ebx;

  mov eax, 'VMXh';
  mov ebx, 0;
  mov ecx, 10;
  mov edx, 'VX';

  in eax, dx;

  cmp ebx, 'VMXh';
  setz [Result];

  pop ebx;
  pop ecx;
  pop edx;
end;
//------------------------------
begin
  Result := True;
  try
    ChkVMware;
  except
    Result := False;
  end;
end;


function IsRunningUnderHyperV: BOOL; stdcall;
var
  VMBranding: array[0..12] of AnsiChar;
//------------------------------
procedure GetVMBrand;
asm
  mov eax, $40000000;
  cpuid;
  mov dword ptr [VMBranding+0], ebx;  // Get the VM branding string
  mov dword ptr [VMBranding+4], ecx;
  mov dword ptr [VMBranding+8], edx;
end;
//------------------------------
begin
  GetVMBrand;
  VMBranding[12] := #0;
  Result := CompareText(String(VMBranding), 'Microsoft Hv') = 0;
end;

 

How can thiese function be done in 64-bit? On compile I get

[dcc64 Error] Unit1.pas(33): E2116 Invalid combination of opcode and operands

Registers need to be changed. Which to use?

 

Share this post


Link to post
procedure ChkVMware;
asm
  push rdx;
  push rcx;
  push rbx;

  mov rax, 'VMXh';
  mov rbx, 0;
  mov rcx, 10;
  mov rdx, 'VX';

  in rax, dx;  <-- here is error: operand size mismatch

  cmp rbx, 'VMXh';
  setz [Result];

  pop rbx;
  pop rcx;
  pop rdx;
end;

Thank you. In that link registers are like eax, edx, ecx and rbx for 32-bit, but if you change them to 64-bit (rax, rdx, rcx, rbx) then I get error: operand size mismatch.

I even dont know if this is proper way to change registers?

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×