Detect VMWare programmatically

Question

I would like to check if my application is being run on VMWare. Is there a reliable way to do this in C++?

Why exactly would you want to do that? I can't think of many reasons, where a simple "do you run under a vm?" dialog box is not enough (if even that is really really needed) — viraptor, Dec 11 '09 at 23:24
Duplicaet of http://stackoverflow.com/questions/154163/detect-virtualized-os-from-an-application — saschabeaumont, Dec 14 '09 at 01:28
@viraptor It's not because you can't think of cases that there aren't any. For example i'm working on identifying a computer for licences and stuff like that, and i need to know if i'm in a VM or not because this will determine which hardware info i'm going to use, and to know if i'm in a VM I have to check all the possible VMs, including VM Ware. — Virus721, Aug 04 '14 at 09:19
@Virus721 It wasn't a dismissive comment. Knowing the use case would actually help here. You're talking about hardware info for example - this is separate from the VM part and if you want to be future-proof (what about new types? what about device passthrough? what if they change the name?) you should actually look at the listed hardware rather than checking for VM type. If it's for a license then you're probably looking at an "is this virtualised" check, rather than specific hypervisor detection. That's why I don't think "is this vmware guest" is a good question to ask in most cases. — viraptor, Aug 04 '14 at 11:03
Detecting common virtual machine configurations is trivial. Remember that user will always be able to bypass your checks if there is a need. — Croll, Apr 12 '19 at 17:12

score 4 · Answer 1 · answered Dec 11 '09 at 23:20

4

I just found this assembly on codeproject.

http://www.codeproject.com/KB/system/VmDetect.aspx

answered Dec 11 '09 at 23:20

Daniel A. White

187,200
47
362
445

score 2 · Answer 2 · answered Dec 11 '09 at 23:22

I think this link might be able to help you out. Its in assembly, not C++, but you could always create an assembly block in your C++...

////////////////////////////////////////////////////////////////////////////////
//
//  Simple VMware check on i386
//
//    Note: There are plenty ways to detect VMware. This short version bases
//    on the fact that VMware intercepts IN instructions to port 0x5658 with
//    an magic value of 0x564D5868 in EAX. However, this is *NOT* officially
//    documented (used by VMware tools to communicate with the host via VM).
//
//    Because this might change in future versions - you should look out for
//    additional checks (e.g. hardware device IDs, BIOS informations, etc.).
//    Newer VMware BIOS has valid SMBIOS informations (you might use my BIOS
//    Helper unit to dump the ROM-BIOS (http://www.bendlins.de/nico/delphi).
//
function IsVMwarePresent(): LongBool; stdcall;  // platform;
begin
  Result := False;
 {$IFDEF CPU386}
  try
    asm
            mov     eax, 564D5868h
            mov     ebx, 00000000h
            mov     ecx, 0000000Ah
            mov     edx, 00005658h
            in      eax, dx
            cmp     ebx, 564D5868h
            jne     @@exit
            mov     Result, True
    @@exit:
    end;
  except
    Result := False;
  end;
{$ENDIF}
end;

As with any code from the internet, be careful of merely copying & pasting it and expecting it to work perfectly.

This appears to cause a crash on Win2k8 server and possibly Windows 7 32bit OS unfortunatly — Mike Trader, Dec 11 '09 at 23:37
You probably need to wrap it in a Win32 "structured" exception handler. If you get an invalid instruction exception or similar, you're not in VMware. http://msdn.microsoft.com/en-us/library/s58ftw19%28VS.80%29.aspx — Tim Sylvester, Dec 12 '09 at 00:21

score 0 · Answer 3 · answered Apr 12 '19 at 17:09

I believe this smart, and "simple" C++ - assembly code could help anyone else. You may read more information about it on the github page.

https://github.com/dretax/VMDetect

int IsVMRunning()
{
#if _WIN64 
    UINT64 time1 = rdtsc();
    UINT64 time2 = rdtsc();
    if (time2 - time1 > 500) {
        return 1;
    }
    return 0;
#else 
    unsigned int time1 = 0;
    unsigned int time2 = 0;
    __asm
    {
        RDTSC
        MOV time1, EAX
        RDTSC
        MOV time2, EAX

    }
    if (time2 - time1 > 500) {
        return 1;
    }
    return 0;
#endif
}

Detect VMWare programmatically

3 Answers3