BOOL IsVMWarePre(){     PROCESSENTRY32 pe32;    pe32.dwSize = sizeof(pe32);    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);    if(hProcessSnap == INVALID_HANDLE_VALUE)    {        return FALSE;    }    BOOL bMore = Process32First(hProcessSnap, &pe32);    while(bMore)    {        if (strcmp(pe32.szExeFile, "VMwareService.exe")==0 || strcmp(pe32.szExeFile, "VMwareTray.exe")==0 || strcmp(pe32.szExeFile, "VMwareUser.exe")==0 )        {            return TRUE;        }        bMore = Process32Next(hProcessSnap, &pe32);    }    CloseHandle(hProcessSnap);    return FALSE;}

[HKEY_LOCAL_MACHINE_HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0]"Identifier"="VMware Virtual IDE Hard Drive""Type"="DiskPeripheral" [HKEY_LOCAL_MACHINE_HARDWARE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\0000]"DeviceDesc"="VMware Accelerated AMD PCNet Adapter""DisplayName"="VMware Acceleeated AMD PCNet Adapter""Mfg"="VMware,Inc.""ProviderName"="VMware,Inc." [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96F-E325-11CE-BFC1-08002BE10318}\0000]"LocationInformationOverride"="plugged into PS/2 mouse port""InfPath"="oem13.inf""InfSection"="VMMouse""ProviderName"="VMware,Inc."

string mac;if (mac=="00-0c-29"){    return TRUE;}else    return FALSE;

BOOL IsVMWarePre(){    ULONG xdt = 0 ;    ULONG InVM = 0;    __asm    {        push edx        sidt [esp-2]        pop edx        nop        mov xdt , edx    }    if (xdt > 0xd0000000)    {         InVM = 1;    }    else    {        InVM = 0;    }    __asm    {        push edx        sgdt [esp-2]        pop edx        nop        mov xdt , edx    }    if (xdt > 0xd0000000)    {        InVM += 1;    }    if (InVM == 0)    {        return FALSE;    }    else    {        return TRUE;    }

bool IsVMWarePre(){  bool rc = true;   __try  {    __asm    {      push   edx      push   ecx      push   ebx      mov    eax, 'VMXh'      mov    ebx, 0  // 将ebx设置为非幻数’VMXH’的其它值      mov    ecx, 10 // 指定功能号，用于获取VMWare版本，当它为0x14时用于获取VMware内存大小      mov    edx, 'VX' // 端口号      in     eax, dx // 从端口dx读取VMware版本到eax，若上面指定功能号为0x14时，可通过判断eax中的值是否大于0，若是则说明处于虚拟机中      cmp    ebx, 'VMXh' // 判断ebx中是否包含VMware版本’VMXh’，若是则在虚拟机中      setz   [rc] // 设置返回值      pop    ebx      pop    ecx      pop    edx    }  }  __except(EXCEPTION_EXECUTE_HANDLER)  //如果未处于VMware中，则触发此异常  {    rc = false;  }   return rc;}

BOOL IsVMwarePre(){    if (PathIsDirectory("C:\\Program Files\\VMware\\VMware Tools\\") == 0)    {        return FALSE;    }    else        return TRUE;

from idautils import *from idc import * heads = Heads(SegStart(ScreenEA()), SegEnd(ScreenEA()))antiVM = [for i in heads:    if (GetMnem(i) == "sidt" or GetMnem(i) == "sgdt" or GetMnem(i) == "sldt" or GetMnem(i) == "smsw" or GetMnem(i) == "str" or GetMnem(i) == "in" or GetMnem(i) == "cpuid"):        antiVM.append(i) print "Number of potential Anti-VM instructions: %d" % (len(antiVM)) for i in antiVM:    SetColor(i, CIC_ITEM, 0x0000ff)    Message("Anti-VM: %08x\n" % i)

isolation.tools.getPtrLocation.disable = "TRUE"isolation.tools.setPtrLocation.disable = "TRUE"isolation.tools.getVersion.disable = "TRUE"isolation.tools.setVersion.disable = "TRUE"monitor_control.disable_directexec = "TRUE"monitor_control.disable_chksimd = "TRUE"monitor_control.disable_ntreloc = "TRUE"monitor_control.disable_selfmod = "TRUE"monitor_control.disable_reloc = "TRUE"monitor_control.disable_btinout = "TRUE"monitor_control.disable_btmemspace = "TRUE"monitor_control.disable_btpriv = "TRUE"monitor_control.disable_btseg = "TRUE"