[Amin_Mansouri]

The virtual machine system VMware uses a “backdoor
communication port” to be able to pass data between the host
and the guest operating system. This communication port is
used to read and write clipboard information, drag and drop
between host and guest operating system, and allow file
sharing between the two running systems. Communication on
this port occurs by using two privileged x86 instructions, “IN”
and “OUT”. These two instructions cannot normally be run
from an unprivileged vantage point and would generate an
exception; however when running under VMware, the
emulation layer has implemented these particular instructions
differently allowing them to be executed from an unprivileged
vantage point. As such we can use these methods to detect if
we are in a VMware virtual environment.
In the inline assembly below we setup a call to the “IN”
instruction by pushing a number of static values onto the stack.
The first parameter of interest is the static string ‘VMXh’.
This string is the “magic” value that must be present for the
virtual machine to know that the request is legitimate. The
value 10 is the particular VMware backdoor function that we
wish to execute, while the value ‘VX’ is the default port that
the VMware backdoor IO listens for. Finally we execute the
“IN” call and analyze the return value. If the return value is
zero, and we have reached our exception handler, we know
that we are not running in a virtual session. If the return value
is non zero and we do not reach out exception handler we are
running inside of VMware

کد:

Function AntiVMware():boolean;
begin
try
  asm
   push edx;
   push ecx;
   push ebx;
   mov eax, 'VMXh';
   mov ebx, 0; // This can be any value except MAGIC
   mov ecx, 10; // "CODE" to get the VMware Version
   mov edx, 'VX'; // Port Number
   in eax, dx; // Read port
   //On return EAX returns the VERSION
   cmp ebx, 'VMXh'; // is it VMware
   setz Result; //Set flag state
   pop ebx;
   pop ecx;
   pop edx;
  end;
except
  Result:= False;
end;
end;



[code]

if AntiVMware then
  MessageBox(0, 'VMware Instance Detected', 'VMware Detected', +MB_OK +MB_ICONINFORMATION)
  else
  MessageBox(0, 'No VMware Instance Detected', 'No VMware Detected', +MB_OK +MB_ICONINFORMATION);

با سورس بالا میتونید از اجرا شدن برنامه در محیط vm جلوگیری کنید.

بر روی این نسخه هم تست شده و جواب داده

VM WARE 7.1.0