,, MMP""MM""YMM `7MM P' MM `7 MM MM MMpMMMb. .gP"Ya MM MM MM ,M' Yb MM MM MM 8M"""""" MM MM MM YM. , .JMML. .JMML JMML.`Mbmmd' `7MMF' `7MF' `7MMF' `7MMF' `MA ,V MM MM VM: ,V `7M' `MF' MM MM .gP"Ya ,6"Yb.`7M' `MF'.gP"Ya `7MMpMMMb. MM. M' `VA ,V' MMmmmmmmMM ,M' Yb 8) MM VA ,V ,M' Yb MM MM `MM A' XMX MM MM 8M"""""" ,pm9MM VA ,V 8M"""""" MM MM :MM; ,V' VA. MM MM YM. , 8M MM VVV YM. , MM MM VF .AM. .MA..JMML. .JMML.`Mbmmd' `Moo9^Yo. W `Mbmmd'.JMML JMML. ,, ,, ,, .g8"""bgd `7MM `7MM mm db .dP' `M MM MM MM dM' ` ,pW"Wq. MM MM .gP"Ya ,p6"bo mmMMmm `7MM ,pW"Wq.`7MMpMMMb. MM 6W' `Wb MM MM ,M' Yb 6M' OO MM MM 6W' `Wb MM MM MM. 8M M8 MM MM 8M"""""" 8M MM MM 8M M8 MM MM `Mb. ,'YA. ,A9 MM MM YM. , YM. , MM MM YA. ,A9 MM MM `"bmmmd' `Ybmd9'.JMML..JMML.`Mbmmd' YMbmd' `Mbmo.JMML.`Ybmd9'.JMML JMML. -- Contact -- https://twitter.com/vxunderground vxug@null.net

1) Introduction

There are a lot of ways to detect virtualized env, here I will show only a simple trick to detect if you are running inside VirtualBox. This trick requires that guest additions (a component that let you exchange files between a virtualized system and the real one) are installed on the virtualized system because the detection is based on it. If you want to go deeper in VM detection look at http://www.invisiblethings.org/papers/redpill.html ! Now go to the real stuff

2) Theory & Code

The detection can be done in two ways:

  1. Check if VBoxHook.dll exists in the system (using LoadLibrary() for example)
  2. Check if the pseudo-device \\.\VBoxMiniRdrDN exists in the system (you need CreateFile())

Here are listed two simple programs that demonstrate this:

detectVBox_1.c

/* Check if VBoxHook.dll exists */

#include <windows.h>

int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
        if(LoadLibrary("VBoxHook.dll") != NULL)
        {
                MessageBox(NULL,"VBox detected!","Warning",MB_OK|MB_ICONWARNING);
        }

        else
        {
                MessageBox(NULL,"Not inside VBox","Info",MB_OK|MB_ICONINFORMATION);
        }
}
 

detectVBox_2.c

/* Check if \\.\VBoxMiniRdrDN exists */

#include <windows.h>

int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
        if(CreateFile("\\\\.\\VBoxMiniRdrDN",GENERIC_READ,FILE_SHARE_READ,
                NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL) != INVALID_HANDLE_VALUE)
        {
                MessageBox(NULL,"VBox detected!","Warning",MB_OK|MB_ICONWARNING);
        }

        else
        {
                MessageBox(NULL,"Not inside VBox","Info",MB_OK|MB_ICONINFORMATION);
        }
}
 

3) Greetz

greetz to #eof-project,#virus,#vxcode @ undernet a special thx to MrAnderson for testing :D You can contact me at wargame89@yahoo.it or visit http://vx.netlux.org/wargamevx