jiweihong
jiweihong
/ vmware-detect.c
Created
September 14, 2020 02:07
— forked from c0d3inj3cT/vmware-detect.c
This code will scan the process address space of csrss.exe for the string, "MS_VM_CERT". It is the OEM String of VMWare present in the SMBIOS structures.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /* | |
| Detect VMWare using OEM String in Memory | |
| Tested on Windows XP SP3/VMWare Workstation 7.1.0 | |
| c0d3inj3cT | |
| */ | |
| #include <windows.h> | |
| #include <stdio.h> | |
| #define MARKER "MS_VM_CERT" |
jiweihong
/ resources.md
Created
August 5, 2020 02:35
— forked from muff-in/resources.md
