$a = _CheckVM()
If $a = "" Then
MsgBox(0, "我不在虚拟机里", "我不在虚拟机里!")
Else
MsgBox(0, "我在虚拟机里!", "我在虚拟机里,我的理由是" & @CRLF & @CRLF & $a)
EndIf
;检查是否运行于虚拟机环境。返回空值说明运行于真实环境,返回一个字符串,说明运行于虚拟机环境并给出解释。
;方法:检查虚拟机服务/进程,硬盘,BIOS 主板/芯片组
;发现2个以上即确定为虚拟机环境
Func _CheckVM()
$strComputer = '.'
$objWMIService = ObjGet('winmgmts:\\' & $strComputer & '\root\cimv2')
$vmhit_count = 0
$vmhit_details = ""
; 检查虚拟机管理程序
If ProcessExists("VBoxService.exe") Or ProcessExists("VBoxTray.exe") Or ProcessExists("VMwareTray.exe") Or ProcessExists("VMwareUser.exe") Then _AddVMHit($vmhit_count, $vmhit_details, "RUNNING SOFTWARE", "Found a Vbox or VMware guest OS service or tray process")
; 检查虚拟机设备
If Not IsObj($objWMIService) Then
MsgBox(0, "", "? WTF?")
Return ""
EndIf
; 检查虚拟机硬盘
$colItems = $objWMIService.ExecQuery('SELECT * FROM Win32_DiskDrive', 'WQL', 0x10 + 0x20)
If IsObj($colItems) Then
For $objItem In $colItems
$vReturn = $objItem.Model
Select
Case StringInStr($vReturn, "VBOX HARDDISK")
_AddVMHit($vmhit_count, $vmhit_details, "DISKS", "Found device ""VBOX HARDDISK""")
Case StringInStr($vReturn, "QEMU HARDDISK")
_AddVMHit($vmhit_count, $vmhit_details, "DISKS", "Found device ""QEMU HARDDISK""")
Case StringInStr($vReturn, "VMWARE VIRTUAL IDE HARD DRIVE")
_AddVMHit($vmhit_count, $vmhit_details, "DISKS", "Found device ""VMWARE VIRTUAL IDE HARD DRIVE""")
Case StringInStr($vReturn, "VMWARE Virtual S SCSI Disk Device")
_AddVMHit($vmhit_count, $vmhit_details, "DISKS", "Found device ""VMWARE Virtual S SCSI Disk Device""")
EndSelect
Next
EndIf
; 检查虚拟机BIOS
$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_BIOS", "WQL", 0x10 + 0x20)
If IsObj($colItems) Then
For $objItem In $colItems
Select
Case StringInStr($objItem.BIOSVersion(0), "Vbox")
_AddVMHit($vmhit_count, $vmhit_details, "BIOS", "Found Vbox BIOS version")
Case StringInStr($objItem.SMBIOSBIOSVersion, "virt")
_AddVMHit($vmhit_count, $vmhit_details, "BIOS", "Found Vbox BIOS version")
EndSelect
Next
EndIf
; 检查虚拟机主板/芯片组
$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_Baseboard", "WQL", 0x10 + 0x20)
If IsObj($colItems) Then
For $objItem In $colItems
Select
Case StringInStr($objItem.Name, "Base Board") And StringInStr($objItem.Product, "440BX Desktop Reference Platform")
_AddVMHit($vmhit_count, $vmhit_details, "MOTHERBOARD", "Found VMware-style motherboard, ""440BX Desktop Reference Platform"" / Name=""Base Board""")
EndSelect
Next
EndIf
If $vmhit_count >= 2 Then
Return $vmhit_details & @CRLF & @CRLF & "Hits in " & $vmhit_count & " of 4 hardware categories - probably a virtual machine."
Else
Return ""
EndIf
EndFunc ;==>_CheckVM
Func _AddVMHit(ByRef $vmhit_count, ByRef $vmhit_details, $this_hit_category, $this_hit_text)
If StringInStr($vmhit_details, "In CATEGORY:" & $this_hit_category & ":") Then
$vmhit_details &= " and " & $this_hit_text
Else
If $vmhit_details > "" Then $vmhit_details &= @CRLF
$vmhit_details &= "In CATEGORY:" & $this_hit_category & ": " & $this_hit_text
$vmhit_count += 1
EndIf
EndFunc ;==>_AddVMHit
|