Detecting Virtual PC

Adding to my previous post on detecting virtual environments, here's the code for detecting Virtual PC. Note that it's a conversion from CodeProject, the original author is here. I also didn't write the conversion, I'm simply accumulating the VMM detection code here. Original credit for the conversion goes to Dennis Pasamore who did the bulk of the conversion work with some assistance from Avatar Zonderatau.


function TForm1.IsRunningVirtualPC: boolean;
push ebp;
mov ebp, esp;

mov ecx, offset @exception_handler;

push ebx;
push ecx;

push dword ptr fs:[0];
mov dword ptr fs:[0], esp;

mov ebx, 0; // Flag
mov eax, 1; // VPC function number

// call VPC
db $0F, $3F, $07, $0B

mov eax, dword ptr ss:[esp];
mov dword ptr fs:[0], eax;

add esp, 8;

test ebx, ebx;

setz al;

lea esp, dword ptr ss:[ebp-4];
mov ebx, dword ptr ss:[esp];
mov ebp, dword ptr ss:[esp+4];

add esp, 8;

jmp @ret1;

mov ecx, [esp+0Ch];
mov dword ptr [ecx+0A4h], -1; // EBX = -1 ->; not running, ebx = 0 -> running
add dword ptr [ecx+0B8h], 4; // ->; skip past the call to VPC
xor eax, eax; // exception is handled