Hi,
Please do not keep on posting the same question all over the forum, I removed a few of your duplicate posts.
Your question still isn't clear and crossposting it all over doesn't help.
Besides that crossposting isn't allowed as it makes it very difficult to follow a discussion if you scatter it out over a lot of isolated posts (see forum Community Terms of Use article 1i )
Instead please explain what you are trying to do and what exactly the issue is?
Are you getting errors or does the VM crash or??
At the moment you a re just posting some code and tell us that you are getting an unexpected result, but there's no context.
What has the problem to do with virtual box for example? Does the problem happen there as well or are you trying to run both virtualbox and vmware workstation/player at the same time, are you trying to run virtualbox as a guest?
How about starting with attaching a vmware.log and explaining a bit more details of the issue?
If you provide a bit more context I might even be able to move your post to a more relevant sub forum, but at this moment I am not even understanding your issue.
thanks,
--
Wil
Ok, so if I'm reading your question correctly then, you're not seeing an error, but instead want to be able to evade detection of some unknown software that it is running in a VM?
(Not sure what the "exploit" bit is about)
The specifics are very low level (the rdtsc turns out to be an x86 CPU register ) and as this is an end user forum I do not expect a lot of replies on the specific.
There used to be a VMware employee around that answered this type of question, but he isn't around anymore.
Maybe covelli has an answer on this, but that's just a rough guess on who might be able to answer.
edit: A program that runs under a debugger has AFAIK a completely different way for detecting that.
Eg. as we are talking about windows, that would normally be done via windows API IsDebuggerPresent
Of course I don't know what that API call does.. (as I do not normally meddle in assembly)
--
Wil
how i understand this bug not fixable end cannot be disable ? 
whay the vm exit is forsed when it's try call cpu id ?
if it's not call cpu id all good - its happen only how you see on comet of code if
move aex 0x00
cpuid
this code work fine no detect's vmware ( if change cpuid.x.xxx"xxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxx")
static inline unsigned long long rdtsc_diff() {
unsigned long long ret, ret2;
unsigned eax, edx;
__asm__ volatile("rdtsc" : "=a" (eax), "=d" (edx));
ret = ((unsigned long long)eax) | (((unsigned long long)edx) << 32);
__asm__ volatile("rdtsc" : "=a" (eax), "=d" (edx));
ret2 = ((unsigned long long)eax) | (((unsigned long long)edx) << 32);
return ret2 - ret;
}
Hi,
There really are a LOT of ways to detect if you are running under a hypervisor or under VMware specifically.
Not sure if I'm reading the output correctly. Have you already made changes to the VM to evade VMware detection?
Have you added the restrict_backdoor setting already?
eg see for details:
https://communities.vmware.com/thread/448013?start=0&tstart=0
edit: for other's reading this, some pafish explanation: Sandbox detection: Pafish overview | Portcullis Labs
edit2: and SANS has an article about this too, with a lot of possible settings in your vmx to try out:
http://handlers.sans.org/tliston/ThwartingVMDetection_Liston_Skoudis.pdf
--
Wil
Hi,
I understand your frustration.
But somehow I don't think it is possible to completely evade detection of running in a VM.
I'd be happy to hear/learn otherwise, but unless somebody that works on the innards of the hypervisor jumps in down here, I'm afraid there won't be many more tips.
--
Wil
for it's start undectect - need find how dissable forse vmexit when it's call cpu id 0 on rdtsc
it posible to passthrough the host rdtsc ?
Umm.. I don't know, but you could of course have run strings on the binary and try to poke around a bit with the results from that.
Like:
:/usr/lib/vmware/bin$ strings vmware-vmx | grep -i rdtsc
disable_rdtsc_batching
disable_rdtscopt_bt
disable_rdtscopt_de
virtual_rdtsc
RDTSC exiting
Enable RDTSCP
Disabling TSC scaling since virtual_rdtsc is disabled.
timeTracker.vtsc.rdtscCountThreshold
RDTSC
cpuid.RDTSCP
IA32_VMX_PROCBASED_CTLS.RDTSC_REQUIRED
IA32_VMX_PROCBASED_CTLS.RDTSC_ALLOWED
IA32_VMX_PROCBASED_CTLS2.RDTSCP_REQUIRED
IA32_VMX_PROCBASED_CTLS2.RDTSCP_ALLOWED
IA32_VMX_TRUE_PROCBASED_CTLS.RDTSC_REQUIRED
IA32_VMX_TRUE_PROCBASED_CTLS.RDTSC_ALLOWED
HVSimEmitRDTSCCheck
HVSimEmitRDTSCP
HVSimEmitClusteredRDTSCP
HVSimEmitRDTSC
HVSimEmitClusteredRDTSC
HVSimRDTSCPExit
HVSimRDTSCExit
HVSimRDTSC
HVSimRDTSCP
hvTrapRDTSC
HVSimEmitRDTSCCheck
HVSimEmitRDTSCP
HVSimEmitClusteredRDTSCP
HVSimEmitRDTSC
HVSimEmitClusteredRDTSC
HVSimRDTSCPExit
HVSimRDTSCExit
HVSimRDTSC
HVSimRDTSCP
hvTrapRDTSC
OPCODE_RDTSC
rdtscCnt
OPCODE_RDTSCP
So the vmware player binary certainly is doing something with RDTSC, if any of those strings up there is a configurable option, I don't know... I'll leave that as your home work.
--
Wil