Red Pill detect virtualization

user_6593791 0
Viewed 2158

I am trying to detect if my Windows is running on Virtual Machine or not. I've found this C code which is known as Joanna Rutkowska's Red Pill:

int swallow_redpill () 
{
  unsigned char m[2+4], rpill[] = "\x0f\x01\x0d\x00\x00\x00\x00\xc3";
  *((unsigned*)&rpill[3]) = (unsigned)m;
  ((void(*)())&rpill)();
  return (m[5]>0xd0) ? 1 : 0;
}

But when I am running it in my VC++ Project it fails on line 

  ((void(*)())&rpill)();

with message: Access violation executing location 0x003AFCE8. Am I doing smth wrong?

virtualization virtual-machine c c++
2 Answers

Apparently the sample code is trying to execute a sequence of machine instructions that behave differently inside some virtual machines than on *some" real hardware. Note that other VMs may not be detectable with such simple approach.

The reason why the code fails to execute is that on modern OSes you can not execute data sections. You would need to specifically put that piece of code into an executable section, or change data section to be executable.

From Joanna Rutkowska the actual writer of the code:

NOTE: this program will fail on systems with PAX/X^W/grsecurity, protection (as it was pointed out by Brad Spengler) since the rpill variable is not marked as executable. To make it run in such systems, mprotect() should be used to mark rpill with PROT_EXEC attribute. Another solution would be to just use asm() keyword instead of shellcode-like buffer. However, this program should be rather considered as a skeleton to build into your own shellcode, rather then standalone production class tool;) My goal was to make it as simple and portable as possible. That's why I didn't use asm() nor mprotect() since they are system or compiler dependent.

user_5307140 
#include <windows.h>

unsigned char m[2+4], rpill[] = "\x0f\x01\x0d\x00\x00\x00\x00\xc3";
int swallow_redpill () 
{
  unsigned int old;
  VirtualProtect(rpill, 8, PAGE_EXECUTE_READWRITE, &old);
  *((unsigned*)&rpill[3]) = (unsigned)m;
  ((void(*)())&rpill)();
  return (m[5]>0xd0) ? 1 : 0;
}

should do the trick on Windows. Make sure you run it built on Win32 if you have a x64 machine.

user_99704170
Related