antivm.~dpr

反最新虚拟机代码

library AntiVm;

{ Important note about DLL memory management: ShareMem must be the
  first unit in your library's USES clause AND your project's (select
  Project-View Source) USES clause if your DLL exports any procedures or
  functions that pass strings as parameters or function results. This
  applies to all strings passed to and from your DLL--even those that
  are nested in records and classes. ShareMem is the interface unit to
  the BORLNDMM.DLL shared memory manager, which must be deployed along
  with your DLL. To avoid using BORLNDMM.DLL, pass string information
  using PChar or ShortString parameters. }

uses
  Windows,
  Messages,
  SysUtils,
  Variants,
  Classes,
  Graphics,
  Controls,
  Dialogs,
  StdCtrls;
type
  AntiVirus=Class

  public
   function IsRunInVMWare(out ErrMsg: Pchar): Boolean;
  private


end;

{反VM}
function AntiVirus.IsRunInVMWare(out ErrMsg: Pchar): Boolean;stdcall;
begin
Result := False;
try
    asm
      push     edx
      push     ecx
      push     ebx
      mov      eax, 'VMXh'
      mov      ecx, $0A
      mov      edx, 'VX'
      in       eax, dx
      cmp      ebx, 'VMXh'
      setz     [Result]
      pop      ebx
      pop      ecx
      pop      edx
    end;

except

    on E: Exception do

      ErrMsg := Pchar(E.Message);

end;

end;

exports
IsRunInVMWare;

begin


end.