VMware & winlicense

Printable View

2011-12-01, 01:19 PM
Askleptius

VMware & winlicense

Суть вопроса такова : невозможность запуска из виртуалки клиента, стоит протектор ВЛ. С прошлой версией было проще, обходился ток коректировкой файла конфига, теперь не работает. Пробовал чистить от ключей протектора систему, блокировать доступ, всьо равно палит. Кто понимает или уже вилечил стукните в личку или здесь в теме. Буду благодарен.
2011-12-01, 01:38 PM
Grooguz

Sorry, can you make English translation. As I understand, you have problems with running Requiem under VM?
2011-12-01, 02:11 PM
Askleptius

Quote:

Originally Posted by groom [Only registered and activated users can see links. Click Here To Register...]

Sorry, can you make English translation. As I understand, you have problems with running Requiem under VM?

Yes, there is such problem! More a long ago decided it, it keeps indoors now!
2011-12-01, 02:15 PM
Grooguz

if something packed with winlicense/Themida/VMprotect (with enabled protection against VMware), you should first remove protector... I do not know other ways to run such files under VMware
2011-12-01, 02:43 PM
Askleptius

Quote:

Originally Posted by groom [Only registered and activated users can see links. Click Here To Register...]

if something packed with winlicense/Themida/VMprotect (with enabled protection against VMware), you should first remove protector... I do not know other ways to run such files under VMware

I understand, but think that it is simpler to hide status and change hardware id , an effective method is not only, at least for me.
2011-12-01, 02:54 PM
Grooguz

I didn't clearly got your question.. Anyways, following piece of asm shows how to detect VM

Code:

XOR EAX, EAX PUSH OFFSET @@Handler PUSH DWORD PTR FS:[EAX] MOV DWORD PTR FS:[EAX], ESP MOV EAX, 564D5868h MOV EBX, 3c6cf712h MOV ECX, 0Ah MOV DX, 5658h IN EAX, DX MOV EAX, True JMP @@NotHandle @@Handler: MOV EAX, [ESP+$C] MOV TContext(EAX).EIP, OFFSET @@Handled XOR EAX, EAX RET @@Handled: XOR EAX, EAX @@NotHandle: XOR EBX, EBX POP DWORD PTR FS:[EBX] ADD ESP, 4

Maybe this method is used in protectors like Themida.
Probably Dwar can give you a more useful answer....
2011-12-04, 10:33 PM
Askleptius

Quote:

Originally Posted by groom [Only registered and activated users can see links. Click Here To Register...]

I didn't clearly got your question.. Anyways, following piece of asm shows how to detect VM
Maybe this method is used in protectors like Themida.
Probably Dwar can give you a more useful answer....

Will expect his help, hope he often peeps in new themes.

---------- Post added 2011-12-04 at 09:33 PM ---------- Previous post was 2011-12-01 at 02:10 PM ----------

Решение найдено! спасибо Grooguz за то что откликнулся!
2012-03-18, 02:14 PM
KollyaN

Quote:

Originally Posted by Askleptius [Only registered and activated users can see links. Click Here To Register...]

Will expect his help, hope he often peeps in new themes.

---------- Post added 2011-12-04 at 09:33 PM ---------- Previous post was 2011-12-01 at 02:10 PM ----------

Решение найдено! спасибо Grooguz за то что откликнулся!

Приятного времени суток. А могли бы вы разъяснить решение данного вопроса? Заранее благодарен.
Have a nice time of day. And could you explain the solution to this problem? Thanks in advance.