opencv3.2为什么还不发布官方python3 opencv版本

来源：蜘蛛抓取(WebSpider) 时间：2017-10-11 02:32 标签： python查询opencv版本
查看: 94928|回复: 35
VM简单设置反虚拟机检测设置（网游实测）
本帖最后由 lsfsky 于
10:12 编辑
混了卡饭那么久了&&第一次发帖 方法也不算原创
& & 解决 VMware 虚拟机 中被提示 “请不要在虚拟机中运行此程序”或者“Themida Sorry, this application cannot run under a Virtual Machine”设置：
1、用记事本打开 VMX 文件 类似 Windows XP Professional.vmx ，在文本末尾加入两行
monitor_control.restrict_backdoor = TRUE
disable_acceleration = TRUE
“这样处理以后有个后遗症， 就是 VMTools 可能无法加载了”，我先把VMtools先装好再设置的。
2、打开VM，在cpu设置，选择虚拟化（最长的那个）。（反虚拟机检测关键在于虚拟化）
大家可以参考下16楼坛友danny8376的回复，我只是以前玩网游的时候去百度的方法试验出来的，具体原理我也不懂。
有些游戏可能会检测显卡，具体修改可以参考坛友修改VMware虚拟机里面的显卡名称 传送门
版区有你更精彩： ）
好像还有其它方法
风之暇想 发表于
好像还有其它方法
我又没说没其他&&你知道的话&&跟大家分享下啊
代{过}{滤}理失效有一段时间没去国际服了，最近有啥更新吗？LZ在亚服还是美服，有免费vpn吗
apollooqm 发表于
代{过}{滤}理失效有一段时间没去国际服了，最近有啥更新吗？LZ在亚服还是美服，有免费vpn吗
美服&&用的免费的VPN是&&MXvpn&&一天100M流量 没时间限制
apollooqm 发表于
代{过}{滤}理失效有一段时间没去国际服了，最近有啥更新吗？LZ在亚服还是美服，有免费vpn吗
- -你也潜水好久的啊现在还是开箱子3倍经验活动
lsfsky 发表于
- -你也潜水好久的啊现在还是开箱子3倍经验活动
是啊，开90级送黄金套活动练了几个号后就没咋玩，耍了一阵剑灵，不知何故还是觉得奇迹世界吸引我
请问在9.0版本中是否有，如8.0效果不好的情况？
感谢分享~~~~~~~~~~~~~~~~~
Copyright & KaFan & All Rights Reserved.
Powered by Discuz! X3.1( 苏ICP备号 ) GMT+8,24786人阅读
在当今信息安全领域，特别是恶意软件分析中，经常需要利用到虚拟机技术，以提高病毒分析过程的安全性以及硬件资源的节约性，因此它在恶意软件领域中是应用越来越来广泛。这里我们所谓的虚拟机（Virtual&Machine）是指通过软件模拟的具有完整硬件系统功能的、运行在一个完全隔离环境中的完整计算机系统。通过虚拟机软件（比如VMware，Virtual&PC&,VirtualBox），你可以在一台物理计算机上模拟出一台或多台虚拟的计算机，这些虚拟机完全就像真正的计算机那样进行工作，例如你可以安装操作系统、安装应用程序、访问网络资源等等。攻击者为了提高恶意程序的隐蔽性以及破坏真实主机的成功率，他们都在恶意程序中加入检测虚拟机的代码，以判断程序所处的运行环境。当发现程序处于虚拟机（特别是蜜罐系统）中时，它就会改变操作行为或者中断执行，以此提高反病毒人员分析恶意软件行为的难度。本文主要针对基于Intel&CPU的虚拟环境VMware中的Windows&XP&SP3系统进行检测分析，并列举出当前常见的几种虚拟机检测方法。
方法一：通过执行特权指令来检测虚拟机
Vmware为真主机与虚拟机之间提供了相互沟通的通讯机制，它使用“IN”指令来读取特定端口的数据以进行两机通讯，但由于IN指令属于特权指令，在处于保护模式下的真机上执行此指令时，除非权限允许，否则将会触发类型为“EXCEPTION_PRIV_INSTRUCTION”的异常，而在虚拟机中并不会发生异常，在指定功能号0A（获取VMware版本）的情况下，它会在EBX中返回其版本号“VMXH”；而当功能号为0x14时，可用于获取VMware内存大小，当大于0时则说明处于虚拟机中。VMDetect正是利用前一种方法来检测VMware的存在，其检测代码分析如下：
bool&IsInsideVMWare()
&&bool&rc&=&
&&&&&&push&&&edx
&&&&&&push&&&ecx
&&&&&&push&&&ebx
&&&&&&mov&&&&eax,&'VMXh'
&&&&&&mov&&&&ebx,&0&&//&将ebx设置为非幻数’VMXH’的其它值
&&&&&&mov&&&&ecx,&10&//&指定功能号，用于获取VMWare版本，当它为0x14时用于获取VMware内存大小
&&&&&&mov&&&&edx,&'VX'&//&端口号
&&&&&&in&&&&&eax,&dx&//&从端口dx读取VMware版本到eax
//若上面指定功能号为0x14时，可通过判断eax中的值是否大于0，若是则说明处于虚拟机中
&&&&&&cmp&&&&ebx,&'VMXh'&//&判断ebx中是否包含VMware版本’VMXh’，若是则在虚拟机中
&&&&&&setz&&&[rc]&//&设置返回值
&&&&&&pop&&&&ebx
&&&&&&pop&&&&ecx
&&&&&&pop&&&&edx
&&__except(EXCEPTION_EXECUTE_HANDLER)&&//如果未处于VMware中，则触发此异常
测试结果：
&&&&&&&&&&&&&&&&&图1
如图1所示，VMDetect成功检测出VMWare的存在。
方法二：利用IDT基址检测虚拟机
利用IDT基址检测虚拟机的方法是一种通用方式，对VMware和Virtual&PC均适用。中断描述符表IDT（Interrupt&Descriptor&Table）用于查找处理中断时所用的软件函数，它是一个由256项组成的数据，其中每一中断对应一项函数。为了读取IDT基址，我们需要通过SIDT指令来读取IDTR（中断描述符表寄存器，用于IDT在内存中的基址），SIDT指令是以如下格式来存储IDTR的内容：
typedef&struct
&&&&WORD&IDTL&&&&//&IDT的大小
&&&&WORD&LowIDT&&//&IDT的低位地址
&&&&WORD&HiIDT&&//&IDT的高位地址
}&IDTINFO;
由于只存在一个IDTR，但又存在两个操作系统，即虚拟机系统和真主机系统。为了防止发生冲突，VMM（虚拟机监控器）必须更改虚拟机中的IDT地址，利用真主机与虚拟机环境中执行sidt指令的差异即可用于检测虚拟机是否存在。著名的“红丸”（redpill）正是利用此原理来检测VMware的。Redpill作者在VMware上发现虚拟机系统上的IDT地址通常位于0xFFXXXXXX，而Virtual&PC通常位于0xE8XXXXXX，而在真实主机上正如图2所示都位于0x80xxxxxx。Redpill仅仅是通过判断执行SIDT指令后返回的第一字节是否大于0xD0，若是则说明它处于虚拟机，否则处于真实主机中。Redpill的源码甚是精简，源码分析如下：
#include&&stdio.h&
int&main&()&{
&&unsigned&char&m[2+4],&rpill[]&=&&\x0f\x01\x0d\x00\x00\x00\x00\xc3&;&&//相当于SIDT[adrr],其中addr用于保存IDT地址
&&*((unsigned*)&rpill[3])&=&(unsigned)m;&&//将sidt[addr]中的addr设为m的地址
&&((void(*)())&rpill)();&&//执行SIDT指令，并将读取后IDT地址保存在数组m中
&&printf&(&idt&base:&%#x\n&,&*((unsigned*)&m[2]));&&&//由于前2字节为IDT大小，因此从m[2]开始即为IDT地址
&&if&(m[5]&0xd0)&printf&(&Inside&Matrix!\n&,&m[5]);&//当IDT基址大于0xd0xxxxxx时则说明程序处于VMware中
&&else&printf&(&Not&in&Matrix.\n&);
&&return&0;
测试结果如图2所示：
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&图2
利用此IDT检测的方法存在一个缺陷，由于IDT的值只针对处于正在运行的处理器而言，在单CPU中它是个常量，但当它处于多CPU时就可能会受到影响了，因为每个CPU都有其自己的IDT，这样问题就自然而然的产生了。针对此问题，Offensive&Computing组织成员提出了两种应对方法，其中一种方法就是利用Redpill反复地在系统上循环执行任务，以此构造出一张当前系统的IDT值变化统计图，但这会增加CPU负担；另一种方法就是windows&API函数SetThreadAffinityMask()将线程限制在单处理器上执行，当执行此测试时只能准确地将线程执行环境限制在本地处理器，而对于将线程限制在VM处理器上就可能行不通了，因为VM是计划在各处理器上运行的，VM线程在不同的处理器上执行时，IDT值将会发生变化，因此此方法也是很少被使用的。为此，有人提出了使用LDT的检测方法，它在具有多个CPU的环境下检测虚拟机明显优于IDT检测方法，该方法具体内容参见下节内容。
方法三：利用LDT和GDT的检测方法
在&《Intel(R)&64&and&IA-32&&Architecture&Software&Developer’s&Manual&Volume&3A:&System&Programming&Guide》第二章的Vol.3&2-5&一页（我的Intel开发手册是2008版的）中对于LDT和GDT的描述如下（以下内容为个人翻译）：
在保护模式下，所有的内存访问都要通过全局描述符表（GDT）或者本地描述符表（LDT）才能进行。这些表包含有段描述符的调用入口。各个段描述符都包含有各段的基址，访问权限，类型和使用信息，而且每个段描述符都拥有一个与之相匹配的段选择子，各个段选择子都为软件程序提供一个GDT或LDT索引（与之相关联的段描述符偏移量），一个全局/本地标志（决定段选择子是指向GDT还是LDT），以及访问权限信息。
若想访问段中的某一字节，必须同时提供一个段选择子和一个偏移量。段选择子为段提供可访问的段描述符地址（在GDT&或者LDT&中）。通过段描述符，处理器从中获取段在线性地址空间里的基址，而偏移量用于确定字节地址相对基址的位置。假定处理器在当前权限级别（CPL）可访问这个段，那么通过这种机制就可以访问在GDT&或LDT&中的各种有效代码、数据或者堆栈段，这里的CPL是指当前可执行代码段的保护级别。
GDT的线性基址被保存在GDT寄存器（GDTR）中，而LDT的线性基址被保存在LDT寄存器（LDTR）中。&
由于虚拟机与真实主机中的GDT和LDT并不能相同，这与使用IDT的检测方法一样，因此虚拟机必须为它们提供一个“复制体”。关于GDT和LDT的基址可通过SGDT和SLDT指令获取。虚拟机检测工具Scoopy&suite的作者Tobias&Klein经测试发现，当LDT基址位于0x0000（只有两字节）时为真实主机，否则为虚拟机，而当GDT基址位于0xFFXXXXXX时说明处于虚拟机中，否则为真实主机。具体实现代码如下：
#include&&stdio.h&
void&LDTDetect(void)
&&&&unsigned&short&ldt_addr&=&0;
&&&&unsigned&char&ldtr[2];
&&&&_asm&sldt&ldtr
&&&&ldt_addr&=&*((unsigned&short&*)&ldtr);
&&&&printf(&LDT&BaseAddr:&0x%x\n&,&ldt_addr);
&&&&if(ldt_addr&==&0x0000)
&&&&&&&&printf(&Native&OS\n&);
&&&&&&&&printf(&Inside&VMware\n&);
void&GDTDetect(void)
&&&&unsigned&int&gdt_addr&=&0;
&&&&unsigned&char&gdtr[4];
&&&&_asm&sgdt&gdtr
&&&&gdt_addr&=&*((unsigned&int&*)&gdtr[2]);
&&&&printf(&GDT&BaseAddr:0x%x\n&,&gdt_addr);
&&&&if((gdt_addr&&&&24)&==&0xff)
&&&&&&&&printf(&Inside&VMware\n&);
&&&&&&&&printf(&Native&OS\n&);
int&main(void)
&&&&LDTDetect();
&&&&GDTDetect();
&&&&return&0;
测试结果如图3所示：
&&&&&&&&&&&&&&&&&&&图3
方法四：基于STR的检测方法
在保护模式下运行的所有程序在切换任务时，对于当前任务中指向TSS的段选择器将会被存储在任务寄存器中，TSS中包含有当前任务的可执行环境状态，包括通用寄存器状态，段寄存器状态，标志寄存器状态，EIP寄存器状态等等，当此项任务再次被执行时，处理器就会其原先保存的任务状态。每项任务均有其自己的TSS，而我们可以通过STR指令来获取指向当前任务中TSS的段选择器。这里STR（Store&task&register）指令是用于将任务寄存器&(TR)&中的段选择器存储到目标操作数，目标操作数可以是通用寄存器或内存位置，使用此指令存储的段选择器指向当前正在运行的任务的任务状态段&(TSS)。在虚拟机和真实主机之中，通过STR读取的地址是不同的，当地址等于0x0040xxxx时，说明处于虚拟机中，否则为真实主机。实现代码如下：
#include&&stdio.h&
int&main(void)
&&&&unsigned&char&mem[4]&=&{0};
&&&&int&i;
&&&&__asm&str&
&&&&printf&(&&STR&base:&0x&);
&&&&for&(i=0;&i&4;&i++)
&&&&&&&&printf(&%02x&,mem[i]);
&&&&if&(&(mem[0]==0x00)&&&&(mem[1]==0x40))
&&&&&&&&printf(&\n&INSIDE&MATRIX!!\n&);
&&&&&&&&printf(&\n&Native&OS!!\n&);
&&&&return&0;
测试结果如图4所示：
&&&&&&&&&&&&&&&&&&&&&&&&&&图4
方法五：基于注册表检测虚拟机
在windows虚拟机中常常安装有VMware&Tools以及其它的虚拟硬件（如网络适配器、虚拟打印机，USB集线器……），它们都会创建任何程序都可以读取的windows注册表项，因此我们可以通过检测注册表中的一些关键字符来判断程序是否处于虚拟机之中。关于这些注册表的位置我们可以通过在注册表中搜索关键词“vmware”来获取，下面是我在VMware下的WinXP中找到的一些注册表项：
项名：HKEY_CLASSES_ROOT\Applications\VMwareHostOpen.exe
项名：HKEY_CLASSES_ROOT\Installer\Products\C2A6F2EFEB2B12CF170FE\ProductName
键值“VMware&Tools”
项名：HKEY_CLASSES_ROOT\Installer\Products\C2A6F2EFEB2B12CF170FE\SourceList\PackageName
键值：VMware&Tools.msi
项名：HKEY_CURRENT_USER\Printers\DeviceOld
键值：_#VMwareVirtualPrinter,winspool,TPVM:
项名：HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi&Port&0\Scsi&Bus&0\Target&Id&0\Logical&Unit&Id&0\Identifier
键值：VMware&Virtual&IDE&Hard&Drive
项名：HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi&Port&1\Scsi&Bus&0\Target&Id&0\Logical&Unit&Id&0\Identifier
键值：NECVMWar&VMware&IDE&CDR10
项名：HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\C2A6F2EFEB2B12CF170FE\ProductName
键值：VMware&Tools
项名：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C2A6F2EFEB2B12CF170FE\InstallProperties\DisplayName
键值：VMware&Tools
项名：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\0002\DeviceDesc
键值：VMware&SVGA&II
项名：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows&NT\CurrentVersion\NetworkCards\2\Description
键值：VMware&Accelerated&AMD&PCNet&Adapter
项名：HKEY_LOCAL_MACHINE\SOFTWARE\VMware,&Inc.\VMware&Tools
项名：HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-0}\0000\DriverDesc
键值：VMware&SVGA&II
项名：HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-
0}\0000\ProviderName
键值：VMware,&Inc.
项名：HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-0}\0001\DriverDesc
键值：VMware&Accelerated&AMD&PCNet&Adapter
项名：HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E97B-E325-11CE-BFC1-0}\0000\DriverDesc
键值：VMware&SCSI&Controller
项名：HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ThinPrint&Print&Port&Monitor&for&VMWare
补充另外一处 具体代码如下：
BOOL DetectVM() {
char szBuffer[64];
unsigned long hSize= sizeof(szBuffer) - 1;
if( RegOpenKeyEx( HKEY_LOCAL_MACHINE, &HARDWARE\\DESCRIPTION\\System\\BIOS\\&, 0, KEY_READ, &hKey )==ERROR_SUCCESS ) {
RegQueryValueEx( hKey, &SystemManufacturer&, NULL, NULL, (unsigned char *)szBuffer, &hSize );
if( strstr( szBuffer, &VMWARE& )) {
RegCloseKey( hKey );
return TRUE;
RegCloseKey( hKey );
return FALSE;
除以上这些表项之外，还有很多地方可以检测，特别是虚拟机提供的虚拟化软硬件、服务之类，比如文件共享服务，VMware&物理磁盘助手服务，VMware&Ethernet&Adapter&Driver，VMware&SCSI&Controller等等的这些信息都可作为检测虚拟机的手段。这里我们就以其中某表项为例编程举例一下，其它表项检测方法同理，具体代码如下：
.model&flat,&stdcall
option&casemap:none
&&&include&&windows.inc
&&&include&&user32.inc
&&&include&&kernel32.inc
&&&include&&advapi32.inc
&&&includelib&&user32.lib
&&&includelib&&kernel32.lib
&&&includelib&&advapi32.lib
szCaption&&&&&db&&VMware&Detector&&,0
szInside&&&&&&&&&db&&Inside&VMware!&,0
szOutside&&&&&&&&&&&&&&db&&Native&OS!&,0
szSubKey&&&&&&db&&software\VMWare,&Inc.\VMware&tools&,0
hKey&&&&&&&&&&&&&&dd&&&&?
&&invoke&RegOpenKeyEx,&HKEY_LOCAL_MACHINE,&addr&szSubKey,&0,\
&&&&&&&&&&&&&&&&&KEY_WRITE&or&KEY_READ,&addr&hKey
&&.if&eax&==&ERROR_SUCCESS
&&invoke&MessageBox,&NULL,addr&szInside,&addr&szCaption,&MB_OK
&&invoke&MessageBox,&NULL,addr&szOutside,&addr&szCaption,&MB_OK
&&invoke&RegCloseKey,hKey
&&invoke&ExitProcess,NULL
测试结果如图5所示：
&&&&&&&&&&&&图5
方法六：基于时间差的检测方式
本方法通过运行一段特定代码，然后比较这段代码在虚拟机和真实主机之中的相对运行时间，以此来判断是否处于虚拟机之中。这段代码我们可以通过RDTSC指令来实现，RDTSC指令是用于将计算机启动以来的CPU运行周期数存放到EDX：EAX里面，其中EDX是高位，而EAX是低位。下面我们以xchg&&&&ecx,&&eax&一句指令的运行时间为例，这段指令在我的真实主机windows&7系统上的运行时间为0000001E，如图6所示：
&&&&&&&&&&&&&&图6
而该指令在虚拟机WinXP下的运行时间为，如图7所示：
&&&&&&&&&&&&&&&图7
两者之间的运行时间明显差别很多，在虚拟机中的运行速度远不如真实主机的，一般情况下，当它的运行时间大于0xFF时，就可以确定它处于虚拟机之中了，因此不难写出检测程序，具体实现代码如下：
.model&flat,&stdcall
option&casemap:none
include&&&&&&windows.inc
include&&&&&&&kernel32.inc
include&&&&&&user32.inc
includelib&&&&kernel32.lib
includelib&&&&user32.lib
szTitle&&&&&&db&&&VMDetect&With&RDTSC&,&0h
szInsideVM&&&&db&&&Inside&VMware!&,&0h
szOutsideVM&&&&db&&&Native&OS!&,&0h
&&xchg&&&&&ecx,&eax
&&sub&&&&eax,&ecx
&&cmp&&&&eax,&0FFh
&&jg&&&&Detected
&&invoke&&MessageBox,&0,&offset&szOutsideVM,&offset&szTitle,&0
&&invoke&&&MessageBox,&0,&offset&szInsideVM,&offset&szTitle,&0
测试结果如图8所示：
&&&&&&&&&&&&&&图8
方法七：利用虚拟硬件指纹检测虚拟机
利用虚拟硬件指纹也可用于检测虚拟机的存在，比如VMware默认的网卡MAC地址前缀为“00-05-69，00-0C-29或者00-50-56”，这前3节是由VMware分配的唯一标识符OUI，以供它的虚拟化适配器使用。在我的VMWare&WinXP下的MAC地址为00-0C-29-5B-D7-67，如图9所示：
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&图9
但由于这些可经过修改配置文件来绕过检测。另外，还可通过检测特定的硬件控制器，BIOS，USB控制器，显卡，网卡等特征字符串进行检测，这些在前面使用注册表检测方法中已有所涉及。
另外之前在看雪论坛上也有朋友提到通过检测硬盘Model&Number是否含有“vmware”或“virtual”等字样来实现检测虚拟机的功能，具体转载如下：
小试 anti vmware
今天偶然看到一款绿色版的硬盘专业工具，突然发现可以利用其中的一项功能来实现anti vmware。
今日事今日毕，那就在今晚12：00之前把这个想法实现吧，let's go!
我的想法就是检测硬盘的modelnumber,具体什么是modelnumber自己网上搜吧，反正不是硬盘序列号。难点就是在多种操作系统下都要能起到anti vmware的效果。程序在xp、2k、2003下都可以检测到vmware的运行。
直接贴代码了，如果看不懂也没关系，我也是逆了人家的代码写出来的。Delphi也可以当汇编语言开发工具用，难道不是吗？
unit Unit1;
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls, B
TForm1 = class(TForm)
BitBtn1: TBitB
procedure BitBtn1Click(Sender: TObject);
procedure FormClose(Sender: TO var Action: TCloseAction);
{ Private declarations }
{ Public declarations }
Form1: TForm1;
hDeviceHandle:T
implementation
{$R *.dfm}
procedure TForm1.BitBtn1Click(Sender: TObject);
InBuffer: array[0..$8f]
hDeviceHandle:=CreateFile('\\.\PHYSICALDRIVE0',$C,nil,OPEN_EXISTING,$);
ZeroMemory(@InBuffer,sizeof(InBuffer));
lea ebx,InBuffer
xor ecx,ecx
mov al,$2c
MOV [ebx],al
MOV EAX,$200c0000
MOV [ebx+4], eax
mov al,$01
MOV [ebx+8],al
mov al,$40
MOV [ebx+$c],al
MOV [ebx+$10], eax
mov al,$30
MOV [ebx+$18],al
mov al,$12
MOV [ebx+$1c],al
mov al,$40
MOV [ebx+$20],al
add ecx,ebx
add ecx,$50
MOV [ebx+$14], ecx
if DeviceIoControl(hDeviceHandle,$4D014,@InBuffer,$50,@InBuffer,$50,cb,nil) then
lea ebx,InBuffer
add ebx,$58
mov tmp,ebx
if ((pos('vmware',LowerCase(tmp))&0) or (pos('virtual',LowerCase(tmp))&0)) then
showmessage('检测到 VMware Workstation!!!')
showmessage('请在VMware中测试!');
procedure TForm1.FormClose(Sender: TO var Action: TCloseAction);
closehandle(hDeviceHandle);
代码很短，但是效果不错。截图几张，留作纪念!
C++代码实现如下：
通过IOCTL_STORAGE_QUERY_PROPERTY
typedef enum _STORAGE_QUERY_TYPE {PropertyStandardQuery = 0,PropertyExistsQuery,PropertyMaskQuery,PropertyQueryMaxDefined} STORAGE_QUERY_TYPE, *PSTORAGE_QUERY_TYPE;
typedef enum _STORAGE_PROPERTY_ID {StorageDeviceProperty = 0,StorageAdapterProperty} STORAGE_PROPERTY_ID, *PSTORAGE_PROPERTY_ID;
typedef struct _STORAGE_PROPERTY_QUERY {
STORAGE_PROPERTY_ID PropertyId;
STORAGE_QUERY_TYPE QueryT
UCHAR AdditionalParameters[1];
} STORAGE_PROPERTY_QUERY, *PSTORAGE_PROPERTY_QUERY;
typedef struct _STORAGE_DEVICE_DESCRIPTOR {
UCHAR DeviceT
UCHAR DeviceTypeM
BOOLEAN RemovableM
BOOLEAN CommandQ
ULONG VendorIdO
ULONG ProductIdO
} STORAGE_DEVICE_DESCRIPTOR, *PSTORAGE_DEVICE_DESCRIPTOR;
#define IOCTL_STORAGE_QUERY_PROPERTY CTL_CODE(IOCTL_STORAGE_BASE, 0x0500, METHOD_BUFFERED, FILE_ANY_ACCESS)
bool IsSandboxed()
HANDLE hPhysicalDriveIOCTL = 0;
int j = 0,k = 0;
char szModel[128],szBuffer[128];
char *szDrives[] = {
&virtual&,
hPhysicalDriveIOCTL = CreateFile (&\\\\.\\PhysicalDrive0&, 0,FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,OPEN_EXISTING, 0, NULL);
if (hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
STORAGE_PROPERTY_QUERY
DWORD cbBytesReturned = 0;
memset ((void *) & query, 0, sizeof (query));
query.PropertyId = StorageDeviceP
memset (szBuffer, 0, sizeof (szBuffer));
memset (szModel, 0, sizeof (szModel));
if (DeviceIoControl(hPhysicalDriveIOCTL, IOCTL_STORAGE_QUERY_PROPERTY,& query,sizeof (query),& szBuffer,sizeof (szBuffer),& cbBytesReturned, NULL)){
STORAGE_DEVICE_DESCRIPTOR *descrip = (STORAGE_DEVICE_DESCRIPTOR*)&szB
int pos = descrip-&ProductIdO
int m = 0;
for(int g =szBuffer[g] != '\0';g++){
szModel[m++] = szBuffer[g];
CharLowerBuff(szModel,strlen(szModel));
for (int i = 0; i & (sizeof(szDrives)/sizeof(LPSTR)) - 1; i++ ) {
if (szDrives[i][0] != 0) {
if(strstr(szModel,szDrives[i]))
return TRUE;
CloseHandle (hPhysicalDriveIOCTL);
return FALSE;
国外SANS安全组织的研究人员总结出当前各种虚拟机检测手段不外乎以下四类：
●&&搜索虚拟环境中的进程，文件系统，注册表；
●&&搜索虚拟环境中的内存
●&&搜索虚拟环境中的特定虚拟硬件
●&&搜索虚拟环境中的特定处理器指令和功能
因为现代计算系统大多是由文件系统，内存，处理器及各种硬件组件构成的，上面提到的四种检测手段均包含了这些因素。纵观前面各种检测方法，也均在此四类当中。除此之外，也有人提出通过网络来检测虚拟机，比如搜索ICMP和TCP数据通讯的时间差异，IP&ID数据包差异以及数据包中的异常头信息等等。随着技术研究的深入，相信会有更多的检测手段出现，与此同时，虚拟机厂商也会不断进化它们的产品，以增加anti-vmware的难度，这不也正是一场永无休止的无烟战争！
================================================================================
anti VM的解决方法
对于上边 方法一二三四六的解决方案是 ：
1.在本机BIOS的CPU设置中开启VT（虚拟化）选项。 注意要先做这一步以后 才能安装VM 顺序错了只能把VM完全卸载重新安装。
2.新建虚拟机 在CPU设置如下图设置：
主要目的是为了 关闭二进制优化 开启虚拟机的VT虚拟化。
3.关闭一些虚拟机的设置 用记事本打开 VMX 文件 这个文件是VM的配置文件 如类似地址&C:\VM Machines\Windows 7 (32位)\Windows 7 (32位).vmx&，在文本末尾加入
isolation.tools.getPtrLocation.disable = &TRUE&
isolation.tools.setPtrLocation.disable = &TRUE&
isolation.tools.setVersion.disable = &TRUE&
isolation.tools.getVersion.disable = &TRUE&
monitor_control.disable_directexec = &TRUE&
monitor_control.disable_chksimd = &TRUE&
monitor_control.disable_ntreloc = &TRUE&
monitor_control.disable_selfmod = &TRUE&
monitor_control.disable_reloc = &TRUE&
monitor_control.disable_btinout = &TRUE&
monitor_control.disable_btmemspace = &TRUE&
monitor_control.disable_btpriv = &TRUE&
monitor_control.disable_btseg = &TRUE&
monitor_control.restrict_backdoor = &TRUE&这样一来 就实现了 开启VT虚拟化 关闭二进制优化 关闭各种后门 然后安装VM中的系统 如WIN7 安装好后在VM WIN7中运行 方法一二三四六的检测全部通过了。
方法七的解决方案就是修改硬件信息，这里的VM特征硬件信息有很多，这里只说网卡的，直接下载一个mac地址修改器，修改mac这样一来mac地址就不是VM特有的了，从而达到过方法七的效果。
方法五，很多商业软件都是用这个方法来验证，原因很简单不管是在驱动还是在应用层都可以很方便的读取注册表，只要保护开发人员自己安装一个VM就能提取里边特征注册码，这个解决方案就是 搜索注册表的“VMware”& &virtual& 等字段，把能修改的都修改了，然后导出注册表，以便重启系统后导入，因为重启VM后有些注册表信息会还原。
实例如下：
环境：VM虚拟机 WIN7 32位，光盘镜像名称 XBL_GHOST_WIN7_SP1_07ZJB.iso
原理：修改注册表中的 “VMware” 修改为了 “test123”
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation]
&BIOSVersion&=&6.00&
&BIOSReleaseDate&=&07/02/2012&
&SystemManufacturer&=&test123, Inc.&
&SystemProductName&=&test123 test123 Platform&
&InformationSource&=dword:
[HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS]
&BiosMajorRelease&=dword:
&BiosMinorRelease&=dword:
&ECFirmwareMajorRelease&=dword:
&ECFirmwareMinorRelease&=dword:
&BaseBoardManufacturer&=&Intel Corporation&
&BaseBoardProduct&=&440BX Desktop Reference Platform&
&BaseBoardVersion&=&None&
&BIOSReleaseDate&=&07/02/2012&
&BIOSVendor&=&Phoenix Technologies LTD&
&BIOSVersion&=&6.00&
&SystemFamily&=&&
&SystemManufacturer&=&test123, Inc.&
&SystemProductName&=&test123 test123 Platform&
&SystemSKU&=&&
&SystemVersion&=&None&
[HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0]
&InquiryData&=hex:00,00,02,02,1f,00,00,73,56,4d,77,61,72,65,2c,20,56,4d,77,61,\
72,65,20,56,69,72,74,75,61,6c,20,53,31,2e,30,20
&Identifier&=&test123, test123 Virtual S1.0 &
&DeviceType&=&DiskPeripheral&
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-0}\0000]
&CoInstallers32&=hex(7):76,00,6d,00,78,00,5f,00,6d,00,6f,00,64,00,65,00,2e,00,\
64,00,6c,00,6c,00,2c,00,20,00,56,00,4d,00,58,00,5f,00,4d,00,6f,00,64,00,65,\
00,43,00,68,00,61,00,6e,00,67,00,65,00,00,00,00,00
&InfPath&=&oem2.inf&
&InfSection&=&vmx_svga_vista&
&ProviderName&=&test123, Inc.&
&DriverDateData&=hex:00,80,de,95,e5,e0,ca,01
&DriverDate&=&4-21-2010&
&DriverVersion&=&11.6.0.35&
&MatchingDeviceId&=&pci\\ven_15ad&dev_0405&subsys_040515ad&rev_00&
&DriverDesc&=&test123 SVGA II&
&FeatureScore&=dword:000000fc
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-0}\0000\Settings]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation]
&BIOSVersion&=&6.00&
&BIOSReleaseDate&=&07/02/2012&
&SystemManufacturer&=&test123, Inc.&
&SystemProductName&=&test123 test123 Platform&
&InformationSource&=dword:
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Video\{ABBD-44A8-95C3-DC6CB912ED85}\0000]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
&Resolution.0&=hex:33,32,30,78,32,34,30,00
&Resolution.1&=hex:34,30,30,78,33,30,30,00
&Resolution.2&=hex:35,31,32,78,33,38,34,00
&Resolution.3&=hex:36,34,30,78,34,38,30,00
&Resolution.4&=hex:38,30,30,78,36,30,30,00
&Resolution.5&=hex:31,30,32,34,78,37,36,38,00
&Resolution.6&=hex:31,31,35,32,78,38,36,34,00
&Resolution.7&=hex:31,32,38,30,78,39,36,30,00
&Resolution.8&=hex:31,34,30,30,78,31,30,35,30,00
&Resolution.9&=hex:31,36,30,30,78,31,32,30,30,00
&Resolution.10&=hex:31,39,32,30,78,31,34,34,30,00
&Resolution.11&=hex:32,30,34,38,78,31,35,33,36,00
&Resolution.12&=hex:32,35,36,30,78,31,39,32,30,00
&Resolution.13&=hex:38,35,34,78,34,38,30,00
&Resolution.14&=hex:31,32,38,30,78,37,32,30,00
&Resolution.15&=hex:31,33,36,36,78,37,36,38,00
&Resolution.16&=hex:31,39,32,30,78,31,30,38,30,00
&Resolution.17&=hex:31,32,38,30,78,38,30,30,00
&Resolution.18&=hex:31,34,34,30,78,39,30,30,00
&Resolution.19&=hex:31,36,38,30,78,31,30,35,30,00
&Resolution.20&=hex:31,39,32,30,78,31,32,30,30,00
&Resolution.21&=hex:32,35,36,30,78,31,36,30,30,00
&Resolution.22&=hex:37,32,30,78,34,38,30,00
&Resolution.23&=hex:37,32,30,78,35,37,36,00
&Resolution.24&=hex:33,32,30,78,32,30,30,00
&Resolution.25&=hex:36,34,30,78,34,30,30,00
&Resolution.26&=hex:38,30,30,78,34,38,30,00
&Resolution.27&=hex:31,32,38,30,78,37,36,38,00
&Resolution.28&=hex:31,32,38,30,78,31,30,32,34,00
&HardwareInformation.ChipType&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,00,\
53,00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
&HardwareInformation.DacType&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,00,53,\
00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
&HardwareInformation.MemorySize&=hex:00,00,00,08
&HardwareInformation.AdapterString&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,\
00,53,00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
&HardwareInformation.BiosString&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,00,\
53,00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Video\{ABBD-44A8-95C3-DC6CB912ED85}\0000\VolatileSettings]
&{5b45201d-f2f2-4f3b-85bb-30ff1f953599}&=hex:5c,00,3f,00,3f,00,5c,00,50,00,43,\
00,49,00,23,00,56,00,45,00,4e,00,5f,00,31,00,35,00,41,00,44,00,26,00,44,00,\
45,00,56,00,5f,00,30,00,34,00,30,00,35,00,26,00,53,00,55,00,42,00,53,00,59,\
00,53,00,5f,00,30,00,34,00,30,00,35,00,31,00,35,00,41,00,44,00,26,00,52,00,\
45,00,56,00,5f,00,30,00,30,00,23,00,33,00,26,00,32,00,61,00,63,00,66,00,31,\
00,65,00,39,00,26,00,30,00,26,00,37,00,38,00,23,00,7b,00,35,00,62,00,34,00,\
35,00,32,00,30,00,31,00,64,00,2d,00,66,00,32,00,66,00,32,00,2d,00,34,00,66,\
00,33,00,62,00,2d,00,38,00,35,00,62,00,62,00,2d,00,33,00,30,00,66,00,66,00,\
31,00,66,00,39,00,35,00,33,00,35,00,39,00,39,00,7d,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Video\{ABBD-44A8-95C3-DC6CB912ED85}\0001]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Video\{ABBD-44A8-95C3-DC6CB912ED85}\0001\VolatileSettings]
&{5b45201d-f2f2-4f3b-85bb-30ff1f953599}&=hex:5c,00,3f,00,3f,00,5c,00,50,00,43,\
00,49,00,23,00,56,00,45,00,4e,00,5f,00,31,00,35,00,41,00,44,00,26,00,44,00,\
45,00,56,00,5f,00,30,00,34,00,30,00,35,00,26,00,53,00,55,00,42,00,53,00,59,\
00,53,00,5f,00,30,00,34,00,30,00,35,00,31,00,35,00,41,00,44,00,26,00,52,00,\
45,00,56,00,5f,00,30,00,30,00,23,00,33,00,26,00,32,00,61,00,63,00,66,00,31,\
00,65,00,39,00,26,00,30,00,26,00,37,00,38,00,23,00,7b,00,35,00,62,00,34,00,\
35,00,32,00,30,00,31,00,64,00,2d,00,66,00,32,00,66,00,32,00,2d,00,34,00,66,\
00,33,00,62,00,2d,00,38,00,35,00,62,00,62,00,2d,00,33,00,30,00,66,00,66,00,\
31,00,66,00,39,00,35,00,33,00,35,00,39,00,39,00,7d,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmx_svga\Device0]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E968-E325-11CE-BFC1-0}\0000]
&CoInstallers32&=hex(7):76,00,6d,00,78,00,5f,00,6d,00,6f,00,64,00,65,00,2e,00,\
64,00,6c,00,6c,00,2c,00,20,00,56,00,4d,00,58,00,5f,00,4d,00,6f,00,64,00,65,\
00,43,00,68,00,61,00,6e,00,67,00,65,00,00,00,00,00
&InfPath&=&oem2.inf&
&InfSection&=&vmx_svga_vista&
&ProviderName&=&test123, Inc.&
&DriverDateData&=hex:00,80,de,95,e5,e0,ca,01
&DriverDate&=&4-21-2010&
&DriverVersion&=&11.6.0.35&
&MatchingDeviceId&=&pci\\ven_15ad&dev_0405&subsys_040515ad&rev_00&
&DriverDesc&=&test123 SVGA II&
&FeatureScore&=dword:000000fc
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E968-E325-11CE-BFC1-0}\0000\Settings]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Video\{ABBD-44A8-95C3-DC6CB912ED85}\0000]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
&Resolution.0&=hex:33,32,30,78,32,34,30,00
&Resolution.1&=hex:34,30,30,78,33,30,30,00
&Resolution.2&=hex:35,31,32,78,33,38,34,00
&Resolution.3&=hex:36,34,30,78,34,38,30,00
&Resolution.4&=hex:38,30,30,78,36,30,30,00
&Resolution.5&=hex:31,30,32,34,78,37,36,38,00
&Resolution.6&=hex:31,31,35,32,78,38,36,34,00
&Resolution.7&=hex:31,32,38,30,78,39,36,30,00
&Resolution.8&=hex:31,34,30,30,78,31,30,35,30,00
&Resolution.9&=hex:31,36,30,30,78,31,32,30,30,00
&Resolution.10&=hex:31,39,32,30,78,31,34,34,30,00
&Resolution.11&=hex:32,30,34,38,78,31,35,33,36,00
&Resolution.12&=hex:32,35,36,30,78,31,39,32,30,00
&Resolution.13&=hex:38,35,34,78,34,38,30,00
&Resolution.14&=hex:31,32,38,30,78,37,32,30,00
&Resolution.15&=hex:31,33,36,36,78,37,36,38,00
&Resolution.16&=hex:31,39,32,30,78,31,30,38,30,00
&Resolution.17&=hex:31,32,38,30,78,38,30,30,00
&Resolution.18&=hex:31,34,34,30,78,39,30,30,00
&Resolution.19&=hex:31,36,38,30,78,31,30,35,30,00
&Resolution.20&=hex:31,39,32,30,78,31,32,30,30,00
&Resolution.21&=hex:32,35,36,30,78,31,36,30,30,00
&Resolution.22&=hex:37,32,30,78,34,38,30,00
&Resolution.23&=hex:37,32,30,78,35,37,36,00
&Resolution.24&=hex:33,32,30,78,32,30,30,00
&Resolution.25&=hex:36,34,30,78,34,30,30,00
&Resolution.26&=hex:38,30,30,78,34,38,30,00
&Resolution.27&=hex:31,32,38,30,78,37,36,38,00
&Resolution.28&=hex:31,32,38,30,78,31,30,32,34,00
&HardwareInformation.ChipType&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,00,\
53,00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
&HardwareInformation.DacType&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,00,53,\
00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
&HardwareInformation.MemorySize&=hex:00,00,00,08
&HardwareInformation.AdapterString&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,\
00,53,00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
&HardwareInformation.BiosString&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,00,\
53,00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Video\{ABBD-44A8-95C3-DC6CB912ED85}\0001]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\vmx_svga\Device0]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-0}\0000]
&CoInstallers32&=hex(7):76,00,6d,00,78,00,5f,00,6d,00,6f,00,64,00,65,00,2e,00,\
64,00,6c,00,6c,00,2c,00,20,00,56,00,4d,00,58,00,5f,00,4d,00,6f,00,64,00,65,\
00,43,00,68,00,61,00,6e,00,67,00,65,00,00,00,00,00
&InfPath&=&oem2.inf&
&InfSection&=&vmx_svga_vista&
&ProviderName&=&test123, Inc.&
&DriverDateData&=hex:00,80,de,95,e5,e0,ca,01
&DriverDate&=&4-21-2010&
&DriverVersion&=&11.6.0.35&
&MatchingDeviceId&=&pci\\ven_15ad&dev_0405&subsys_040515ad&rev_00&
&DriverDesc&=&test123 SVGA II&
&FeatureScore&=dword:000000fc
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-0}\0000\Settings]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation]
&BIOSVersion&=&6.00&
&BIOSReleaseDate&=&07/02/2012&
&SystemManufacturer&=&test123, Inc.&
&SystemProductName&=&test123 test123 Platform&
&InformationSource&=dword:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video\{ABBD-44A8-95C3-DC6CB912ED85}\0000]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
&Resolution.0&=hex:33,32,30,78,32,34,30,00
&Resolution.1&=hex:34,30,30,78,33,30,30,00
&Resolution.2&=hex:35,31,32,78,33,38,34,00
&Resolution.3&=hex:36,34,30,78,34,38,30,00
&Resolution.4&=hex:38,30,30,78,36,30,30,00
&Resolution.5&=hex:31,30,32,34,78,37,36,38,00
&Resolution.6&=hex:31,31,35,32,78,38,36,34,00
&Resolution.7&=hex:31,32,38,30,78,39,36,30,00
&Resolution.8&=hex:31,34,30,30,78,31,30,35,30,00
&Resolution.9&=hex:31,36,30,30,78,31,32,30,30,00
&Resolution.10&=hex:31,39,32,30,78,31,34,34,30,00
&Resolution.11&=hex:32,30,34,38,78,31,35,33,36,00
&Resolution.12&=hex:32,35,36,30,78,31,39,32,30,00
&Resolution.13&=hex:38,35,34,78,34,38,30,00
&Resolution.14&=hex:31,32,38,30,78,37,32,30,00
&Resolution.15&=hex:31,33,36,36,78,37,36,38,00
&Resolution.16&=hex:31,39,32,30,78,31,30,38,30,00
&Resolution.17&=hex:31,32,38,30,78,38,30,30,00
&Resolution.18&=hex:31,34,34,30,78,39,30,30,00
&Resolution.19&=hex:31,36,38,30,78,31,30,35,30,00
&Resolution.20&=hex:31,39,32,30,78,31,32,30,30,00
&Resolution.21&=hex:32,35,36,30,78,31,36,30,30,00
&Resolution.22&=hex:37,32,30,78,34,38,30,00
&Resolution.23&=hex:37,32,30,78,35,37,36,00
&Resolution.24&=hex:33,32,30,78,32,30,30,00
&Resolution.25&=hex:36,34,30,78,34,30,30,00
&Resolution.26&=hex:38,30,30,78,34,38,30,00
&Resolution.27&=hex:31,32,38,30,78,37,36,38,00
&Resolution.28&=hex:31,32,38,30,78,31,30,32,34,00
&HardwareInformation.ChipType&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,00,\
53,00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
&HardwareInformation.DacType&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,00,53,\
00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
&HardwareInformation.MemorySize&=hex:00,00,00,08
&HardwareInformation.AdapterString&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,\
00,53,00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
&HardwareInformation.BiosString&=hex:56,00,4d,00,77,00,61,00,72,00,65,00,20,00,\
53,00,56,00,47,00,41,00,20,00,49,00,49,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video\{ABBD-44A8-95C3-DC6CB912ED85}\0000\VolatileSettings]
&{5b45201d-f2f2-4f3b-85bb-30ff1f953599}&=hex:5c,00,3f,00,3f,00,5c,00,50,00,43,\
00,49,00,23,00,56,00,45,00,4e,00,5f,00,31,00,35,00,41,00,44,00,26,00,44,00,\
45,00,56,00,5f,00,30,00,34,00,30,00,35,00,26,00,53,00,55,00,42,00,53,00,59,\
00,53,00,5f,00,30,00,34,00,30,00,35,00,31,00,35,00,41,00,44,00,26,00,52,00,\
45,00,56,00,5f,00,30,00,30,00,23,00,33,00,26,00,32,00,61,00,63,00,66,00,31,\
00,65,00,39,00,26,00,30,00,26,00,37,00,38,00,23,00,7b,00,35,00,62,00,34,00,\
35,00,32,00,30,00,31,00,64,00,2d,00,66,00,32,00,66,00,32,00,2d,00,34,00,66,\
00,33,00,62,00,2d,00,38,00,35,00,62,00,62,00,2d,00,33,00,30,00,66,00,66,00,\
31,00,66,00,39,00,35,00,33,00,35,00,39,00,39,00,7d,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video\{ABBD-44A8-95C3-DC6CB912ED85}\0001]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video\{ABBD-44A8-95C3-DC6CB912ED85}\0001\VolatileSettings]
&{5b45201d-f2f2-4f3b-85bb-30ff1f953599}&=hex:5c,00,3f,00,3f,00,5c,00,50,00,43,\
00,49,00,23,00,56,00,45,00,4e,00,5f,00,31,00,35,00,41,00,44,00,26,00,44,00,\
45,00,56,00,5f,00,30,00,34,00,30,00,35,00,26,00,53,00,55,00,42,00,53,00,59,\
00,53,00,5f,00,30,00,34,00,30,00,35,00,31,00,35,00,41,00,44,00,26,00,52,00,\
45,00,56,00,5f,00,30,00,30,00,23,00,33,00,26,00,32,00,61,00,63,00,66,00,31,\
00,65,00,39,00,26,00,30,00,26,00,37,00,38,00,23,00,7b,00,35,00,62,00,34,00,\
35,00,32,00,30,00,31,00,64,00,2d,00,66,00,32,00,66,00,32,00,2d,00,34,00,66,\
00,33,00,62,00,2d,00,38,00,35,00,62,00,62,00,2d,00,33,00,30,00,66,00,66,00,\
31,00,66,00,39,00,35,00,33,00,35,00,39,00,39,00,7d,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vmx_svga\Device0]
&InstalledDisplayDrivers&=hex(7):76,00,6d,00,78,00,5f,00,66,00,62,00,00,00,00,\
&VgaCompatible&=dword:
&DefaultSettings.XResolution&=dword:
&DefaultSettings.YResolution&=dword:
&DefaultSettings.BitsPerPel&=dword:
&Device Description&=&test123 SVGA II&
这样一来就解决了方法五，anti VM有可能是多种方法结合，所以需要具体测试。
参考知识库
* 以上用户言论只代表其个人观点，不代表CSDN网站的观点或立场
访问：1683164次
积分：16325
积分：16325
排名：第491名
原创：30篇
转载：765篇
评论：168条
(11)(22)(14)(2)(13)(17)(5)(12)(2)(3)(17)(41)(31)(11)(8)(14)(12)(12)(6)(18)(10)(8)(17)(5)(2)(7)(7)(7)(10)(15)(23)(25)(5)(19)(9)(3)(9)(7)(10)(18)(19)(25)(13)(14)(7)(15)(36)(7)(3)(8)(17)(12)(32)(14)(4)(14)(26)(7)(15)(11)(16)(5)

我要回帖

更多关于 python查询opencv版本 的文章

 

随机推荐