1
2;--- Win64 console application with exception handler, uses WinInc v2+
3;--- assemble: jwasm -c -win64 -Zp8 Win64_5.asm
4;--- link: link /subsystem:console /Libpath:\WinInc\Lib64 Win64_5.obj
5
6    option casemap:none
7    option frame:auto
8
9    .nolist
10    .nocref
11WIN32_LEAN_AND_MEAN equ 1
12    include \WinInc\Include\windows.inc
13    .list
14    .cref
15
16    includelib <kernel32.lib>
17
18;--- CStr(): macro function to simplify defining a string
19
20CStr macro Text:VARARG
21local szText
22    .const
23szText  db Text,0
24    .code
25    exitm <offset szText>
26endm
27
28    .CODE
29
30exchdl proc pRecord:ptr, ulframe:qword, pContext:ptr, x4:ptr
31
32    add qword ptr [r8].CONTEXT.Rip_, 1  ;1=size of "in EAX, DX" opcode
33    mov eax, 0  ;0=continue execution?
34    ret
35
36exchdl endp
37
38VMwareInstalled proc FRAME:exchdl uses rbx
39
40    mov eax, 0564D5868h
41    mov ebx, 08685D465h
42    mov ecx, 10
43    mov dx, 05658h
44    in eax, dx
45    cmp ebx, 564D5868h
46    setz al
47    movzx eax,al
48    ret
49
50VMwareInstalled endp
51
52main proc FRAME uses rbx rsi rdi
53
54local dwWritten:DWORD
55
56    invoke GetStdHandle,STD_OUTPUT_HANDLE
57    mov rbx,rax
58    invoke VMwareInstalled
59    .if ( eax )
60        lea rsi, CStr("running in VMware",13,10)
61    .else
62        lea rsi, CStr("NOT running in VMware",13,10)
63    .endif
64    invoke lstrlen, rsi
65    mov edi, eax
66    invoke WriteConsoleA, rbx, rsi, edi, addr dwWritten, 0
67    ret
68
69main endp
70
71mainCRTStartup proc FRAME
72    invoke main
73    invoke ExitProcess, eax
74mainCRTStartup endp
75
76    END mainCRTStartup
77