1 2;--- Win64 console application with exception handler. 3;--- this variant can be assembled by both JWasm and ML64. 4;--- assemble: jwasm -c Win64_5m.asm 5;--- ml64 -c Win64_5m.asm 6;--- link: link /subsystem:console /Libpath:\WinInc\Lib64 Win64_5m.obj 7 8 option casemap:none 9 10 includelib <msvcrt.lib> 11 12exit proto 13printf proto 14 15;--- CStr(): macro function to simplify defining a string 16 17CStr macro Text:VARARG 18local szText 19 .const 20szText db Text,0 21 .code 22 exitm <offset szText> 23endm 24 25EXCEPTION_MAXIMUM_PARAMETERS EQU 15 26DWORD64 typedef QWORD 27 28EXCEPTION_RECORD64 struct 29ExceptionCode DWORD ? 30ExceptionFlags DWORD ? 31ExceptionRecord DWORD64 ? 32ExceptionAddress DWORD64 ? 33NumberParameters DWORD ? 34__unusedAlignment DWORD ? 35ExceptionInformation DWORD64 EXCEPTION_MAXIMUM_PARAMETERS dup (?) 36EXCEPTION_RECORD64 ends 37 38M128 struct 39Low_ QWORD ? 40High_ QWORD ? 41M128 ends 42 43LEGACY_SAVE_AREA struct 44ControlWord WORD ? 45Reserved0 WORD ? 46StatusWord WORD ? 47Reserved1 WORD ? 48TagWord WORD ? 49Reserved2 WORD ? 50ErrorOffset DWORD ? 51ErrorSelector WORD ? 52ErrorOpcode WORD ? 53DataOffset DWORD ? 54DataSelector WORD ? 55Reserved3 WORD ? 56FloatRegisters BYTE 8*10 dup (?) 57LEGACY_SAVE_AREA ends 58 59CONTEXT struct 60P1Home DWORD64 ? 61P2Home DWORD64 ? 62P3Home DWORD64 ? 63P4Home DWORD64 ? 64P5Home DWORD64 ? 65P6Home DWORD64 ? 66ContextFlags DWORD ? 67MxCsr DWORD ? 68SegCs WORD ? 69SegDs WORD ? 70SegEs WORD ? 71SegFs WORD ? 72SegGs WORD ? 73SegSs WORD ? 74EFlags DWORD ? 75Dr0_ DWORD64 ? 76Dr1_ DWORD64 ? 77Dr2_ DWORD64 ? 78Dr3_ DWORD64 ? 79Dr6_ DWORD64 ? 80Dr7_ DWORD64 ? 81Rax_ DWORD64 ? 82Rcx_ DWORD64 ? 83Rdx_ DWORD64 ? 84Rbx_ DWORD64 ? 85Rsp_ DWORD64 ? 86Rbp_ DWORD64 ? 87Rsi_ DWORD64 ? 88Rdi_ DWORD64 ? 89R8_ DWORD64 ? 90R9_ DWORD64 ? 91R10_ DWORD64 ? 92R11_ DWORD64 ? 93R12_ DWORD64 ? 94R13_ DWORD64 ? 95R14_ DWORD64 ? 96R15_ DWORD64 ? 97Rip_ DWORD64 ? 98Xmm0_ M128 <> 99Xmm1_ M128 <> 100Xmm2_ M128 <> 101Xmm3_ M128 <> 102Xmm4_ M128 <> 103Xmm5_ M128 <> 104Xmm6_ M128 <> 105Xmm7_ M128 <> 106Xmm8_ M128 <> 107Xmm9_ M128 <> 108Xmm10_ M128 <> 109Xmm11_ M128 <> 110Xmm12_ M128 <> 111Xmm13_ M128 <> 112Xmm14_ M128 <> 113Xmm15_ M128 <> 114FltSave LEGACY_SAVE_AREA <> 115Fill DWORD ? 116DebugControl DWORD64 ? 117LastBranchToRip DWORD64 ? 118LastBranchFromRip DWORD64 ? 119LastExceptionToRip DWORD64 ? 120LastExceptionFromRip DWORD64 ? 121Fill1 DWORD64 ? 122CONTEXT ends 123 124 .CODE 125 126exchdl proc pRecord:ptr, ulframe:qword, pContext:ptr, x4:ptr 127 128 sub rsp,28h 129 add qword ptr [r8].CONTEXT.Rip_, 1 ;1=size of "in EAX, DX" opcode 130 mov edx, [rcx].EXCEPTION_RECORD64.ExceptionCode 131 mov rcx, CStr("exception code: %X",10) 132 call printf 133 mov eax, 0 ;0=continue execution? 134 add rsp,28h 135 ret 136 137exchdl endp 138 139VMwareInstalled proc FRAME:exchdl 140 141 push rbx 142 .pushreg rbx 143 .endprolog 144 145 mov eax, 0564D5868h 146 mov ebx, 08685D465h 147 mov ecx, 10 148 mov dx, 05658h 149 in eax, dx 150 cmp ebx, 564D5868h 151 setz al 152 movzx eax,al 153 154 add rsp,0 155 pop rbx 156 ret 157 158VMwareInstalled endp 159 160main proc FRAME 161 162 sub rsp,28h 163 .allocstack 28h 164 .endprolog 165 166 mov rcx, CStr("Testing VMware presence",10) 167 call printf 168 169 call VMwareInstalled 170 171 lea rcx, CStr("running in VMware",10) 172 and eax, eax 173 jnz @F 174 lea rcx, CStr("NOT running in VMware",10) 175@@: 176 call printf 177 178 add rsp,28h 179 ret 180 181main endp 182 183mainCRTStartup proc 184 sub rsp,28h 185 call main 186 mov ecx,eax 187 call exit 188mainCRTStartup endp 189 190 END 191