当前位置：首页 > news >正文

鹰盾视频加密器Windows播放器禁止虚拟机运行的技术实现解析

news 来源：原创 2025/6/14 15:44:21

一、虚拟机检测技术背景与挑战

在数字版权保护领域，虚拟机环境常被用于软件逆向与盗版行为。播放器需通过系统级检测手段识别虚拟化环境，主要挑战包括：

虚拟机特征隐蔽性：现代虚拟机技术不断模拟真实硬件环境
反检测对抗：虚拟机逃逸技术持续发展
兼容性平衡：避免对真实物理环境产生误判

二、硬件层虚拟机检测技术

2.1 CPU特征检测

通过获取CPU底层特征识别虚拟化痕迹，典型实现：

// CPU虚拟化特征检测核心代码
bool detect_virtual_cpu() {// 方法1: 检测CPUID指令中的虚拟化标志int info[4] = {0};__cpuid(info, 1);// 检查Hyper-V标志位(bit 31)if (info[3] & (1 << 31)) return true;// 方法2: 检测VMware特有CPU标识char vendor[13] = {0};__cpuid(info, 0);memcpy(vendor, info, 12);if (strcmp(vendor, "VMwareVMware") == 0) return true;// 方法3: 检测Intel VT-x/AMD-V虚拟化扩展int exts[4] = {0};__cpuid(exts, 0x80000001);if ((exts[3] & (1 << 5)) || (exts[3] & (1 << 21))) {// 存在虚拟化扩展，但需结合其他特征判断是否为虚拟机}return false;
}

2.2 主板与BIOS特征检测

分析主板制造商与BIOS信息中的虚拟化线索：

// 主板与BIOS虚拟化特征检测
bool check_motherboard_virtual() {// 通过WMI获取主板信息IWbemLocator* locator = NULL;IWbemServices* services = NULL;CoInitializeEx(NULL, COINIT_MULTITHREADED);CoCreateInstance(CLSID_WbemLocator, 0, CLSCTX_INPROC_SERVER,IID_IWbemLocator, (LPVOID*)&locator);locator->ConnectServer(L"ROOT\\CIMV2", NULL, NULL, 0, NULL, 0, 0, &services);VARIANT var;VariantInit(&var);IEnumWbemClassObject* enumerator = NULL;services->ExecQuery(L"WQL", L"SELECT * FROM Win32_BaseBoard",WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY,NULL, &enumerator);BOOL result = FALSE;while (enumerator) {IWbemClassObject* obj = NULL;ULONG uReturn = 0;if (enumerator->Next(WBEM_INFINITE, 1, &obj, &uReturn) == 0 && uReturn == 1) {obj->Get(L"Manufacturer", 0, &var, 0, 0);// 检查常见虚拟机主板制造商if (var.vt == VT_BSTR && (wcsstr(var.bstrVal, L"VMware") || wcsstr(var.bstrVal, L"VirtualBox") ||wcsstr(var.bstrVal, L"Hyper-V"))) {result = true;break;}VariantClear(&var);obj->Release();} else {break;}}// 清理资源...return result;
}

2.3 存储设备特征分析

检测虚拟磁盘与物理磁盘的差异特征：

// 存储设备虚拟化检测
bool detect_virtual_storage() {// 方法1: 检测SCSI控制器类型HDEVINFO hDevInfo = SetupDiGetClassDevs(&GUID_DEVCLASS_DISK, NULL, NULL,DIGCF_PRESENT | DIGCF_DEVICEINTERFACE);bool isVirtual = false;for (int i = 0; ; i++) {SP_DEVINFO_DATA devInfoData = {0};devInfoData.cbSize = sizeof(SP_DEVINFO_DATA);if (!SetupDiEnumDeviceInfo(hDevInfo, i, &devInfoData)) break;DWORD dataT;DWORD buffersize = 0;SetupDiGetDeviceRegistryProperty(hDevInfo, &devInfoData, SPDRP_HARDWAREID,&dataT, NULL, 0, &buffersize);wchar_t* buffer = new wchar_t[buffersize / sizeof(wchar_t)];if (SetupDiGetDeviceRegistryProperty(hDevInfo, &devInfoData, SPDRP_HARDWAREID,&dataT, (PBYTE)buffer, buffersize, &buffersize)) {// 检查虚拟存储设备特征if (wcsstr(buffer, L"VMware") || wcsstr(buffer, L"vbox")) {isVirtual = true;break;}}delete[] buffer;}SetupDiDestroyDeviceInfoList(hDevInfo);return isVirtual;
}

三、系统层虚拟机检测方案

3.1 进程与服务检测

监控虚拟化相关进程与服务：

// 虚拟化进程与服务检测
bool check_virtual_processes_services() {// 方法1: 检测虚拟机相关进程HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);if (hSnapshot == INVALID_HANDLE_VALUE) return false;PROCESSENTRY32 processEntry = {0};processEntry.dwSize = sizeof(PROCESSENTRY32);if (Process32First(hSnapshot, &processEntry)) {do {// 检查常见虚拟机进程if (_wcsicmp(processEntry.szExeFile, L"vmware.exe") == 0 ||_wcsicmp(processEntry.szExeFile, L"vboxsvc.exe") == 0 ||_wcsicmp(processEntry.szExeFile, L"hyperv.exe") == 0) {CloseHandle(hSnapshot);return true;}} while (Process32Next(hSnapshot, &processEntry));}CloseHandle(hSnapshot);// 方法2: 检测虚拟机相关服务SC_HANDLE hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_ENUMERATE_SERVICE);if (hSCManager) {DWORD needed, returned, services;EnumServicesStatus(hSCManager, SERVICE_WIN32, SERVICE_STATE_ALL,NULL, 0, &needed, &returned, &services, NULL);LPENUM_SERVICE_STATUS lpServices = (LPENUM_SERVICE_STATUS)HeapAlloc(GetProcessHeap(), 0, needed);if (lpServices) {if (EnumServicesStatus(hSCManager, SERVICE_WIN32, SERVICE_STATE_ALL,lpServices, needed, &needed, &returned, &services, NULL)) {for (DWORD i = 0; i < services; i++) {SC_HANDLE hService = OpenService(hSCManager, lpServices[i].lpServiceName, SERVICE_QUERY_CONFIG);if (hService) {DWORD cbBytesNeeded = 0;QUERY_SERVICE_CONFIG qsc = {0};if (QueryServiceConfig(hService, &qsc, 0, &cbBytesNeeded)) {if (qsc.lpBinaryPathName) {if (_wcsicmp(qsc.lpBinaryPathName, L"vmware.exe") == 0 ||_wcsicmp(qsc.lpBinaryPathName, L"vboxservice.exe") == 0) {HeapFree(GetProcessHeap(), 0, lpServices);CloseServiceHandle(hService);CloseServiceHandle(hSCManager);return true;}}}CloseServiceHandle(hService);}}}HeapFree(GetProcessHeap(), 0, lpServices);}CloseServiceHandle(hSCManager);}return false;
}

3.2 驱动与API检测

通过钩子技术监控虚拟化相关API调用：

// API钩子实现虚拟机检测
typedef NTSTATUS (NTAPI *PNTQUERYSYSTEMINFORMATION)(SYSTEM_INFORMATION_CLASS SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength,PULONG ReturnLength
);PNTQUERYSYSTEMINFORMATION g_NtQuerySystemInformation = NULL;NTSTATUS NTAPI HookedNtQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength,PULONG ReturnLength
) {if (SystemInformationClass == SystemProcessorInformation) {// 监控处理器信息查询，检测虚拟化特征NTSTATUS status = g_NtQuerySystemInformation(SystemInformationClass, SystemInformation,SystemInformationLength, ReturnLength);if (NT_SUCCESS(status)) {PSYSTEM_PROCESSOR_INFORMATION processorInfo = (PSYSTEM_PROCESSOR_INFORMATION)SystemInformation;// 分析处理器信息中的虚拟化特征if (CheckProcessorVirtualizationSignatures(processorInfo)) {// 检测到虚拟机环境return STATUS_ACCESS_DENIED; // 阻止继续查询}}return status;}return g_NtQuerySystemInformation(SystemInformationClass, SystemInformation,SystemInformationLength, ReturnLength);
}// 钩子安装函数
bool InstallAPIHook() {HMODULE hNtdll = GetModuleHandle(L"ntdll.dll");if (!hNtdll) return false;FARPROC fp = GetProcAddress(hNtdll, "NtQuerySystemInformation");if (!fp) return false;// 实现函数钩子（简化示意，实际需处理内存保护等）g_NtQuerySystemInformation = (PNTQUERYSYSTEMINFORMATION)fp;// 此处应包含内存写入保护绕过等底层操作// ...return true;
}

3.3 时间与性能特征分析

通过系统时间与性能指标识别虚拟机：

// 时间与性能特征虚拟机检测
bool detect_virtual_by_timing() {// 方法1: 时间戳计数器(TSC)检测DWORD64 tsc1 = __rdtsc();Sleep(1);DWORD64 tsc2 = __rdtsc();DWORD64 tsc_diff = tsc2 - tsc1;// 虚拟机中TSC通常表现异常if (tsc_diff < 1000000 || tsc_diff > 10000000) {return true;}// 方法2: 性能计数器检测PDH_HQUERY query = NULL;PDH_HCOUNTER counter = NULL;PdhOpenQuery(NULL, 0, &query);PdhAddCounter(query, L"\\Processor(_Total)\\% Processor Time", 0, &counter);PdhCollectQueryData(query);Sleep(100);PdhCollectQueryData(query);PDH_FMT_COUNTERVALUE value;PdhGetFormattedCounterValue(counter, PDH_FMT_DOUBLE, NULL, &value);// 虚拟机中处理器利用率可能呈现异常模式if (value.doubleValue > 90.0 || value.doubleValue < 10.0) {PdhCloseQuery(query);return true;}PdhCloseQuery(query);// 方法3: 系统时间一致性检测SYSTEMTIME st1, st2;GetSystemTime(&st1);Sleep(10);GetSystemTime(&st2);if (st2.milliseconds - st1.milliseconds < 5 || st2.milliseconds - st1.milliseconds > 15) {return true;}return false;
}

四、虚拟机检测综合决策机制

4.1 多层检测融合算法

采用加权评分机制综合各层检测结果：

// 虚拟机检测综合评分系统
class VirtualMachineDetector {
private:// 各检测方法权重struct DetectionMethod {float weight;bool (*detectFunc)();};DetectionMethod methods[] = {{0.25, detect_virtual_cpu},{0.20, check_motherboard_virtual},{0.15, detect_virtual_storage},{0.15, check_virtual_processes_services},{0.25, detect_virtual_by_timing}};const int methodCount = sizeof(methods) / sizeof(DetectionMethod);const float threshold = 0.6; // 检测阈值public:bool isVirtualMachine() {float score = 0.0;for (int i = 0; i < methodCount; i++) {if (methods[i].detectFunc()) {score += methods[i].weight;}}return score >= threshold;}
};

4.2 反逃逸对抗技术

针对虚拟机逃逸的防御措施：

// 反虚拟机逃逸检测
bool anti_vm_escape_detection() {// 方法1: 检测调试器与虚拟机监控器交互if (IsDebuggerPresent()) return true;// 方法2: 内存完整性校验PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)GetModuleHandle(NULL);PIMAGE_NT_HEADERS ntHeader = (PIMAGE_NT_HEADERS)((BYTE*)dosHeader + dosHeader->e_lfanew);DWORD checkSum = ntHeader->OptionalHeader.CheckSum;// 重新计算校验和DWORD calculatedSum = CalculateImageCheckSum(dosHeader);if (checkSum != calculatedSum) {// 镜像可能被虚拟机监控器修改return true;}// 方法3: 中断描述符表(IDT)检测PKDPC pKdpc = (PKDPC)0x8003f000; // 简化示例，实际需正确获取if (pKdpc->Type == 8) {// 检测到虚拟机特有的中断处理return true;}return false;
}

五、防御机制与对抗升级

5.1 动态检测策略更新

// 动态检测策略更新系统
void update_detection_strategies() {// 从服务器获取最新检测规则HTTPRequest request;request.setUrl(L"https://update.detector.com/rules");request.setMethod(HTTP_GET);HTTPResponse response = request.send();if (response.getStatusCode() == 200) {std::wstring rules = response.getContent();// 解析新规则std::vector<DetectionRule> newRules = parseRules(rules);// 更新检测方法VirtualMachineDetector detector;for (auto& rule : newRules) {detector.addDetectionMethod(rule.detectFunc, rule.weight);}// 保存新规则到本地saveRulesToLocal(newRules);}
}

5.2 硬件级防护方案

结合TPM与SGX的硬件级防护：

// 基于SGX的可信执行环境检测
bool check_sgx_environment() {// 检测SGX指令支持int cpuInfo[4] = {0};__cpuid(cpuInfo, 0x7);if ((cpuInfo[1] >> 26) & 0x1) {// SGX指令集支持// 尝试创建SGX enclavesgx_enclave_id_t enclaveId;sgx_create_enclave(L"enclave.signed.so", SGX_DEBUG_FLAG, NULL, NULL,&enclaveId, NULL);if (enclaveId != 0) {// 在可信执行环境中执行关键检测bool isVirtual = false;sgx_status_t status = sgx_ecall(enclaveId, 0, &isVirtual, NULL, NULL, NULL);if (status == SGX_SUCCESS) {return isVirtual;}}}return false;
}