Querying the I/O Communication Port

Created the Monday 11 March 2019. Updated 3 years, 6 months ago.

VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.

Technique Identifier


Code Snippets

void CheckVM(void)
	unsigned int    a, b;

	__try {
		__asm {

			// save register values on the stack
			push eax
			push ebx
			push ecx
			push edx

			// perform fingerprint
			mov eax, 'VMXh' // VMware magic value (0x564D5868)
			mov ecx, 0Ah // special version cmd (0x0a)
			mov dx, 'VX' // special VMware I/O port (0x5658)

			in eax, dx // special I/O cmd

			mov a, ebx // data 
			mov b, ecx // data (eax gets also modified

			// restore register values from the stack
			pop edx
			pop ecx
			pop ebx
			pop eax

	if (a == 'VMXh') { // is the value equal to the VMware magic value?
		printf("Result  : VMware detected\nVersion : ");
		if (b == 1)
		else if (b == 2)
		else if (b == 3)
		else if (b == 4)
			printf("unknown version\n\n");
		printf("Result  : Not Detected\n\n");

Additional Resources

External Links

Subscribe to our Newsletter

The information entered into this form is mandatory. It will be subjected to computer processing. It is processed by computer in order to support our users and readers. The recipients of the data will be : contact@unprotect.it.

According to the Data Protection Act of January 6th, 1978, you have at any time, a right of access to and rectification of all of your personal data. If you wish to exercise this right and gain access to your personal data, please write to Thomas Roccia at contact@unprotect.it.

You may also oppose, for legitimate reasons, the processing of your personal data.