
SMSW
Stores the machine status word into the destination operand.
Code Snippets
#include <iostream>
using namespace std;
void smsw()
{
unsigned int reax = 0;
__asm
{
mov eax, 0xCCCCCCCC
smsw eax
mov DWORD PTR[reax], eax
}
if ((((reax >> 24) & 0xFF) == 0xcc) && (((reax >> 16) & 0xFF) == 0xcc))
{
cout << "VM detected!" << endl;
}
}
int main()
{
smsw();
cout << "Hello world!" << endl;
return 0;
}
Detection Rules
rule:
meta:
name: execute anti-VM instructions
namespace: anti-analysis/anti-vm/vm-detection
author: moritz.raabe@fireeye.com
scope: basic block
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
- Anti-Behavioral Analysis::Virtual Machine Detection::Instruction Testing [B0009.029]
examples:
- Practical Malware Analysis Lab 17-03.exe_:0x401A80
features:
- or:
- mnemonic: sdit
- mnemonic: sgdt
- mnemonic: sldt
- mnemonic: smsw
- mnemonic: str
- mnemonic: in
- mnemonic: cpuid
- mnemonic: vpcext