ldt_trick invalid detection method same results on 2 VM and 2 bare-metal (win+linux)
Author: adeliktasCreated Mar 17, 2023Updated Jun 1, 2025
Labelsbug
UCHAR ldtr[5] = "\xef\xbe\xad\xde"; ULONG ldt = 0; #if defined (ENV32BIT) _asm sldt ldtr //asm("sldt %0" : "=g"(ldtr)); //for linux #endif ldt = *((unsigned long *)&ldtr[0]);
ldt_base == 0xdead0000 => means bare-metal
kvm/qemu VM and vmware VM and bare-metal-Linux and bare-metal-Windows10(21h2) all return the same results: vmdetect ldt_trick(32bit)=LDT base: 0xdead0000 //g++ -m32 vmdetect ldt_trick(64bit)=LDT base: 0xdeadbeef
The asm instruction will not be called for 64bit. Changing/Allowing that, returns the same result, as when it's run compiled for 32bit. Judging from the results, the detection method is invalid.
Source: ayoubfaouzi/al-khaser