Vmware Hardened VM detection mitigation loader (anti anti-vm)
Vmware Hardened VM detection mitigation loader (anti anti-vm)
VMwareHardenedLoader-ng is a Windows kernel driver for VMware guest research environments. It filters selected VMware-related firmware strings and blocks selected VMware PnP registry enumeration.
The driver resolves undocumented kernel globals from signed System Informer KPH dynamic data instead of PDBs, signature scanning, or registry-provided RVAs.
Read the build guide, then build from a Visual Studio 2022 Developer Command Prompt with the WDK installed:
msbuild VmLoader.sln /m /t:Rebuild /p:Configuration=Release /p:Platform=x64The build downloads and validates the KPH manifest, generates and signs v20 dynamic data, and publishes the runtime artifacts needed by the install scripts. See runtime loading before configuring external dynamic data or loading the driver.
The maintained configurations are Release|x64, Debug|x64, Release|ARM64, and Debug|ARM64. ARM64 runtime behavior still depends on undocumented kernel layouts and must be validated on the target Windows build.
Released under the MIT License. See LICENSE.
System Informer is included as a submodule for KPH dynamic data and the CustomBuildTool and CustomSignTool utilities.
kphtools provides the symbol source and RVAs for nt!ExpFirmwareTableResource and nt!ExpFirmwareTableProviderListHead.
No open issues yet, or sync has not completed.