在 x64 上, get_gdt_base 会引起未定义的行为

ULONG get_gdt_base() { // Get the base of Global Descriptor Table (GDT)

UCHAR gdtr[6];
ULONG gdt = 0;

// sgdt instruction stores the contents of the GDT Register
// (the GDTR which points to the GDT) in a processor register.

#if defined(ENV32BIT) _asm sgdt gdtr #endif gdt = *((unsigned long *)&gdtr[2]); // printf("GDT base: 0x%x\n", gdt);

return gdt;

} gdtr is an uninitialized local array, and ONLY on 32bit is it filled with the sgdt opcode. On x64 it just stores the uninitialized value from gdtr into gdt. Then the check the GDT trick looks to see if the upper byte is FF: BOOL gdt_trick() { UINT gdt_base = get_gdt_base();

if ((gdt_base >> 24) == 0xff)
	return TRUE; // VMWare detected

else
	return FALSE;

} I received a random failure of this test, that's what lead me to investigate. The failure was on VirtualBox, never failed ever before just randomly once, and this test clearly looks for "vmware".