VMware 加固的 VM 检测缓解加载程序 (防止反 VM)
VMwareHardenedLoader-ng is a Windows kernel driver for VMware guest research environments. It filters selected VMware-related firmware strings and blocks selected VMware PnP registry enumeration.
The driver resolves undocumented kernel globals from signed System Informer KPH dynamic data instead of PDBs, signature scanning, or registry-provided RVAs.
Read the build guide, then build from a Visual Studio 2022 Developer Command Prompt with the WDK installed:
msbuild VmLoader.sln /m /t:Rebuild /p:Configuration=Release /p:Platform=x64
The build downloads and validates the KPH manifest, generates and signs v20 dynamic data, and publishes the runtime artifacts needed by the install scripts. See runtime loading before configuring external dynamic data or loading the driver.
The maintained configurations are Release|x64, Debug|x64, Release|ARM64, and Debug|ARM64. ARM64 runtime behavior still depends on undocumented kernel layouts and must be validated on the target Windows build.
Released under the MIT License. See LICENSE.
System Informer is included as a submodule for KPH dynamic data and the CustomBuildTool and CustomSignTool utilities.
kphtools provides the symbol source and RVAs for nt!ExpFirmwareTableResource and nt!ExpFirmwareTableProviderListHead.
暂无开放 Issues，或尚未同步最近议题。