/*
 * VMware fingerprinting counter measures
 * by Kostya KORTCHINSKY <kostya (dot) kortchinsky (at) renater (dot) fr>
 *
 * Many thanks to the people of the French HoneyNet Project who helped me !
 *
 * gcc -Wall -lz -o vmpatch vmpatch.c # zlib needed !
 *
 * -- BACKUP YOUR VMWARE-VMX BINARY BEFORE USING THIS ! --
 *
 * ./vmpatch
 *
 * This program is based on some reverse-engineering work carried out on
 * VMware Workstation binaries for Linux, and has for only aim to improve
 * the "furtivity" of VMware.
 *
 * Please, understand that there is a chance to screw up guest OS, and
 * therefore this program should only be used by power users (and preferably
 * for text mode oriented guest OS). I stress that there is no need to use
 * this outside the context of HoneyPots.
 *
 * Since this program patches mostly constants, it shouldn't raise any
 * security issue, and only addresses some _very_ obvious things :
 * - strings for IDE devices (HD & CDROM)
 * - strings for SCSI devices (HD & CDROM)
 * - video adaptor vendor & device IDs
 * - I/O backdoor
 *
 * I am aware that there are a lot of things remaining, and a more advanced
 * version is being developped and used with deeper changes such as whole
 * BIOSes replacement.
 *
 * I would be glad to get some feedback about changes to bring, fingerprinting
 * methods to counter, ... And yes, verbosity is minimal.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <linux/elf.h>
#include <zlib.h>

#define VERSION 0.1.1

typedef struct
{
	unsigned long int vendor;
	unsigned long int model;
	unsigned long int revision;
} offsetsScsiHD;

typedef struct
{
	unsigned long int model;
	unsigned long int nops[4];
} offsetsScsiCDROM;

typedef struct
{
	char *vendor;
	char *model;
	char *revision;
} scsiDevice;

typedef struct
{
	char *name;
	unsigned short int vendor;
	unsigned short int device;
} videoAdapter;

typedef struct
{
	char *name;
	offsetsScsiHD scsiHD;
	offsetsScsiCDROM scsiCDROM;
	unsigned long int videoAdapter[2];
	unsigned long int magicNumber;
	unsigned long int ideHD;
	unsigned long int ideCDROM;
} vmwareVersion;

scsiDevice scsiHDs[] =
{
	{ "IBM", "DDRS-34560", "S97B" },
	{ "QUANTUM", "FIREBALL ST4.3S", "0F0C" },
	{ "SEAGATE", "ST32155N", "0532" }
};

scsiDevice scsiCDROMs[] =
{
	{ "PLEXTOR", "CD-ROM PX-40TS", "1.02" },
	{ "YAMAHA", "CRW6416S", "1.0c" }
};

videoAdapter videoAdapters[] =
{
	{ "nVidia Corporation NV10 [GeForce 256 SDR]", 0x10de, 0x0100 },
	{ "ATI Technologies Inc 3D Rage Pro", 0x1002, 0x4747 }
};

char *ideHDs[] =
{
	"Maxtor 88400D8",
	"IBM-DTNA-22110",
	"FUJITSU MHT2030AT"
};

char *ideCDROMs[] =
{
	"SONY CD-RW CRX140E",
	"_NEC CD-2800D",
	"PLEXTOR CD-R PX-W8432T"
};

vmwareVersion vmwareVersions[] =
{
	{
		"VMware Workstation 4.0.5 build-6030",
		{ 0x5dba7, 0x5dbc5, 0x5dbf3 },
		{ 0x5f188, { 0x5eb13, 0x5eb83, 0x5ec13, 0x5ee74 } },
		{ 0x7f683, 0x7f5a9 },
		0x10aff,
		0x9240,
		0x91e0
	}
};

int version = -1;
unsigned char *vmxBinary = NULL, *vmmBinary = NULL;
Elf32_Ehdr *vmxEhdr = NULL, *vmmEhdr = NULL;
Elf32_Shdr *vmxShdr = NULL, *vmmShdr = NULL;
char *vmxShstrtab = NULL, *vmmShstrtab = NULL;
int indexVbios = -1, indexVmm = -1, indexZtext = -1, indexZrodata = -1;
unsigned char *sectionVbios = NULL, *sectionZtext = NULL, *sectionZrodata = NULL, *sectionVmm = NULL;

int getChoice(void)
{
	int result;
	char *s, input[16];

	fgets(input, sizeof(input), stdin);
	s = strchr(input, '\n');
	if (s)
		*s = '\0';
	result = atoi(input) - 1;
	if (result < 0)
		result = 0;

	return result;
}

char vendor[8], model[16], revision[4];

void initScsiDevice(scsiDevice *device)
{
	int size;

	memset(&vendor[0], ' ', sizeof(vendor));
	size = strlen(device->vendor);
	if (size > sizeof(vendor))
		size = sizeof(vendor);
	memcpy(&vendor[0], device->vendor, size);
	memset(&model[0], ' ', sizeof(model));
	size = strlen(device->model);
	if (size > sizeof(model))
		size = sizeof(model);
	memcpy(&model[0], device->model, size);
	memset(&revision[0], ' ', sizeof(revision));
	size = strlen(device->revision);
	if (size > sizeof(revision))
		size = sizeof(revision);
	memcpy(&revision[0], device->revision, size); 
}

void patchScsiDevices(void)
{
	int i, number;
	unsigned long int offset;

	fprintf(stdout, "Choose a new virtual SCSI hard drive from the following list:\n\n");
	for (i = 0; i < sizeof(scsiHDs) / sizeof(scsiDevice); i++)
		fprintf(stdout, "%3d.  %s %s\n", i + 1, scsiHDs[i].vendor, scsiHDs[i].model);
	fprintf(stdout, "\nEnter the number: ");
	number = getChoice();

	initScsiDevice(&scsiHDs[number]);

	offset = vmwareVersions[version].scsiHD.vendor;
	memcpy(&vmxBinary[offset + 3], &vendor[0], 4);
	memcpy(&vmxBinary[offset + 10], &vendor[4], 4);
	offset = vmwareVersions[version].scsiHD.model;
	memcpy(&vmxBinary[offset + 3], &model[0], 4);
	memcpy(&vmxBinary[offset + 10], &model[4], 4);
	memcpy(&vmxBinary[offset + 17], &model[8], 4);
	memcpy(&vmxBinary[offset + 24], &model[12], 4);
	offset = vmwareVersions[version].scsiHD.revision;
	memcpy(&vmxBinary[offset + 3], &revision[0], 4);

	fprintf(stdout, "Choose a new virtual SCSI CDROM drive from the following list:\n\n");
	for (i = 0; i < sizeof(scsiCDROMs) / sizeof(scsiDevice); i++)
		fprintf(stdout, "%3d.  %s %s\n", i + 1, scsiCDROMs[i].vendor, scsiCDROMs[i].model);
	fprintf(stdout, "\nEnter the number: ");
	number = getChoice();

	initScsiDevice(&scsiCDROMs[number]);

	offset = vmwareVersions[version].scsiCDROM.model;
	memcpy(&vmxBinary[offset + 3], &model[0], 4);
	memcpy(&vmxBinary[offset + 10], &model[4], 4);
	memcpy(&vmxBinary[offset + 17], &model[8], 4);
	vmxBinary[offset + 21] = '\xe9';
	*(unsigned long int *)(&vmxBinary[offset + 22]) = vmwareVersions[version].scsiCDROM.nops[0] - (offset + 26);
	offset = vmwareVersions[version].scsiCDROM.nops[0];
	vmxBinary[offset] = '\xc7';
	vmxBinary[offset + 1] = '\x47';
	vmxBinary[offset + 2] = '\x1c';
	memcpy(&vmxBinary[offset + 3], &model[12], 4);
	vmxBinary[offset + 7] = '\xe9';
	*(unsigned long int *)(&vmxBinary[offset + 8]) = vmwareVersions[version].scsiCDROM.nops[1] - (offset + 12);
	offset = vmwareVersions[version].scsiCDROM.nops[1];
	vmxBinary[offset] = '\xc7';
	vmxBinary[offset + 1] = '\x47';
	vmxBinary[offset + 2] = '\x08';
	memcpy(&vmxBinary[offset + 3], &vendor[0], 4);
	vmxBinary[offset + 7] = '\xe9';
	*(unsigned long int *)(&vmxBinary[offset + 8]) = vmwareVersions[version].scsiCDROM.nops[2] - (offset + 12);
	offset = vmwareVersions[version].scsiCDROM.nops[2];
	vmxBinary[offset] = '\xc7';
	vmxBinary[offset + 1] = '\x47';
	vmxBinary[offset + 2] = '\x0c';
	memcpy(&vmxBinary[offset + 3], &vendor[4], 4);
	vmxBinary[offset + 7] = '\xe9';
	*(unsigned long int *)(&vmxBinary[offset + 8]) = vmwareVersions[version].scsiCDROM.nops[3] - (offset + 12);
	offset = vmwareVersions[version].scsiCDROM.nops[3];
	vmxBinary[offset] = '\xc7';
	vmxBinary[offset + 1] = '\x47';
	vmxBinary[offset + 2] = '\x20';
	memcpy(&vmxBinary[offset + 3], &revision[0], 4);
	vmxBinary[offset + 7] = '\xe9';
	*(unsigned long int *)(&vmxBinary[offset + 8]) = vmwareVersions[version].scsiCDROM.model + 28 - (offset + 12);
}

int patchVideoAdapter(void)
{
	int i, number, error = EXIT_FAILURE;
	unsigned long int length, newLength;
	unsigned char checksum, *data = NULL;
	unsigned short int offset;

	fprintf(stdout, "Choose a new virtual video adapter from the following list:\n\n");
	for (i = 0; i < sizeof(videoAdapters) / sizeof(videoAdapter); i++)
		fprintf(stdout, "%3d.  %s\n", i + 1, videoAdapters[i].name);
	fprintf(stdout, "\nEnter the number: ");
	number = getChoice();

	length = 48 * 1024;
	if ((data = malloc(length)) == NULL)
		return error;
	if (uncompress(data, &length, &vmxBinary[vmxShdr[indexVbios].sh_offset], vmxShdr[indexVbios].sh_size) != Z_OK)
		goto end;

	if (data[0] != 0x55 || data[1] != 0xaa)
		goto end;
	offset = *(unsigned short int *)(&data[24]);
	if (memcmp(&data[offset], "PCIR", 4) != 0)
		goto end;
	*(unsigned short int *)(&data[offset + 4]) = videoAdapters[number].vendor;
	*(unsigned short int *)(&data[offset + 6]) = videoAdapters[number].device;
	for (i = 0, checksum = 0; i < length; i++)
		if (i != 6)
			checksum += data[i];
	data[6] = (unsigned char)(-checksum);

	newLength = 16 * 1024;
	if ((sectionVbios = malloc(newLength)) == NULL)
		goto end;
	if (compress2(sectionVbios, &newLength, data, length, Z_BEST_COMPRESSION) != Z_OK)
		goto end;
	vmxShdr[indexVbios].sh_size = newLength;
	vmxShdr[indexVbios].sh_entsize = length;

	*(unsigned short int *)(&vmxBinary[vmwareVersions[version].videoAdapter[0]]) = videoAdapters[number].vendor;
	*(unsigned short int *)(&vmxBinary[vmwareVersions[version].videoAdapter[1]]) = videoAdapters[number].device;

	error = EXIT_SUCCESS;
end:
	free(data);
	return error;
}

int patchIoBackdoor(void)
{
	int error = EXIT_FAILURE;
	unsigned long int length, newLength;
	unsigned char *data = NULL;

	length = 384 * 1024;
	if ((data = malloc(length)) == NULL)
		return error;
	if (uncompress(data, &length, &vmmBinary[vmmShdr[indexZtext].sh_offset], vmmShdr[indexZtext].sh_size) != Z_OK)
		goto end;

	*(unsigned long int *)(&data[vmwareVersions[version].magicNumber]) = 0x48506f74;

	newLength = 192 * 1024;
	if ((sectionZtext = malloc(newLength)) == NULL)
		goto end;
	if (compress2(sectionZtext, &newLength, data, length, Z_BEST_COMPRESSION) != Z_OK)
		goto end;
	vmmShdr[indexZtext].sh_size = newLength;
	vmmShdr[indexZtext].sh_entsize = length;

	error = EXIT_SUCCESS;
end:
	free(data);
	return error;
}

int patchIdeDevices(void)
{
	int i, number, size, error = EXIT_FAILURE;
	unsigned long int length, newLength;
	unsigned char *data = NULL;

	length = 48 * 1024;
	if ((data = malloc(length)) == NULL)
		return error;
	if (uncompress(data, &length, &vmmBinary[vmmShdr[indexZrodata].sh_offset], vmmShdr[indexZrodata].sh_size) != Z_OK)
		goto end;

	fprintf(stdout, "Choose a new virtual IDE hard drive from the following list:\n\n");
	for (i = 0; i < sizeof(ideHDs) / sizeof(char *); i++)
		fprintf(stdout, "%3d.  %s\n", i + 1, ideHDs[i]);
	fprintf(stdout, "\nEnter the number: ");
	number = getChoice();

	memset(&data[vmwareVersions[version].ideHD], ' ', 31);
	size = strlen(ideHDs[number]);
	if (size > 31)
		size = 31;
	memcpy(&data[vmwareVersions[version].ideHD], ideHDs[number], size);

	fprintf(stdout, "Choose a new virtual IDE CDROM from the following list:\n\n");
	for (i = 0; i < sizeof(ideCDROMs) / sizeof(char *); i++)
		fprintf(stdout, "%3d.  %s\n", i + 1, ideCDROMs[i]);
	fprintf(stdout, "\nEnter the number: ");
	number = getChoice();

	memset(&data[vmwareVersions[version].ideCDROM], ' ', 31);
	size = strlen(ideCDROMs[number]);
	if (size > 31)
		size = 31;
	memcpy(&data[vmwareVersions[version].ideCDROM], ideCDROMs[number], size);

	newLength = 16 * 1024;
	if ((sectionZrodata = malloc(newLength)) == NULL)
		goto end;
	if (compress2(sectionZrodata, &newLength, data, length, Z_BEST_COMPRESSION) != Z_OK)
		goto end;
	vmmShdr[indexZrodata].sh_size = newLength;
	vmmShdr[indexZrodata].sh_entsize = length;

	error = EXIT_SUCCESS;
end:
	free(data);
	return error;
}

int main(int argc, char *argv[])
{
	FILE *file, *process;
	char buffer[64];
	int i, error = EXIT_FAILURE;
	unsigned long int fileSize, size;
	unsigned char *newBinary = NULL;

	if ((process = popen("/usr/bin/vmware -v", "r")) == NULL)
		return error;
	if (fgets(buffer, sizeof(buffer), process) == NULL)
		return error;
	if (pclose(process) == -1)
		return error;
	for (i = 0; i < sizeof(vmwareVersions) / sizeof(vmwareVersion); i++)
		if (strncmp(buffer, vmwareVersions[i].name, strlen(vmwareVersions[i].name)) == 0)
			version = i;
	if (version == -1)
		return error;

	if ((file = fopen("/usr/lib/vmware/bin/vmware-vmx", "rb")) == NULL)
		return error;
	fseek(file, 0, SEEK_END);
	fileSize = ftell(file);
	if ((vmxBinary = malloc(fileSize)) == NULL)
		goto end;
	fseek(file, 0, SEEK_SET);
	if (fread(vmxBinary, 1, fileSize, file) != fileSize)
		goto end;
	vmxEhdr = (Elf32_Ehdr *)(&vmxBinary[0]);
	vmxShdr = (Elf32_Shdr *)(&vmxBinary[vmxEhdr->e_shoff]);
	vmxShstrtab = &vmxBinary[vmxShdr[vmxEhdr->e_shstrndx].sh_offset];
	for (i = 1; i < vmxEhdr->e_shnum; i++)
	{
		if (!strcmp(&vmxShstrtab[vmxShdr[i].sh_name], ".vbios"))
			indexVbios = i;
		else if (!strcmp(&vmxShstrtab[vmxShdr[i].sh_name], ".vmm"))
			indexVmm = i;
		if (indexVbios != -1 && indexVmm != -1)
			break;
	}
	if (i == vmxEhdr->e_shnum)
		goto end;

	patchScsiDevices();
	if (patchVideoAdapter() != EXIT_SUCCESS)
		goto end;

	vmmBinary = &vmxBinary[vmxShdr[indexVmm].sh_offset];
	vmmEhdr = (Elf32_Ehdr *)(&vmmBinary[0]);
	vmmShdr = (Elf32_Shdr *)(&vmmBinary[vmmEhdr->e_shoff]);
	vmmShstrtab = &vmmBinary[vmmShdr[vmmEhdr->e_shstrndx].sh_offset];
	for (i = 0; i < vmmEhdr->e_shnum; i++)
	{
		if(!strcmp(&vmmShstrtab[vmmShdr[i].sh_name], ".ztext"))
			indexZtext = i;
		else if (!strcmp(&vmmShstrtab[vmmShdr[i].sh_name], ".zrodata"))
			indexZrodata = i;
		if (indexZtext != -1 && indexZrodata != -1)
			break;
	}
	if (i == vmmEhdr->e_shnum)
		goto end;

	if (patchIoBackdoor() != EXIT_SUCCESS)
		goto end;
	if (patchIdeDevices() != EXIT_SUCCESS)
		goto end;

	if ((sectionVmm = malloc(256 * 1024)) == NULL)
		goto end;
	memset(sectionVmm, '\0', 256 * 1024);
	size = sizeof(Elf32_Ehdr);
	for (i = 0; i < vmmEhdr->e_shnum; i++)
	{
		if(strcmp(&vmmShstrtab[vmmShdr[i].sh_name], ".bss"))
		{
			if (i == indexZtext && sectionZtext)
				memcpy(&sectionVmm[size], sectionZtext, vmmShdr[i].sh_size);
			else if (i == indexZrodata && sectionZrodata)
				memcpy(&sectionVmm[size], sectionZrodata, vmmShdr[i].sh_size);
			else
				memcpy(&sectionVmm[size], &vmmBinary[vmmShdr[i].sh_offset], vmmShdr[i].sh_size);
			vmmShdr[i].sh_offset = size;
			size += vmmShdr[i].sh_size;
		}
	}
	vmmEhdr->e_shoff = size;
	memcpy(&sectionVmm[0], vmmEhdr, sizeof(Elf32_Ehdr));
	memcpy(&sectionVmm[size], vmmShdr, vmmEhdr->e_shentsize * vmmEhdr->e_shnum);
	size += vmmEhdr->e_shentsize * vmmEhdr->e_shnum;
	vmxShdr[indexVmm].sh_size = size;

	if ((file = freopen("/usr/lib/vmware/bin/vmware-vmx", "wb", file)) == NULL)
		goto end;
	if ((newBinary = malloc(2560 * 1024)) == NULL)
		goto end;
	memset(newBinary, '\0', 2560 * 1024);
	i = (indexVbios < indexVmm) ? indexVbios : indexVmm;
	size = vmxShdr[i].sh_offset;
	memcpy(&newBinary[0], &vmxBinary[0], size);
	for (; i < vmxEhdr->e_shnum; i++)
	{
		if (i == indexVbios && sectionVbios)
			memcpy(&newBinary[size], sectionVbios, vmxShdr[i].sh_size);
		else if (i == indexVmm && sectionVmm)
			memcpy(&newBinary[size], sectionVmm, vmxShdr[i].sh_size);
		else
			memcpy(&newBinary[size], &vmxBinary[vmxShdr[i].sh_offset], vmxShdr[i].sh_size);
		vmxShdr[i].sh_offset = size;
		size += (((vmxShdr[i].sh_size - 1) / vmxShdr[i].sh_addralign) + 1) * vmxShdr[i].sh_addralign;
	}
	vmxEhdr->e_shoff = size;
	memcpy(&newBinary[0], vmxEhdr, sizeof(Elf32_Ehdr));
	memcpy(&newBinary[size], vmxShdr, vmxEhdr->e_shentsize * vmxEhdr->e_shnum);
	size += vmxEhdr->e_shentsize * vmxEhdr->e_shnum;

	fseek(file, 0, SEEK_SET);
	if (fwrite(newBinary, 1, size, file) != size)
		goto end;

	error = EXIT_SUCCESS;
end:
	if (newBinary)
		free(newBinary);
	if (sectionVmm)
		free(sectionVmm);
	if (sectionZrodata)
		free(sectionZrodata);
	if (sectionZtext)
		free(sectionZtext);
	if (sectionVbios)
		free(sectionVbios);
	if (vmxBinary)
		free(vmxBinary);
	fclose(file);

	return error;
}