VirtualPC 2004 (build 528) detection (?)

[gynvael () vexillium org]

Hello ;>

Recently I've been working on a disassembler. When implementing the 'REPE/REPNE' prefix, I've asked myself, how many 
prefixes 'REP' can there be ?
I tested it by creating an application with code like:
REP REP REP ... REP MOVSB
After a few tests (by me and ReWolf) we've found out that the CPU generates Illegal Instruction exception when there 
are at least 15*REP. The exception is not generated when there are "only" 14*REP or less. We have tested this on both 
Intel (P3, P4) CPUs and AMD (duron).
I have decided also to test this on virtual CPUs like VMWare, VirtualPC, and so on.

I found out that on VirtualPC 2004 (build 528) the exception is NOT generated (when there are 15 REP). 

This fact can be used to detect that an app is running on VirtualPC 2004 (build 528). I have not tested in on other 
versions.

Proof of concept code follows.
(sorry for my bad english ;<)

gynvael.coldwind//vx
Team Vexillium


--proof of concept--
; masm32 
; research & code by gynvael.coldwind//vx
; special thx to ReWolf (even more research ;>) & vul7ur3 (testing)
.386
.model flat, stdcall
option casemap :none   ; case sensitive

include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc

includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib

.code

start:
  ; some strings
  jmp @F
    szDlgTitle    db "VirtualPC 2004 RedPill (by gynvael.coldwind//vx)",0
    szMsgOFF      db "VirtualPC was NOT detected",0
    szMsgON       db "VirtualPC DETECTED!",0
  @@:

  ; SEH
  xor eax, eax
  push offset detected
  db 064h ; FS
  push dword ptr [eax]
  db 064h ; FS
  mov dword ptr [eax], esp

  ; teh RedPill
  mov esi, esp
  mov edi, esp
  mov ecx, 1

  ; This is REP REP REP REP ... REP movsb
  ; 15 * REP generate 'Invalid Instruction' exception on real CPU (tested on both Intel and AMD)
  ; Microsoft Virtual PC 2004 does NOT generate this exception.
  db 0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h;
  movsb    

  ; was found!
  invoke MessageBox, 0, ADDR szMsgON, ADDR szDlgTitle, MB_OK
  invoke ExitProcess, 0

detected:
  invoke MessageBox, 0, ADDR szMsgOFF, ADDR szDlgTitle, MB_OK
  invoke ExitProcess, 0
  
end start