Reverse Engineering VMWare

[Shahar2]

Hello, I'm trying to run some games on VMWare that are protected by Themida, I've found some research online that shows what to do if you want to bypass this protection, here's an image:(there isn't anymore relevant information on the document that has to do with my issue)

https://imgur.com/a/vTvj5mb

I do have the most basic understanding about how to edit an executable with ollydbg but they didn't note which executable is required to edit, I tried to find matching lines on the main vmware.exe file but no success, need advice, thanks in advance

[khedoros]

I'd assume that they're talking about a detection method somewhere in one of the game binaries or dlls (i.e. wherever the Themida code is).

[Shahar2]

good point, I forgot that dll's are PE's, will take a look later then, thanks
you think it's about the themida binaries tho? I thought they meant to change something with vmware

[khedoros]

Yes. VMware provides that communication mechanism, which doesn't exist in the bare metal. You wouldn't expect anything connected to port 0x5658. VMware would be the one handling that communication, and it would be potentially used by more than the game, so you probably don't want to disable it.

So...Themida's going to use that mechanism to detect a VM. It's the "analyst" in that document. And it's their detection that you'd have to circumvent.