How to compile VMAware for Windows 7

[RazviOverflow]

I've been testing VMAware in several Windows 7 environments and in all of them the execution crashes with the following error:

This happens on both 32 and 64 bits Win 7 and for vmaware x64 and x86.

Examples:

• https://hybrid-analysis.com/sample/ebfc63974caff4b578923a9639d8eb161da4af0df163155022be05846a2ce48e/689cc6688d1f08c0ba0c8ca2 (Win 7 x64)
• https://hybrid-analysis.com/sample/ebfc63974caff4b578923a9639d8eb161da4af0df163155022be05846a2ce48e/689cc657bc602b99f40a73b6 (Win 7 x64)
• https://app.any.run/tasks/cda17c67-cf26-4766-ab45-20801535a728 (Win 7 x86)
• https://app.threat.zone/submission/afb9a84f-35fd-47d5-824d-1b1a5154529a/dynamic-scan-report/general (Win 7 x64)
• https://app.any.run/tasks/87d0a91e-a4be-480a-9537-28c4c414957f
• https://app.threat.zone/submission/5612bced-ba9c-4acb-b104-bdfc20b87ba5/dynamic-scan-report/general
• https://hybrid-analysis.com/sample/a512fab80fed58d3962ce0d1de0f1093f39f174dee2db18d021146d689b37014/689cce6eb94d35a7950259d9

¿Is there any specific compiler option to support Windows 7?

[NotRequiem]

Yes, there is a specific compiler flag to build VMAware for old operating systems like Windows 7. You just need to tell us the target platform that you want to compile the library for:

Right now your build is failing because your compiler is trying to locate IsWow64Process2, which is not present in the modules of your OS.

We're aware of that and that's why we guarded the code with preprocessor directives, specifically with a _WIN32_WINNT >= _WIN32_WINNT_WIN10 condition:

#if (WINDOWS && _WIN32_WINNT >= _WIN32_WINNT_WIN10)
            USHORT procMachine = 0, nativeMachine = 0;
            if (IsWow64Process2(GetCurrentProcess(), &procMachine, &nativeMachine)) {
                if (nativeMachine == IMAGE_FILE_MACHINE_ARM64 &&
                    (procMachine == IMAGE_FILE_MACHINE_AMD64 ||
                        procMachine == IMAGE_FILE_MACHINE_I386))
                {
                    return true;
                }
            }           
#endif

Just redefine _WIN32_WINNT to be _WIN32_WINNT_WIN7 (0x0601), which is the version of Windows 7

[RazviOverflow]

Thanks for the response.

I confirm that including #define _WIN32_WINNT 0x0601 in vmaware.hpp results in a PE compatible with Win 7 after compilation.

Although the console colors are broken, the program works and results can be read.

[NotRequiem]

We're aware that some terminals like those in old operating systems don't support ansii escape colors, to fix it and see a more cleaner result you can run the CLI with the --no-ansi argument

Don't hesitate to open another issue for any other question you might have :)

Have a good day!