ScoopyNG — The VMware detection tool

Latest Version: v1.0 from 2008 — Current Status: Not further maintained.

ScoopyNG combines the detection tricks of Scoopy Doo and Jerry as well as some new techniques to determine if a current OS is running inside a VMware Virtual Machine (VM) or on a native system.

ScoopyNG should work on all modern uni-, multi- and multi-core cpu's.

ScoopyNG is able to detect VMware even if "anti-detection-mechanisms" are deployed.


FAQ — Interpretation of results

Q: How do I know if it's indeed a VMware Virtual Machine?
A: If one or more of the test results state that VMware is detected.

Q: Do all the tests have to state that it's VMware?
A: No, it is sufficient that one test result says that VMware is detected.


Sample results

Sample 1: native, Windows Vista SP1 32bit, Intel(R) Core(TM)2 Duo CPU

Sample 2: VM, Windows Vista SP1 32bit, Intel(R) Core(TM)2 Duo CPU, VMware Workstation 6.0.4 build-93057, without anti-detection-mechanisms

Sample 3: VM, Windows Vista SP1 32bit, Intel(R) Core(TM)2 Duo CPU, VMware Workstation 6.0.4 build-93057, with anti-detection-mechanisms


Download

Latest Version: Download ScoopyNG v1.0

SHA-256: AB68E945BCEAB536F637B0A3CCAAE7A9EB831A07DA89EB3ABB46728BCDF286E3


Citations

The tool is cited in various academic journals (e.g. here or here) and books.