How to fake a VMs guest OS CPUID

For the most software products the license verification is done with license keys. During my time in the IT I have also seen some products, where the license is tied to the underlying hardware of your server. Mostly this is realized with license files, which include the ID of your CPU. The application checks if the ID within this file matches to the actual CPU ID to complete this mechanism.

I have virtualized some servers with applications, which used this kind of license checks. The normal and probably easiest way is to request / generate a new license file for your new (virtual) hardware. Some weeks ago a customer had the special situation that the software vendor didn´t exists anymore and his physical old server was crashing all the time, which was hosting this special application. He already created a new VM and installed the application but didn´t get any further, because the license file wasn´t accepted. Without a valid license the application didn´t even started.

It took me a while to figure out how to fake the CPUID as I didn´t find anything helpful on the web.


Step 1:
Find out the CPUID you actual need. To do this on a Windows server or desktop open the powershell and run the command Get-WmiObject Win32_Processor. Below you see an example output from my notebook.

cpuid_1

Step 2:
The ID I figured out consists out of two register parts of the assembly instructions of a CPU. For more details check out this wiki article. The picture bellows shows how to spilt this ID into the two required parts.

cpuid_2

This parts you now need to convert form hexadecimal into binary. In my example this looks like this:

cpuid_3

Step 3:
Put the following code to your vmx file of your VM:

cpuid.1.eax = “00000000000000110000011010101001”
cpuid.1.edx = “10111111111010111111101111111111”

Power up your VM and verify the current CPUID with the command shown in step 1. You should now see your desired ID.



Note: The 32-bits of the edx register includes information about specific features the CPU presents to a guest OS. A list of all this features is included in the wiki article I already mentioned above. Some of this features are for sure not available or at least don’t make sense for a virtual CPU. If your new ID includes some of this features, this doesn´t mean that it doesn’t work, but you should verify that your VMs still runs correctly. Also I don´t know if this is supported by VMware. In my case it worked like a charm and the VM runs without any problems.

Special thanks to Jim Mattson from VMware to point me into the right direction.


Comments

  1. I want to know what environment you fake this cpuid information。such as vmware workstation,or vsphere et.

    I very glade to your response to me.

    thanks!!!

  2. forzagenki says:

    Hi,
    Thank you for the tutorial.
    My solution is to build a flexible environment for VMware workstation.
    I’ve followed your tutorial but it doesn’t work for me.

    Step 1:
    I opened PowerShell on Windows desktop of my notebook with i3-M380(Arrandale) and ran the command Get-WmiObject Win32_Processor to find the CPUID I actual need.
    ProcessorId : BFEBFBFF00020655

    Step 2:
    I checked the current CPUID of my another notebook with i7-4650U(Haswell) same way as Step 1.
    ProcessorId : BFEBFBFF00040651
    I put the following code to my vmx file of my VM on this machine:
    cpuid,1,eax = “00000000000000100000011001010101” (00020655)
    cpuid,1,edx = “10111111111010111111101111111111” (BFEBFBFF)
    I powered up my VM and verified the new CPUID same way as Step 1.
    But I couldn’t find my desired ID. (No change)
    ProcessorId : BFEBFBFF00040651

    I don’t know what could be wrong.
    Do you have any suggestions?

    Best regards,
    Genki

    • Hi Genki,
      your convertion looks correct to me.

      At least in the comment you are using ‘,’ instead of ‘.’ in the cpuid parameter.
      Also I don´t know if this is working with VMware workstation products. I performed this on a vSphere 5.1 environment.

      Cheers,
      Mario

  3. Hi Mario,

    Nice post, this is very interesting – thanks for sharing.

    I played around with this in PowerShell after reading your post and have come up with a short script to automate the conversion and generate the syntax for adding into the VMX file.

    ## START ##

    Clear-Host

    ## Get CPUID using WMI
    $ProcessorId = Get-WmiObject Win32_Processor

    ## Convert Hexadecimal numbers on the command line, just prefix the value with ‘0x’
    [Int64]$edx = ‘0x’+ $ProcessorId.ProcessorId.Substring(0,8)
    [Int64]$eax = ‘0x’+ $ProcessorId.ProcessorId.Substring(8,8)

    ## Convert to Binary
    $edxbin = [Convert]::ToString($edx,2)
    $eaxbin = [Convert]::ToString($eax,2)

    ## Pad with leading zero’s if length is less than 32
    If ($edxbin.Length -lt 32){
    $edxbin = “{0:D32}” -f [Int64]$edxbin
    }

    If ($eaxbin.Length -lt 32){
    $eaxbin = “{0:D32}” -f [Int64]$eaxbin
    }

    ## Add to the vmx file of your VM
    Write-Host “cpuid.1.eax = `”$eaxbin`””
    Write-Host “cpuid.1.edx = `”$edxbin`””

    ## END ##

    If I run this on my desktop, it converts my Pocessor ID (BFEBFBFF000206A7) to the following output;

    cpuid.1.eax = “00000000000000100000011010100111”
    cpuid.1.edx = “10111111111010111111101111111111”

    Hope I’ve got this right?

    Cheers,
    Jon

  4. Susanne says:

    Hello Mario,
    I’m very glad that I found your article about cpuid manipulation. I’m very unexperienced in those things, but I’m facing the same problem as you described above: We have a software running with a license, that is bound to the cpuid and we have to migrate the underlying server system. I guess your solution could be working here, but in my case, if I perform the command ‘wmic cpu’ on the source system, it returns two cpu’s. So I guess I have to add information of eax and edx for both processors to my vmx file. My question is: What’s the correct nontation in this case? I would appreciate it very much if you could answer my question! Thanks a lot! -Susanne

  5. Amaris Edeh says:

    Mario, you are my hero! You have saved me a lot of time, money, and frustration–here’s to one more subscriber!! -Amaris

  6. Hello,Can i spoof or change the CPUID ???

  7. Not sure if you able to verify this, but I want to make sure the CPU ID I pulled from my computer is in proper form. Is AFEBFBFF0001067A a valid CPU ID?

  8. Does this trick work with VMware Player?

Speak Your Mind

*