hzqst/VmwareHardenedLoader

Health v2 · maintenance only

Adoption not part of the score

2334 stars · 542 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Windows kernel driver that mitigates VMware VM detection by filtering VMware-related firmware strings and blocking VMware PnP registry enumeration inside guest VMs. It resolves undocumented kernel globals from signed System Informer KPH dynamic data rather than PDBs or signature scanning.

Use cases

• hide vmware from anti-vm checks
• bypass vm detection in malware analysis sandbox
• make windows vm look like physical machine
• evade vmware fingerprinting in guest
• run protected software inside vmware
• anti anti-vm research

When to choose

• you need to defeat VM detection inside VMware Windows 10/11 guests
• you are doing malware analysis or reverse engineering in a VMware lab
• you want a kernel-level firmware string and PnP filtering approach

When to avoid

• you need VM detection evasion on hypervisors other than VMware
• you cannot load test-signed kernel drivers on the target system
• you need a supported, production-safe solution rather than a research tool

Facets

library · maturity active

security reverse-engineering security reverse-engineering windows anti-anti-vm vmware kernel-driver vm-detection evasion sandbox-evasion driver virtualization

Member repositories

For agents

markdown · JSON · MCP: product_card(name="hzqst/VmwareHardenedLoader")