Jump to content

How to spoof real Mac in VMware

Donk

By Donk,
in Multi-booting and Virtualisation

 Share
95 posts in this topic

Recommended Posts

Donk
Donk
Posted
Posted

Here are some new VMX settings that will help you make OS X running in VMware look more like a real Apple Mac. I have only tested on Workstation 10 running on Windows 7, so I cannot guarantee that this will work with other VMware versions and OS. These settings may help overcome some issues such as running the Messages application. If you check the system details before making these changes this is what you can expect to see.

 

Hardware Overview:


  Model Name: Mac
  Model Identifier: VMware7,1
  Processor Speed: 2.53 GHz
  Number of Processors: 2
  Total Number of Cores: 2
  L2 Cache (per Processor): 256 KB
  L3 Cache (per Processor): 12 MB
  Memory: 4 GB
  Boot ROM Version: VMW71.00V.0.B64.1308231723
  SMC Version (system): 1.16f8
  Serial Number (system): VMWVk21tM5F4+1Uty1UOSqjAQ
  Hardware UUID: 00000000-0000-1000-8000-000C292AA301

and from ioreg utility:

localhost:~ vmware$ ./system.sh 
VMware7,1
VMWVk21tM5F4+1Uty1UOSqjAQ
440BX Desktop Reference Platform

Let's swap these out for some genuine looking Apple settings.

 

Firstly, you need to have a running OS X guest and a copy of Chameleon Wizard to generate the relevant IDs. I also suggest you take a snapshot first just in case you make a mistake. 

 

Step 1 - Create unique identifiers

Fire up your OS X guest and run the downloaded copy of Chameleon Wizard in the guest. We are not going to be using the Chameleon boot loader just using the wizard's capability to generate various identifiers such as serial number and board-id.

 

Click on the SMBIOS button

 

post-142645-0-07106500-1380104332_thumb.png

 

Select Edit

 

post-142645-0-85979000-1380104333_thumb.png

 

Select a model and other parameters to generate a spoof ID.

 

post-142645-0-84006500-1380104335_thumb.png

 

In this example I have created a MacBook Pro 6.1 with a re-manufactured serial number. Please do not re-use these but generate your own to make sure everything you do is unique. The 3 pieces of information you need to copy to the host are:

 

  • Product Name
  • Board Product
  • Serial

Now close down the guest ready for the next step.

 

2. Edit the VMX file

 

Open the VMX file for your guest in a text editor and add the following lines:

 

board-id.reflectHost = "FALSE"
board-id = <board-id>
hw.model.reflectHost = "FALSE"
hw.model = <product-name>
serialNumber.reflectHost = "FALSE"
serialNumber = <serial-number>
smbios.reflectHost = "FALSE"
Using the example above:
 
board-id.reflectHost = "FALSE"
board-id = "MAC-F22589C8"
hw.model.reflectHost = "FALSE"
hw.model = "MacBookPro6,2"
serialNumber.reflectHost = "FALSE"
serialNumber = "RM129481AGW"
smbios.reflectHost = "FALSE"

Make sure you do not have any duplicate lines or VMware will not load the guest and give you a dictionary error message. The "board-id.reflectHost " is normally added from the new VM wizard and set to trye so make sure you set it to false.

 

Save the VMX file start the guest.

 

Step 3 Check the system

 

You should now be able to use the "System Information" application to see that the guest is using the product and serial number you specified.

 

Hardware Overview:


  Model Name:   MacBook Pro
  Model Identifier: MacBookPro6,2
  Processor Speed:  2.53 GHz
  Number of Processors: 2
  Total Number of Cores:    2
  L2 Cache (per Processor): 256 KB
  L3 Cache (per Processor): 12 MB
  Memory:   4 GB
  Boot ROM Version: VMW71.00V.0.B64.1308231723
  SMC Version (system): 1.16f8
  Serial Number (system):   RM129481AGW
  Hardware UUID:    00000000-0000-1000-8000-000C292AA301

Attached is a small script file which can be run from Terminal to get all 3 parameters. To use copy to the guest rename to system.sh and make executable with chmod. Here is the output from the script showing the specified IDs.

 

localhost:~ vmware$ ./system.sh 
MacBookPro6,2
RM129481AGW
MAC-F22589C8

Hope this helps.

 

 

Update 1: Use Apple MAC Addresses

 

Remove or comment out these lines in the VMX file (make sure guest is powered off):

ethernet0.addressType = "generated"
ethernet0.generatedAddress = "xx:xx:xx:xx:xx:xx"
ethernet0.generatedAddressOffset = "0"

Add the lines with a static Apple MAC Address:

ethernet0.Address = "xx:xx:xx:xx:xx:xx"
ethernet0.addressType = "static"
ethernet0.checkMACAddress = "false"

replace the ethernetX.Address line with something from this list http://hwaddress.com/?q=Apple

 

system.txt

  • Like 9
Link to comment
Share on other sites
ArgVega
ArgVega
Posted
Posted

I think if we can manually patch the VM Ethernet IDs network values to spoof a Mac's "Ethernet" device to apple, such as ZackehSoul method: http://blog.zackehh.com/imessage-enabler-enabling-imessage-virtual-machines/

 

Along with this vmx patching by Donk we can achieve iMessage use in VMware while still preserving the stock VMware EFI and no longer breaking any of the machines features and stability.

 

EDIT: If anyone has any knowledge of kext writing, there could be some sort of Ethernet "injector" written that resolves the Ethernet information to apple permitted hardware.

Link to comment
Share on other sites
Donk
Donk
Posted
  • Author
Posted

I think if we can manually patch the VM Ethernet IDs network values to spoof a Mac's "Ethernet" device to apple, such as ZackehSoul method: http://blog.zackehh.com/imessage-enabler-enabling-imessage-virtual-machines/

 

Along with this vmx patching by Donk we can achieve iMessage use in VMware while still preserving the stock VMware EFI and no longer breaking any of the machines features and stability.

 

EDIT: If anyone has any knowledge of kext writing, there could be some sort of Ethernet "injector" written that resolves the Ethernet information to apple permitted hardware.

Actually it looks like the Platform-UUID not mac addresses. I have tested a ML guest on Fusion 6 on a real Macbook Pro and it doesn't work there either, and also people with same problem on VMware forums. I think we need to find a way to update the UUID in NVRAM.

Link to comment
Share on other sites
ArgVega
ArgVega
Posted
Posted

I know the VMX file has 2 lines that set the UUID, they are: uuid.bios and uuid.location. They are both hex values and there is an algorithm VMware uses to generate the machine UUID from these.

 

They both seem to contribute to how the UUID of the machine is derived, I know when you move a machine it asks whether you want it to keep the same UUID or generate a new one. We might be able to play with these lines and see if this changes the UUID in NVRAM, I will check when I get home, but you are talking about the UUID in system profiler right? I think if you set uuid.location = "" (it might use the actual machines UUID), would you be able to verify this on your Mac Book Pro?

 

EDIT: Maybe this can be fixed with a patch to the PlatformUUID.kext, to inject the correct UUID from the machine. Anyone have any knowledge with Kexts in order to write this? There used to be some for snow leopard but I doubt they inject the values in mountain lion, I think superhai wrote those

Link to comment
Share on other sites
  • 3 weeks later...
Donk
Donk
Posted
  • Author
Posted

Hi,

SMBIOS.use12CharSerialNumber = "TRUE" did the trick for me on VMWare Workstation 10.0.1 for my OSX Mountain Lion VM..

Thank you so much,

Regards,

ElCoyote

 

 

That's good news. I had seen that setting in a dump of strings but hadn't realised what it meant.

Link to comment
Share on other sites
Hemps
Hemps
Posted
Posted

So added SMBIOS.use12CharSerialNumber = "TRUE"

 

Removed line serialNumber = "RM129481AGW"

 

I see it generated a serial number.

 

Tried iMessage but still not signing in

 

Now what?

Link to comment
Share on other sites
Donk
Donk
Posted
  • Author
Posted

So added SMBIOS.use12CharSerialNumber = "TRUE"

 

Removed line serialNumber = "RM129481AGW"

 

I see it generated a serial number.

 

Tried iMessage but still not signing in

 

Now what?

 

 

 

I have no ideas now.

 

Also can I please ask that others do NOT use my generated number as I politely asked in the original email. Please take the time to generate your own.

Link to comment
Share on other sites
ElCoyote_
ElCoyote_
Posted
Posted

So added SMBIOS.use12CharSerialNumber = "TRUE"

 

Removed line serialNumber = "RM129481AGW"

 

I see it generated a serial number.

 

Tried iMessage but still not signing in

 

Now what?

Yes, you' re right. I thought it would work because the results of osx-system.sh within the Guest were the same as on my Real Mac but I hadn' t verified iMessage. I used the identification of my Real MBP (along with the Serial Number, the hardware type, etc..) and it' s still not signing in.. (although it seems to take longer to verify that information).

Kind regards,

 

Link to comment
Share on other sites
Donk
Donk
Posted
  • Author
Posted

Yes, you' re right. I thought it would work because the results of osx-system.sh within the Guest were the same as on my Real Mac but I hadn' t verified iMessage. I used the identification of my Real MBP (along with the Serial Number, the hardware type, etc..) and it' s still not signing in.. (although it seems to take longer to verify that information).

Kind regards,

 

 

I think I will try it again on one of my real Macs and Fusion 6. If it doesn't work I will raise it as an issue with VMware.

Link to comment
Share on other sites
ArgVega
ArgVega
Posted
Posted

I was able to get iCloud find my iphone to recognize the VMware online with this vmx line, but yes iMessage is still broken.

 

I think Donk is right, it must be something that needs to be injected into the NVRAM, if you use a different bootloader this works, but it breaks more than it fixes. Maybe it's the way VMware identifies it's hardware to the OSX. I get to log in to iMessage but get a message that says "error processing registration".

Link to comment
Share on other sites
Hemps
Hemps
Posted
Posted

If I reset the SMBios info to another form of apple computer, then try sign into iMessage within vmware 10 I get 5 popup windows of "an error occured during activation..." then after clicking the 5th popup windows, It shows account as enabled but seconds later bombs out again and show inactive.

Link to comment
Share on other sites
Donk
Donk
Posted
  • Author
Posted

I think I will try it again on one of my real Macs and Fusion 6. If it doesn't work I will raise it as an issue with VMware.

Only just had time to do this, but clean Mavericks install on Fusion 6 Pro, on a real Macbook Pro allows iMessage to work. So now need to take that VM to a Workstation machine and see if I can find what is different. Will probably use DarwinDumper to get a complete snapshot of all hardware information, and compare between the 2 platforms.

  • Like 1
Link to comment
Share on other sites
MSoK
MSoK
Posted
Posted

Only just had time to do this, but clean Mavericks install on Fusion 6 Pro, on a real Macbook Pro allows iMessage to work. So now need to take that VM to a Workstation machine and see if I can find what is different. Will probably use DarwinDumper to get a complete snapshot of all hardware information, and compare between the 2 platforms.

Thanks for the update Donk, keep up the great work!

Link to comment
Share on other sites
  • 3 weeks later...
ArgVega
ArgVega
Posted
Posted

Only just had time to do this, but clean Mavericks install on Fusion 6 Pro, on a real Macbook Pro allows iMessage to work. So now need to take that VM to a Workstation machine and see if I can find what is different. Will probably use DarwinDumper to get a complete snapshot of all hardware information, and compare between the 2 platforms.

Hi Donk, where you able to verify the same machine on Workstation? I wonder if it is something to do with the vmware injected hardware values from the local machine.

Link to comment
Share on other sites
  • 2 weeks later...
xexitenglishx
xexitenglishx
Posted
Posted

Is there any way to use this to basically trick a program that wont run in an OSX virtual machine to actually run in it.

Basically i have this software that somehow detects that im running osx in vmware.

 

From the log i have it seems to check the ROMBootVersion, SCM version and the rombootversion shows up as VMF.xxxxx which is the VMware software version.

 

I also have not installed the parallels tools yet so i know its not seeing that. I think it is checking the hardware profile and since it doesnt know the processor type, memory, ect it fails.

 

Is there any way i can monitor the startup of the app to see what it called for in the system for checks. is there a way i can spoof my entire real rMBP

 

Thanks!

  • Like 1
Link to comment
Share on other sites
AxeL__17
AxeL__17
Posted
Posted

Only just had time to do this, but clean Mavericks install on Fusion 6 Pro, on a real Macbook Pro allows iMessage to work. So now need to take that VM to a Workstation machine and see if I can find what is different. Will probably use DarwinDumper to get a complete snapshot of all hardware information, and compare between the 2 platforms.

 

Donk, could you please specify on which condition (virtual hw ver, vmx option,…)

I am currently running on Mac with Fusion but I was unable to get iMessage working :(

 

Thnx

Link to comment
Share on other sites
luckman212
luckman212
Posted
Posted

Is this possible to do? I am running VMware 10.0.1 with an OS X 10.9 guest (using VMsvga2 and VMware Tools from Darwin.iso 6.0.2) and everything mostly works fine. The only thing I can't get working is iMessage. I think I've tried just about everything ....

 

M-u-l-t-i Beast 6.0.1
Chameleon Wizard
Chimera
FileNVRAM.dylib 1.1.2 (and 1.1.3)
added SMBIOS.use12CharSerialNumber = "TRUE" to the .vmx,
Signing in from a "real" Mac
changing iCloud password
clearing all iMessage items from Keychain
...etc etc...
 
So far nothing has worked... has anyone gotten iMessage to work from inside VMware Workstation running on a non-Mac host?
Link to comment
Share on other sites
  • 3 weeks later...
Donk
Donk
Posted
  • Author
Posted

Hello Donk,

 

Have you tried this spoof method on ESXi host and see if it "fools" hypervisor into thinking it's installed on real Mac ?! That way we could use vCenter to manage unlocked ESXi host... just wishful thinking :-)

 

It would work, as I tried it on a nested ESXi instance. However you would need to make your ESXi server a Hackintosh and override the SMBIOS to specify Apple hardware and the presence of the SMC chip. I have not found a way to do that as ESXi uses its own bootloader.

Link to comment
Share on other sites
 Share
Go to topic listing
×
×
  • Create New...