Jump to content
Donk

How to spoof real Mac in VMware

91 posts in this topic

Recommended Posts

Here are some new VMX settings that will help you make OS X running in VMware look more like a real Apple Mac. I have only tested on Workstation 10 running on Windows 7, so I cannot guarantee that this will work with other VMware versions and OS. These settings may help overcome some issues such as running the Messages application. If you check the system details before making these changes this is what you can expect to see.

 

Hardware Overview:


  Model Name: Mac
  Model Identifier: VMware7,1
  Processor Speed: 2.53 GHz
  Number of Processors: 2
  Total Number of Cores: 2
  L2 Cache (per Processor): 256 KB
  L3 Cache (per Processor): 12 MB
  Memory: 4 GB
  Boot ROM Version: VMW71.00V.0.B64.1308231723
  SMC Version (system): 1.16f8
  Serial Number (system): VMWVk21tM5F4+1Uty1UOSqjAQ
  Hardware UUID: 00000000-0000-1000-8000-000C292AA301

and from ioreg utility:

localhost:~ vmware$ ./system.sh 
VMware7,1
VMWVk21tM5F4+1Uty1UOSqjAQ
440BX Desktop Reference Platform

Let's swap these out for some genuine looking Apple settings.

 

Firstly, you need to have a running OS X guest and a copy of Chameleon Wizard to generate the relevant IDs. I also suggest you take a snapshot first just in case you make a mistake. 

 

Step 1 - Create unique identifiers

Fire up your OS X guest and run the downloaded copy of Chameleon Wizard in the guest. We are not going to be using the Chameleon boot loader just using the wizard's capability to generate various identifiers such as serial number and board-id.

 

Click on the SMBIOS button

 

post-142645-0-07106500-1380104332_thumb.png

 

Select Edit

 

post-142645-0-85979000-1380104333_thumb.png

 

Select a model and other parameters to generate a spoof ID.

 

post-142645-0-84006500-1380104335_thumb.png

 

In this example I have created a MacBook Pro 6.1 with a re-manufactured serial number. Please do not re-use these but generate your own to make sure everything you do is unique. The 3 pieces of information you need to copy to the host are:

 

  • Product Name
  • Board Product
  • Serial

Now close down the guest ready for the next step.

 

2. Edit the VMX file

 

Open the VMX file for your guest in a text editor and add the following lines:

 

board-id.reflectHost = "FALSE"
board-id = <board-id>
hw.model.reflectHost = "FALSE"
hw.model = <product-name>
serialNumber.reflectHost = "FALSE"
serialNumber = <serial-number>
smbios.reflectHost = "FALSE"
Using the example above:
 
board-id.reflectHost = "FALSE"
board-id = "MAC-F22589C8"
hw.model.reflectHost = "FALSE"
hw.model = "MacBookPro6,2"
serialNumber.reflectHost = "FALSE"
serialNumber = "RM129481AGW"
smbios.reflectHost = "FALSE"

Make sure you do not have any duplicate lines or VMware will not load the guest and give you a dictionary error message. The "board-id.reflectHost " is normally added from the new VM wizard and set to trye so make sure you set it to false.

 

Save the VMX file start the guest.

 

Step 3 Check the system

 

You should now be able to use the "System Information" application to see that the guest is using the product and serial number you specified.

 

Hardware Overview:


  Model Name:   MacBook Pro
  Model Identifier: MacBookPro6,2
  Processor Speed:  2.53 GHz
  Number of Processors: 2
  Total Number of Cores:    2
  L2 Cache (per Processor): 256 KB
  L3 Cache (per Processor): 12 MB
  Memory:   4 GB
  Boot ROM Version: VMW71.00V.0.B64.1308231723
  SMC Version (system): 1.16f8
  Serial Number (system):   RM129481AGW
  Hardware UUID:    00000000-0000-1000-8000-000C292AA301

Attached is a small script file which can be run from Terminal to get all 3 parameters. To use copy to the guest rename to system.sh and make executable with chmod. Here is the output from the script showing the specified IDs.

 

localhost:~ vmware$ ./system.sh 
MacBookPro6,2
RM129481AGW
MAC-F22589C8

Hope this helps.

 

 

Update 1: Use Apple MAC Addresses

 

Remove or comment out these lines in the VMX file (make sure guest is powered off):

ethernet0.addressType = "generated"
ethernet0.generatedAddress = "xx:xx:xx:xx:xx:xx"
ethernet0.generatedAddressOffset = "0"

Add the lines with a static Apple MAC Address:

ethernet0.Address = "xx:xx:xx:xx:xx:xx"
ethernet0.addressType = "static"
ethernet0.checkMACAddress = "false"

replace the ethernetX.Address line with something from this list http://hwaddress.com/?q=Apple

 

system.txt

Share this post


Link to post
Share on other sites
Advertisement

I think if we can manually patch the VM Ethernet IDs network values to spoof a Mac's "Ethernet" device to apple, such as ZackehSoul method: http://blog.zackehh.com/imessage-enabler-enabling-imessage-virtual-machines/

 

Along with this vmx patching by Donk we can achieve iMessage use in VMware while still preserving the stock VMware EFI and no longer breaking any of the machines features and stability.

 

EDIT: If anyone has any knowledge of kext writing, there could be some sort of Ethernet "injector" written that resolves the Ethernet information to apple permitted hardware.

Share this post


Link to post
Share on other sites

I think if we can manually patch the VM Ethernet IDs network values to spoof a Mac's "Ethernet" device to apple, such as ZackehSoul method: http://blog.zackehh.com/imessage-enabler-enabling-imessage-virtual-machines/

 

Along with this vmx patching by Donk we can achieve iMessage use in VMware while still preserving the stock VMware EFI and no longer breaking any of the machines features and stability.

 

EDIT: If anyone has any knowledge of kext writing, there could be some sort of Ethernet "injector" written that resolves the Ethernet information to apple permitted hardware.

Actually it looks like the Platform-UUID not mac addresses. I have tested a ML guest on Fusion 6 on a real Macbook Pro and it doesn't work there either, and also people with same problem on VMware forums. I think we need to find a way to update the UUID in NVRAM.

Share this post


Link to post
Share on other sites

I know the VMX file has 2 lines that set the UUID, they are: uuid.bios and uuid.location. They are both hex values and there is an algorithm VMware uses to generate the machine UUID from these.

 

They both seem to contribute to how the UUID of the machine is derived, I know when you move a machine it asks whether you want it to keep the same UUID or generate a new one. We might be able to play with these lines and see if this changes the UUID in NVRAM, I will check when I get home, but you are talking about the UUID in system profiler right? I think if you set uuid.location = "" (it might use the actual machines UUID), would you be able to verify this on your Mac Book Pro?

 

EDIT: Maybe this can be fixed with a patch to the PlatformUUID.kext, to inject the correct UUID from the machine. Anyone have any knowledge with Kexts in order to write this? There used to be some for snow leopard but I doubt they inject the values in mountain lion, I think superhai wrote those

Share this post


Link to post
Share on other sites

Hi,

SMBIOS.use12CharSerialNumber = "TRUE" did the trick for me on VMWare Workstation 10.0.1 for my OSX Mountain Lion VM..

Thank you so much,

Regards,

ElCoyote

 

Share this post


Link to post
Share on other sites

Hi,

SMBIOS.use12CharSerialNumber = "TRUE" did the trick for me on VMWare Workstation 10.0.1 for my OSX Mountain Lion VM..

Thank you so much,

Regards,

ElCoyote

 

 

That's good news. I had seen that setting in a dump of strings but hadn't realised what it meant.

Share this post


Link to post
Share on other sites

So added SMBIOS.use12CharSerialNumber = "TRUE"

 

Removed line serialNumber = "RM129481AGW"

 

I see it generated a serial number.

 

Tried iMessage but still not signing in

 

Now what?

Share this post


Link to post
Share on other sites

So added SMBIOS.use12CharSerialNumber = "TRUE"

 

Removed line serialNumber = "RM129481AGW"

 

I see it generated a serial number.

 

Tried iMessage but still not signing in

 

Now what?

 

 

 

I have no ideas now.

 

Also can I please ask that others do NOT use my generated number as I politely asked in the original email. Please take the time to generate your own.

Share this post


Link to post
Share on other sites

So added SMBIOS.use12CharSerialNumber = "TRUE"

 

Removed line serialNumber = "RM129481AGW"

 

I see it generated a serial number.

 

Tried iMessage but still not signing in

 

Now what?

Yes, you' re right. I thought it would work because the results of osx-system.sh within the Guest were the same as on my Real Mac but I hadn' t verified iMessage. I used the identification of my Real MBP (along with the Serial Number, the hardware type, etc..) and it' s still not signing in.. (although it seems to take longer to verify that information).

Kind regards,

 

Share this post


Link to post
Share on other sites

Yes, you' re right. I thought it would work because the results of osx-system.sh within the Guest were the same as on my Real Mac but I hadn' t verified iMessage. I used the identification of my Real MBP (along with the Serial Number, the hardware type, etc..) and it' s still not signing in.. (although it seems to take longer to verify that information).

Kind regards,

 

 

I think I will try it again on one of my real Macs and Fusion 6. If it doesn't work I will raise it as an issue with VMware.

Share this post


Link to post
Share on other sites

I was able to get iCloud find my iphone to recognize the VMware online with this vmx line, but yes iMessage is still broken.

 

I think Donk is right, it must be something that needs to be injected into the NVRAM, if you use a different bootloader this works, but it breaks more than it fixes. Maybe it's the way VMware identifies it's hardware to the OSX. I get to log in to iMessage but get a message that says "error processing registration".

Share this post


Link to post
Share on other sites

If I reset the SMBios info to another form of apple computer, then try sign into iMessage within vmware 10 I get 5 popup windows of "an error occured during activation..." then after clicking the 5th popup windows, It shows account as enabled but seconds later bombs out again and show inactive.

Share this post


Link to post
Share on other sites

I think I will try it again on one of my real Macs and Fusion 6. If it doesn't work I will raise it as an issue with VMware.

Only just had time to do this, but clean Mavericks install on Fusion 6 Pro, on a real Macbook Pro allows iMessage to work. So now need to take that VM to a Workstation machine and see if I can find what is different. Will probably use DarwinDumper to get a complete snapshot of all hardware information, and compare between the 2 platforms.

Share this post


Link to post
Share on other sites

Only just had time to do this, but clean Mavericks install on Fusion 6 Pro, on a real Macbook Pro allows iMessage to work. So now need to take that VM to a Workstation machine and see if I can find what is different. Will probably use DarwinDumper to get a complete snapshot of all hardware information, and compare between the 2 platforms.

Thanks for the update Donk, keep up the great work!

Share this post


Link to post
Share on other sites

Has anyone been able to get the serialnumber config parameter to work on ESXI 5.5?

 

I entered my own hardware serial number but Mac OS X Mavericks is unable to read it, instead a super long string is displayed.

Share this post


Link to post
Share on other sites

Only just had time to do this, but clean Mavericks install on Fusion 6 Pro, on a real Macbook Pro allows iMessage to work. So now need to take that VM to a Workstation machine and see if I can find what is different. Will probably use DarwinDumper to get a complete snapshot of all hardware information, and compare between the 2 platforms.

Hi Donk, where you able to verify the same machine on Workstation? I wonder if it is something to do with the vmware injected hardware values from the local machine.

Share this post


Link to post
Share on other sites

Is there any way to use this to basically trick a program that wont run in an OSX virtual machine to actually run in it.

Basically i have this software that somehow detects that im running osx in vmware.

 

From the log i have it seems to check the ROMBootVersion, SCM version and the rombootversion shows up as VMF.xxxxx which is the VMware software version.

 

I also have not installed the parallels tools yet so i know its not seeing that. I think it is checking the hardware profile and since it doesnt know the processor type, memory, ect it fails.

 

Is there any way i can monitor the startup of the app to see what it called for in the system for checks. is there a way i can spoof my entire real rMBP

 

Thanks!

Share this post


Link to post
Share on other sites

Only just had time to do this, but clean Mavericks install on Fusion 6 Pro, on a real Macbook Pro allows iMessage to work. So now need to take that VM to a Workstation machine and see if I can find what is different. Will probably use DarwinDumper to get a complete snapshot of all hardware information, and compare between the 2 platforms.

 

Donk, could you please specify on which condition (virtual hw ver, vmx option,…)

I am currently running on Mac with Fusion but I was unable to get iMessage working :(

 

Thnx

Share this post


Link to post
Share on other sites

Is this possible to do? I am running VMware 10.0.1 with an OS X 10.9 guest (using VMsvga2 and VMware Tools from Darwin.iso 6.0.2) and everything mostly works fine. The only thing I can't get working is iMessage. I think I've tried just about everything ....

 

M-u-l-t-i Beast 6.0.1
Chameleon Wizard
Chimera
FileNVRAM.dylib 1.1.2 (and 1.1.3)
added SMBIOS.use12CharSerialNumber = "TRUE" to the .vmx,
Signing in from a "real" Mac
changing iCloud password
clearing all iMessage items from Keychain
...etc etc...
 
So far nothing has worked... has anyone gotten iMessage to work from inside VMware Workstation running on a non-Mac host?

Share this post


Link to post
Share on other sites

Hello Donk,

 

Have you tried this spoof method on ESXi host and see if it "fools" hypervisor into thinking it's installed on real Mac ?! That way we could use vCenter to manage unlocked ESXi host... just wishful thinking :-)

Share this post


Link to post
Share on other sites

Hello Donk,

 

Have you tried this spoof method on ESXi host and see if it "fools" hypervisor into thinking it's installed on real Mac ?! That way we could use vCenter to manage unlocked ESXi host... just wishful thinking :-)

 

It would work, as I tried it on a nested ESXi instance. However you would need to make your ESXi server a Hackintosh and override the SMBIOS to specify Apple hardware and the presence of the SMC chip. I have not found a way to do that as ESXi uses its own bootloader.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By MSoK
      This is the current version of VMware Tools for OS X / macOS from the VMware CDS repository for Fusion 11.1.0
       
      Please note: In the latest VMwareGfx.kext from Fusion 8.5.5 onwards VMware have discontinued the 2D-Acceleration code, and graphics performance is better now, thanks to Zenith432 for the update.
       
      To check for the latest version visit http://softwareupdate.vmware.com/cds/vmw-desktop/fusion/. The various VMware Tools downloads are located under the packages folder for each version.
       
      Instructions for extracting darwin.iso and darwinPre15.iso
      - Download the files above
      - Extract com.vmware.fusion.tools.darwin.zip.tar
      - darwin.iso is located in the "payload" folder
      - Extract com.vmware.fusion.tools.darwinPre15.zip.tar
      - darwinPre15.iso is located in the "payload" folder
    • By cgilley
      Bear with me please, the vmware site is almost hopeless, so I ran across insanelymac.. So, I have a fairly high end laptop that has enabled me to push much of my development environment into virtual machines.  One of these VMs was a macOS High Sierra install.  As a developer, I always have an interest in learning new things, and some of my co-workers are Apple advocates.  Plus, there was some s/w I wanted to try that would only work on the mac.  Using unlocker, etc, I was easily able to create a Mac workstation (what the hell do you call this - mac, macos, apple, mac VM?  lol, I don't have the lingo down right....).  I've been using it for the last 4 months.
       
      Then came the VM Workstation 14.1.6 update.  It kept nagging at me, so I finally allowed it to install.  Brain fart on my part, I should have backed up all of my virtual machines.  All the Windows VMs came through fine, but the Mac is stuck in a perpetual re-boot cycle.  I'm sure this is a vmware issue, but I was hoping maybe a reader has seen this before and has some ideas.  I've gone through the vmware logs until my eyes bleed - lots of interesting but useless information...
       
      regards,
       
      cg
       

    • By br0adband
      Currently using VMware Workstation 15.0.3, with High Sierra 10.13.6 fully updated - Mojave has some issues because of changes to how the GUI is drawn so the performance is slower so I stick with High Sierra. But I've noted - over the years this has always been the case with using macOS or OSX in VMware Workstation as a guest OS sitting on top of Windows - that the actual networking performance is pretty lackluster and I've always wondered why.
       
      I have a Windows 7 VM that I created for testing purposes, so here's the setup in terms of the physical host hardware:
       
      HP EliteBook Folio 9470m
      Intel i5-3427u CPU (2 cores/4 threads)
      12GB of DDR3 1600 (dual channel mode, gets about 22GB/s reads and 21GB/s writes so it's fast enough)
      Samsung 860 EVO 500GB SATA SSD (540MB/s reads and 520MB/s writes tested and verified regularly, no issues)
      Intel Gigabit NIC (no issues)
      Gigabit Internet service (I regularly pull 950-960Mbps without issues)
      Windows 7 Professional x64 fully updated as of March 15th (no issues whatsoever)
       
      Doing a speedtest from my ISP I get ~950Mbps results, downloading large contiguous files from some services gives me 70-90MB/s (that's Megabytes per second) sustained bandwidth during the downloads.
       
      For the VM, it's:
       
      VMware Workstation 15.0.3 (unlocked with Donk's unlocker)
      macOS High Sierra 10.13.5 installed from ISO then upgraded to 10.13.6 from App Store
      4GB assigned to the VM (of the 12GB physical hardware RAM)
      2 "CPUs" assigned to the VM (meaning I just have it set for 1 CPU 2 cores, using the extra two threads from Hyperthreading causes some audio glitches with the VM)
      VMware Tools installed (latest available directly from VMware)
       
      Everything in the VM is "stock" meaning I haven't and probably can't alter the hardware profile. Now, if I go do a download from someplace that I know is fast and can provide significant bandwidth in excess of 50MB/s (that's 400Mbps by the math) like Google Drive or Microsoft OneDrive, or perhaps some Linux distro mirror site in my region, I end up seeing a maximum speed of about 150Mbps (that's Megabits per second) or about 18-19MB/s.
       
      Considering it's a Gigabit NIC being fed to the VM, and Gigabit Internet service, I'd like to think the VM should be showing faster speeds but it's not. No matter what I do, even if it's copying files from a network share to the VM (as a shared folder set up in the VM settings) it still maxes out at roughly ~150Mbps and I can't for the life of me figure out why.
       
      Anyone else notice this slow performance?
       
      Here's why I bring it up:
       
      With the Windows 7 VM I use for testing, as a guest OS on top of Windows 7 itself, I can pull 850-950Mbps in the same speed testing situations. But with the macOS VM, 150Mbps tops it seems.
       
      I wonder if there's a reason for this, perhaps the NIC driver in VMware Tools is just crazy inefficient with respect to using macOS on a Windows host which isn't supposed to be done, of course, but we do it anyway because we actually can (thanks to Donk and many others over the years, I have my own storied history as part of The OSx86 Project when it started up long ago).
       
      Just wondering if anyone else has ever noticed this issue. It's not a big huge hassle, of course, but it is somewhat irritating knowing the networking for the VM should be significantly faster. When I look at the Network Adapter properties inside macOS it shows a Gigabit link as far as the VMware networking driver is concerned so, again, it's just odd why it's so limited, almost a flat line at ~150Mbps and I've never been able to get it to go any faster.
       
      Bizarre...
    • By Utku
      Hi guys, I have a big problem for VT -x. I tried any things for example: dark=0 or already bios option is virtualization is enable. I don't understand this problem.
       
      Thanks guys!! And yes I have intel Q8400 quad core cpu, motherboard is Asus asus p5g41c-m lx.
       


    • By Donk
      Here is a new utility to patch the EFI firmware in VMware Workstation and Fusion to allow the non-server versions of Mac OS X 10.5 (Leopard) and 10.6 (Snow Leopard) to run. Yoiu will need macOS unlocker 3 if you are using Workstation on non-Apple hardware. I still have to find a way to do this on ESXi as the UEFIPatch utility will not run in the ESXi console.
      This currently supports:
       
      Workstation 11/12/14/15 on Windows and Linux Workstation Player 7/12/14/15 on Windows and Linux Fusion 10/11 on macOS  
      https://github.com/DrDonk/efi-unlocker/releases/download/1.0.0/efi-unlocker100.zip
      https://github.com/DrDonk/efi-unlocker
       
      Please read the readme.txt file for details.
      readme.txt
×