Using Free Windows XP Mode as a VMware Virtual Machine

It’s becoming hard to obtain a licensed copy of Windows XP. Yet, many IT professionals, including malware analysts, like having Windows XP in their virtualized labs. After all, Windows XP is still running on numerous personal and business systems. Fortunately, you can download a virtualized instance of Windows XP from Microsoft for free if you are running Windows 7 Professional, Enterprise, or Ultimate on your base system.Microsoft calls this virtualized instance of Windows XP “Windows XP Mode,” and distributes it in the Windows Virtual PC format. If you prefer to use VMware Workstation or VMware Player instead of Virtual PC, follow instructions below.Download Windows XP Mode from Microsoft. You’ll need to go through the Windows validation wizard to confirm you’re running a licensed copy of the appropriate version of Windows 7. You’ll have the option of downloading and installing Windows Virtual PC software, but you don’t need it if you’ll be using VMware.

Install the downloaded Windows XP Mode executable. The installation wizard will give you a chance to specify where the files installed, placing them in “C:\Program Files\Windows XP Mode” by default. This folder will contain, among other files, the 1GB+ file “Windows XP Mode base.vhd” representing the hard drive of the Windows XP virtual machine.

Launch VMware Workstation or Player. Go to the File > Import Windows XP Mode VM menu.

VMware will launch the wizard that will automatically create the Windows XP VMware virtual machine using the Windows XP Mode files you installed in the previous step.

Using VMware Workstation or Player, power on the Windows XP Mode virtual machine that VMware created. Go through the Windows XP setup wizard the same way you would do it for a regular Windows XP system.

At this point, you should have a VMware virtual machine running Windows XP. It will be connected to the network using the VMWare “NAT” mode, so if your base system has Internet access, so would the virtual machine.There two other ways of obtaining Windows virtual machines, both using Windows Virtual PC. In both cases, you can download Windows Virtual PC files and convert them into the VMware format by using VMware vCenter Converteror by using File > Import or Export… in VMware Workstation. You can download Windows XP, Vista and 7 virtual machines from Microsoft’s Internet Explorer Application Compatibility

VPC Image page. You can also download Windows XP and Vista VMs from the NIST Federal Desktop Core Configuration FDCC page. You’ll need to supply valid Windows licenses to activate these OS instances; you may be able to use them for some time period in a limited manner without activation.If this topic is interesting to you, take a look at my Reverse-Engineering Malware course.Hand-picked related items:Using VMware for Malware AnalysisVMware Network Isolation for a Malware Analysis Lab5 Steps to Building a Malware Analysis Toolkit Using Free Tools— Lenny Zeltser

Run XP Mode in VMware Workstation or Player with Activation Intact

The availability of Windows XP Mode is equivalent to a free license to Windows XP operating system. Windows XP Mode is basically a pre-configured and pre-activated copy of Windows XP Professional SP3 running in a virtual machine, with seamless application integration with host machine.

Normally, Windows Virtual PC (VPC) is required to install and run Windows XP Mode (XPM). For VMware Workstation or VMware Player users, there is no reason not to install VPC again just to use XPM, instead of just using more advanced VMware virtualization solution.

From VMware Workstation 7 and VMWare Player 3, the VMware products are now Windows XP Mode compatible, where users of VMware Workstation or VMware Player can import a Windows XP Mode virtual machine, and run the virtual machine full activated, without the need to enter a Windows XP license serial number or product key to activate Windows XP Mode. Windows XP Mode is pre-activated by default, but the activation is normally lost when the virtual machine is ported to other platform.

By running Windows XP Mode on VMware, the virtual machine can take advantage of more than one CPU processor, render high-end graphics, integrate seamlessly with Unity, transfer files easily with drag and drop, and use shared folders. Best of all, VMware can also run concurrently with Windows XP Mode.

Here’s how to import and run Windows XP Mode on VMware Player or VMware Workstation:

1. Download and install Windows XP Mode.

Tip: Windows Virtual PC is not required, if you not plan to use it.

2. Run VMware Player or VMware Workstation.3. Click on File drop down menu, and select Import Windows XP Mode VM.

4. VMware will automatically import and reconfigure Windows XP Mode virtual machine to work with VMware virtualization engine, with a dialog box with progress status bar. Once process is completed, a new virtual machine named Windows XP Mode will appear in VMware.

5. Select the Windows XP Mode and click Play Virtual Machine to run the XP Mode.

Note: If the Windows XP Mode has never been started before, user will need to complete the initial setup.

Tip 1: If the Windows XP Mode is not activated after imported into VMware, check the Windows Xp Mode.vmx configuration file, and ensure that an entry called xpmode.enabled has the “True” value, i.e. xpmode.enabled = “TRUE”.

Tip 2: VMware is adhering to Microsoft’s requirement, which means Windows XP Mode in VMware will only works in premium editions of Windows 7, including Ultimate, Professional and Enterprise. In Windows 7 Home Basic, Windows 7 Home Premium, Windows Vista, Windows XP or Linux, the XP Mode is disabled, and user won’t even see the Import Windows XP Mode VM option.

Tip 3: Windows XP Mode must be installed in order for the Import Windows XP Mode option to be available.

Tip 4: To seamlessly integrate Windows XP Mode with host computer, install the VMware Tools. Once VMware Tools is installed, click on VM drop down menu on the Windows XP Mode VM window, and click on Enter Unity to enable seamless applications publishing from Windows XP Mode to Windows 7 host. A extra Windows XP Mode Start Menu to access programs in the XP Mode VM will be displayed above the Start button when user mouse hovers over Start button.

Tip 5: By default, all application software in Windows XP Mode will access, open and save to file location inside the virtual machine. To allow Windows XP Mode to open or save to folders in Windows 7 host computer, go to VM menu and select Settings. Go to Options tab, and select Shared Folders. Select the radio button for Always enabled, and tick the check box for Map as a network drive in Windows guests. Then, click on Add button and follow the Add Shared Folder wizard to share folder.