Skip to content

Commit 03ccc28

Browse files
committed
chore: renamed VM::TPM to VM::MEASURED_BOOT for accuracy
1 parent 85bf853 commit 03ccc28

3 files changed

Lines changed: 15 additions & 12 deletions

File tree

docs/documentation.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -589,7 +589,7 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
589589
| `VM::SVM_EXCEPTIONS` | Check whether a hypervisor leaks EFER.SVME into guest context via SVM instruction fault type | 🪟 | 150% | | | | [link](https://github.com/NotRequiem/VMAware/tree/main/src/vmaware.hpp#L12707) |
590590
| `VM::CGROUP` | Check for cgroup paths in /proc/self/cgroup | 🐧 | 70% | | | | [link](https://github.com/NotRequiem/VMAware/tree/main/src/vmaware.hpp#L7043) |
591591
| `VM::HYPERV_NESTED` | Check whether a hypervisor is nested within a Hyper-V partition | 🪟 | 100% | | | | [link](https://github.com/NotRequiem/VMAware/tree/main/src/vmaware.hpp#L12846) |
592-
| `VM::TPM` | Check measured boot logs exported by the TPM | 🪟 | 100% | | | | [link](https://github.com/NotRequiem/VMAware/tree/main/src/vmaware.hpp#L12856) |
592+
| `VM::MEASURED_BOOT` | Check measured boot logs exported by the TPM | 🪟 | 100% | | | | [link](https://github.com/NotRequiem/VMAware/tree/main/src/vmaware.hpp#L12856) |
593593
<!-- END OF TECHNIQUE DOCUMENTATION -->
594594
595595
<br>

src/cli/output.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -615,7 +615,7 @@ void general(bool high_threshold, bool all, bool dynamic, const char* output_fil
615615
checker(VM::SVM_EXCEPTIONS, "SVM exceptions");
616616
checker(VM::CGROUP, "cgroup namespace");
617617
checker(VM::HYPERV_NESTED, "nested virtualization");
618-
checker(VM::TPM, "TPM");
618+
checker(VM::MEASURED_BOOT, "Measured boot logs");
619619
checker(VM::TIMER, "timing anomalies");
620620

621621
const auto t2 = std::chrono::high_resolution_clock::now();

src/vmaware.hpp

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -492,7 +492,7 @@ struct VM {
492492
EIP_OVERFLOW,
493493
SVM_EXCEPTIONS,
494494
HYPERV_NESTED,
495-
TPM,
495+
MEASURED_BOOT,
496496

497497
// Linux and Windows
498498
SYSTEM_REGISTERS,
@@ -675,7 +675,7 @@ struct VM {
675675
static u16 technique_count; // get total number of techniques
676676

677677
static std::vector<enum_flags> disabled_techniques;
678-
static constexpr std::array<enum_flags, 1> experimental_techniques{ { TPM } };
678+
static constexpr std::array<enum_flags, 1> experimental_techniques{ { TPM_PASSTHROUGH } };
679679

680680
#if (WINDOWS)
681681
using brand_score_t = i32;
@@ -12888,9 +12888,9 @@ struct VM {
1288812888
/**
1288912889
* @brief Check measured boot logs exported by the TPM
1289012890
* @category Windows
12891-
* @implements VM::TPM
12891+
* @implements VM::MEASURED_BOOT
1289212892
*/
12893-
[[nodiscard]] static bool tpm() {
12893+
[[nodiscard]] static bool measured_boot() {
1289412894
using TBS_RESULT = UINT32;
1289512895
using TBS_HCONTEXT = void*;
1289612896

@@ -12959,7 +12959,7 @@ struct VM {
1295912959
const u8* pBuffer = log_data.data();
1296012960
const size_t total_size = log_data.size();
1296112961

12962-
// Validate the mandatory Spec ID Event header (legacy format)
12962+
// validate Spec ID Event header (legacy format)
1296312963
const TCG_PCR_EVENT_HEADER first_hdr = read_hdr(pBuffer);
1296412964
if (first_hdr.pcrIndex != 0 || first_hdr.eventType != 0x00000003 /* EV_NO_ACTION */) {
1296512965
return false;
@@ -13002,7 +13002,7 @@ struct VM {
1300213002
}
1300313003
};
1300413004

13005-
// Move pointer to sequential crypto-agile TCG_PCR_EVENT2 items
13005+
// move pointer to sequential crypto-agile TCG_PCR_EVENT2 items
1300613006
size_t current_offset = first_event_data_offset + spec_id_size;
1300713007

1300813008
while (current_offset < total_size) {
@@ -13058,7 +13058,7 @@ struct VM {
1305813058

1305913059
if (pcrIndex == 0 && eventType == 0x00000008) {
1306013060
if (eventSize == 2 && payload[0] == 0x00 && payload[1] == 0x00) {
13061-
debug("TPM: Detected null payload");
13061+
debug("MEASURED_BOOT: Detected null payload");
1306213062
return true;
1306313063
}
1306413064
}
@@ -13070,7 +13070,7 @@ struct VM {
1307013070

1307113071
if ((base_addr == 0x830000 && blob_len == 0xD0000) ||
1307213072
(base_addr == 0x900000 && blob_len == 0xE80000)) {
13073-
debug("TPM: Detected OVMF's memory bounds of the SEC and PEI execution phases");
13073+
debug("MEASURED_BOOT: Detected OVMF's memory bounds of the SEC and PEI execution phases");
1307413074
return true;
1307513075
}
1307613076
}
@@ -13142,6 +13142,9 @@ struct VM {
1314213142
FreeLibrary(hTbs);
1314313143
return vm_detected;
1314413144
}
13145+
13146+
13147+
1314513148
// ADD NEW TECHNIQUE FUNCTION HERE
1314613149

1314713150
#if (CLANG)
@@ -13906,7 +13909,7 @@ struct VM {
1390613909
case SVM_EXCEPTIONS: return "SVM_EXCEPTIONS";
1390713910
case CGROUP: return "CGROUP";
1390813911
case HYPERV_NESTED: return "HYPERV_NESTED";
13909-
case TPM: return "TPM";
13912+
case MEASURED_BOOT: return "MEASURED_BOOT";
1391013913
// END OF TECHNIQUE LIST
1391113914
case DEFAULT: return "DEFAULT";
1391213915
case ALL: return "ALL";
@@ -14430,7 +14433,7 @@ std::array<VM::core::technique, VM::enum_size + 1> VM::core::technique_table = [
1443014433
{VM::TRAP, {100, VM::trap}},
1443114434
{VM::KVM_INTERCEPTION, {150, VM::kvm_interception}},
1443214435
{VM::SVM_EXCEPTIONS, {150, VM::svm_exceptions}},
14433-
{VM::TPM, {100, VM::tpm}},
14436+
{VM::MEASURED_BOOT, {100, VM::measured_boot}},
1443414437
{VM::INTERRUPT_SHADOW, {100, VM::interrupt_shadow}},
1443514438
{VM::EIP_OVERFLOW, {100, VM::eip_overflow}},
1443614439
{VM::HYPERVISOR_HOOK, {100, VM::hypervisor_hook}},

0 commit comments

Comments
 (0)