Merge pull request #712 from NotRequiem/main

Windows CLI fixes and other improvements

Author: NotRequiem

src/cli/globals.hpp

@@ -41,6 +41,7 @@ enum arg_enum : u8 {
     DETECTED_ONLY,
     JSON,
     RICH,
+    EXPERIMENTAL,
     NULL_ARG,
 };
 
@@ -59,6 +60,6 @@ extern std::string tag_no_perms;
 extern std::string tag_notes;
 
 // increment this each time a new argument is introduced
-constexpr std::size_t arg_count = 34;
+constexpr std::size_t arg_count = 35;
 
 using arg_table = std::array<std::pair<const char*, arg_enum>, arg_count>;

src/cli/main.cpp

@@ -35,9 +35,9 @@
 #include "wagner_fischer.hpp"
 
 #if (CLI_WINDOWS)
-    #include "windows_tui.hpp"
-    #include <windows.h>
-    #include <shellapi.h>
+#include "windows_tui.hpp"
+#include <windows.h>
+#include <shellapi.h>
 #endif
 
 constexpr const char* ver = "2.7.0";
@@ -68,6 +68,7 @@ R"(Usage:
  --high-threshold   a higher threshold bar for a VM detection will be applied (2x higher)
  --no-ansi          removes color and ansi escape codes from the output
  --dynamic          allow the conclusion message to be dynamic (8 possibilities instead of only 2)
+ --experimental     disable experimental techniques
  --verbose          add more information to the output
  --enums            display the technique enum name used by the lib
  --detected-only    only display the techniques that were detected
@@ -178,7 +179,17 @@ int main(int argc, char* argv[]) {
         }
     }
 
-    if (rich_requested) {
+    bool already_spawned = false;
+    char env_buf[16];
+    if (GetEnvironmentVariableA("VMAWARE_SPAWNED", env_buf, sizeof(env_buf)) > 0) {
+        if (std::strcmp(env_buf, "1") == 0) {
+            already_spawned = true;
+        }
+    }
+
+    if (rich_requested && !already_spawned) {
+        SetEnvironmentVariableA("VMAWARE_SPAWNED", "1");
+
         char exePath[MAX_PATH];
         GetModuleFileNameA(NULL, exePath, MAX_PATH);
 
@@ -187,9 +198,6 @@ int main(int argc, char* argv[]) {
 
         std::string args = "\"" + std::string(exePath) + "\"";
         for (int i = 1; i < argc; ++i) {
-            if (std::strcmp(argv[i], "--rich") == 0) {
-                continue;
-            }
             args += " \"";
             args += argv[i];
             args += "\"";
@@ -249,6 +257,7 @@ int main(int argc, char* argv[]) {
         { "--disable-notes", NOTES },
         { "--high-threshold", HIGH_THRESHOLD },
         { "--dynamic", DYNAMIC },
+        { "--experimental", EXPERIMENTAL },
         { "--verbose", VERBOSE },
         { "--enums", ENUMS },
         { "--no-ansi", NO_ANSI },

src/cli/output.cpp

@@ -2,6 +2,7 @@
 #include "output.hpp"
 #include "windows_tui.hpp"
 #include "globals.hpp"
+#include "sha256.hpp" 
 
 #include <chrono>
 #include <iomanip>
@@ -218,60 +219,6 @@ const char* get_vm_description(const std::string& vm_brand) {
     return "";
 }
 
-#if (CLI_WINDOWS)
-// Run a single technique in a worker thread and wait up to TECHNIQUE_TIMEOUT_MS.
-// Returns {result, timed_out}.  On timeout the flag is pushed to
-// VM::disabled_techniques so the VM::vmaware constructor won't re-run it.
-static constexpr DWORD TECHNIQUE_TIMEOUT_MS = 3000;
-
-struct win_run_result { bool result; bool timed_out; };
-
-static win_run_result win_run_technique(const VM::enum_flags flag) {
-    struct runner_t {
-        VM::enum_flags flag;
-        bool result = false;
-        static DWORD WINAPI run(LPVOID lp) noexcept {
-            auto* self = static_cast<runner_t*>(lp);
-            self->result = VM::check(self->flag);
-            return 0;
-        }
-    };
-
-    runner_t runner { 
-        flag, 
-        false 
-    };
-
-    HANDLE h = CreateThread(nullptr, 0, runner_t::run, &runner, 0, nullptr);
-    if (!h) {
-        return { 
-            VM::check(flag), 
-            false 
-        };
-    }
-
-    if (WaitForSingleObject(h, TECHNIQUE_TIMEOUT_MS) == WAIT_TIMEOUT) {
-        TerminateThread(h, 0);
-        CloseHandle(h);
-        VM::disabled_techniques.push_back(flag);
-        std::cerr << "[TIMEOUT] VM::" << VM::flag_to_string(flag)
-                  << " did not finish within " << (TECHNIQUE_TIMEOUT_MS / 1000)
-                  << "s, skipping\n" << std::flush;
-
-        return { 
-            false, 
-            true 
-        };
-    }
-
-    CloseHandle(h);
-    return { 
-        runner.result, 
-        false
-    };
-}
-#endif
-
 static void checker(const VM::enum_flags flag, const char* message) {
     std::string enum_name;
 
@@ -298,13 +245,7 @@ static void checker(const VM::enum_flags flag, const char* message) {
 
     auto start_time = std::chrono::high_resolution_clock::now();
 
-#if (CLI_WINDOWS)
-    const win_run_result wres = win_run_technique(flag);
-    if (wres.timed_out) { return; }
-    const bool result = wres.result;
-#else
     const bool result = VM::check(flag);
-#endif
 
     auto end_time = std::chrono::high_resolution_clock::now();
 
@@ -380,19 +321,6 @@ bool parse_disable_token(const char* token) {
 }
 
 void generate_json(const char* output) {
-#if (CLI_WINDOWS)
-    // Warm the memo cache with per-technique timeouts before constructing
-    // VM::vmaware, so that any technique that hangs (e.g. CPU_HEURISTIC on
-    // Azure Hyper-V) is aborted and disabled rather than blocking indefinitely.
-    for (u8 i = VM::technique_begin; i < static_cast<u8>(VM::technique_end); ++i) {
-        const VM::enum_flags flag = static_cast<VM::enum_flags>(i);
-        if (is_disabled(flag) || is_unsupported(flag)) { 
-            continue; 
-        }
-        win_run_technique(flag);
-    }
-#endif
-
     const VM::vmaware vm(VM::MULTIPLE);
 
     std::vector<std::string> json;
@@ -617,7 +545,6 @@ void general(bool high_threshold, bool all, bool dynamic, const char* output_fil
     checker(VM::CUCKOO_PIPE, "Cuckoo pipe");
     checker(VM::AZURE, "Azure Hyper-V");
     checker(VM::DISPLAY, "display");
-    checker(VM::DEVICE_STRING, "bogus device string");
     checker(VM::BLUESTACKS_FOLDERS, "BlueStacks folders");
     checker(VM::CPUID_SIGNATURE, "CPUID signatures");
     checker(VM::KGT_SIGNATURE, "Intel KGT signature");
@@ -653,7 +580,6 @@ void general(bool high_threshold, bool all, bool dynamic, const char* output_fil
     checker(VM::MAC_SYS, "system profiler");
     checker(VM::KERNEL_OBJECTS, "kernel objects");
     checker(VM::NVRAM, "NVRAM");
-    checker(VM::EDID, "EDID");
     checker(VM::CLOCK, "system timers");
     checker(VM::MSR, "model specific registers");
     checker(VM::CPU_HEURISTIC, "instruction capabilities");
@@ -671,6 +597,10 @@ void general(bool high_threshold, bool all, bool dynamic, const char* output_fil
     const VM::vmaware vm(VM::MULTIPLE, high_thresh_arg, all_arg, dynamic_arg);
     std::vector<std::string> summary;
 
+#if defined(__VMAWARE_DEBUG__)
+    std::cout << grey << "SHA-256: " << white << compute_self_sha256() << ansi_exit << "\n";
+#endif
+
     const std::string brand = vm.brand;
     const bool is_red = ((brand == VM::brands::NULL_BRAND) || (brand == VM::brands::HYPERV_ROOT));
     summary.push_back(bold + "\nVM brand: " + ansi_exit + (is_red ? red : green) + brand + ansi_exit);
@@ -844,13 +774,25 @@ void general(bool high_threshold, bool all, bool dynamic, const char* output_fil
             std::cout << l << "\n";
         }
     }
+
+    #if defined(__VMAWARE_DEBUG__)
+        std::cout << grey << "SHA-256: " << white << compute_self_sha256() << ansi_exit << "\n";
+    #endif
+
 #else
+
     for (const auto& line : summary) {
         std::cout << line << "\n";
     }
 
+    #if defined(__VMAWARE_DEBUG__)
+        std::cout << grey << "SHA-256: " << white << compute_self_sha256() << ansi_exit << "\n";
+    #endif
+
     if (original_cout_buf) {
         std::cout.rdbuf(original_cout_buf);
     }
+
 #endif
+
 }