fix: CFG indirect call trigger in hypervisor hook detection

Author: Requiem

src/cli/output.cpp

@@ -191,7 +191,7 @@ const char* get_vm_description(const std::string& vm_brand) {
         { VM::brands::INTEL_KGT, "Intel Kernel Guard Technology (KGT) is a policy specification and enforcement framework for ensuring runtime integrity of kernel and platform assets. Demonstrated secure enclaves for critical OS components using VT-x/EPT before being superseded by CET (Control-flow Enforcement Technology) and HyperGuard in Windows 10." },
         { VM::brands::AZURE_HYPERV, "Azure Hyper-V is Microsoft's cloud-optimized hypervisor variant powering Azure VMs. Implements Azure-specific virtual devices like NVMe Accelerated Networking and vTPMs. Supports nested virtualization for running Hyper-V/containers within Azure VMs, enabling cloud-based CI/CD pipelines and dev/test environments." },
         { VM::brands::SIMPLEVISOR, "SimpleVisor is a minimalist Intel VT-x hypervisor by Alex Ionescu for Windows/Linux research. Demonstrates EPT-based memory isolation and hypercall handling. Used to study VM escapes and hypervisor rootkits, with hooks for intercepting CR3 changes and MSR accesses." },
-        { VM::brands::HYPERV_ROOT, "VMAware detected Hyper-V operating as a type 1 hypervisor, not as a guest virtual machine. Although your hardware/firmware signatures match Microsoft's Hyper-V architecture, we determined that you're running on baremetal. This prevents false positives, as Windows sometimes runs under Hyper-V (type 1) hypervisor." },
+        { VM::brands::HYPERV_ROOT, "VMAware detected Hyper-V operating as a type 1 hypervisor, not as a guest virtual machine. This prevents false positives, as Windows sometimes runs under Hyper-V." },
         { VM::brands::UML, "User-Mode Linux (UML) allows running Linux kernels as user-space processes using ptrace-based virtualization. Primarily used for kernel debugging and network namespace testing. Offers lightweight isolation without hardware acceleration, but requires host/guest kernel version matching for stable operation." },
         { VM::brands::POWERVM, "IBM PowerVM is a type 1 hypervisor for POWER9/10 systems, supporting Live Partition Mobility and Shared Processor Pools. Implements VIOS (Virtual I/O Server) for storage/networking virtualization, enabling concurrent AIX, IBM i, and Linux workloads with RAS features like predictive failure analysis." },
         { VM::brands::GCE, "Google Compute Engine (GCE) utilizes KVM-based virtualization with custom Titanium security chips for hardware root of trust. Features live migration during host maintenance and shielded VMs with UEFI secure boot. Underpins Google Cloud's Confidential Computing offering using AMD SEV-SNP memory encryption." },

src/vmaware.hpp

@@ -505,7 +505,7 @@ namespace brands { // TODO, remove this in the 2.8.0 or any release after the 2.
     LEGACY(AZURE_HYPERV, "Microsoft Azure Hyper-V");
     LEGACY(SIMPLEVISOR, "SimpleVisor");
     // not in macro due to mismatch with VM::brands and brands:: renaming this to HYPERV_ROOT
-    [[deprecated("Use VM::brands::HYPERV_ROOT instead")]] static constexpr const char* HYPERV_ARTIFACT = "Hyper-V root partition (host system, not an actual VM)";
+    [[deprecated("Use VM::brands::HYPERV_ROOT instead")]] static constexpr const char* HYPERV_ARTIFACT = "Hyper-V root partition (host system)";
     LEGACY(UML, "User-mode Linux");
     LEGACY(POWERVM, "IBM PowerVM");
     LEGACY(GCE, "Google Compute Engine (KVM)");
@@ -4900,6 +4900,33 @@ struct VM {
 
             return got_any;
         }
+
+        // indirect call without CFG checks
+        #if (MSVC)
+            #define NO_CF_GUARD __declspec(guard(nocf)) __declspec(noinline)
+        #elif (CLANG)
+            #if __has_declspec_attribute(guard)
+                #define NO_CF_GUARD __declspec(guard(nocf)) __attribute__((noinline))
+            #elif __has_attribute(nocf_check)
+                #define NO_CF_GUARD __attribute__((nocf_check)) __attribute__((noinline))
+            #else
+                #define NO_CF_GUARD __attribute__((noinline))
+            #endif
+        #elif (GCC)
+            #if defined(__has_attribute) && __has_attribute(nocf_check)
+                #define NO_CF_GUARD __attribute__((nocf_check)) __attribute__((noinline))
+            #else
+                #define NO_CF_GUARD __attribute__((noinline))
+            #endif
+            #else
+                #define NO_CF_GUARD
+        #endif
+
+        // helper function to invoke pointers without instrumentation
+        NO_CF_GUARD static void execute_unchecked(void* pointer) {
+            using func_t = void(*)();
+            reinterpret_cast<func_t>(pointer)();
+        }
     #endif
     };
 
@@ -12411,8 +12438,7 @@ struct VM {
         using execute_throws_t = bool(*)(void*);
         execute_throws_t execute_throws = [](void* pointer) -> bool {
             __try {
-                using func_t = void(*)();
-                reinterpret_cast<func_t>(pointer)(); // breakpoint hit
+                util::execute_unchecked(pointer); // breakpoint hit
             }
             __except (EXCEPTION_EXECUTE_HANDLER) {
                 return true;
@@ -12542,8 +12568,7 @@ struct VM {
                 }
 
                 __try {
-                    using func_t = void(*)();
-                    reinterpret_cast<func_t>(pointer)();
+                    util::execute_unchecked(pointer);
                 }
                 __except (EXCEPTION_EXECUTE_HANDLER) {
                     did_anyone_throw = 1;