Skip to content

Commit 034961b

Browse files
kernelwernelkernelwernel
authored
Merge pull request #292 from kernelwernel/dev
2.1 merge
2 parents cf4d614 + 8327502 commit 034961b

File tree

7 files changed

+1261
-817
lines changed

7 files changed

+1261
-817
lines changed

‎TODO.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
- [ ] update the updater.py script and fix it
2424
- [ ] @thereisnospoon this is where we need to start modifing the qemu source further by replacing vendor/device ids.
2525
https://www.pcilookup.com/
26+
- [ ] https://wasm.in/threads/testy-v-vmware.35315/#post-444576
2627

2728
QEMU default: 0x1234
2829
Intel: 0x8086

‎auxiliary/add_technique.py‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ def __init__(self, enum_name, file_path, function_name, cross_platform, is_linux
5454
self.notes = notes
5555

5656

57+
# there's like some really weird shit going on with \t, so i'm doing it manually
58+
tab = " "
5759

5860

5961
def prompt():
@@ -215,7 +217,7 @@ def write_header(options):
215217
if options.is_gpl:
216218
new_code.append("/* GPL */ " + options.enum_name + ",\n")
217219
else:
218-
new_code.append("\t\t" + options.enum_name + ",\n")
220+
new_code.append(tab + tab + options.enum_name + ",\n")
219221
update_count += 1
220222

221223

@@ -292,7 +294,7 @@ def write_header(options):
292294
if all(sub in technique_line for sub in preprocessors):
293295
new_code.append(technique_line.lstrip())
294296
else:
295-
new_code.append("\t" + technique_line)
297+
new_code.append(tab + technique_line)
296298

297299

298300
# extra lines
@@ -315,7 +317,7 @@ def write_header(options):
315317
)
316318
else:
317319
new_code.append(
318-
"\t" +
320+
tab +
319321
"{ VM::" +
320322
options.enum_name +
321323
", { " +
@@ -330,7 +332,8 @@ def write_header(options):
330332
# modify the VM::flag_to_string function with the new technique
331333
if "// ADD NEW CASE HERE FOR NEW TECHNIQUE" in line:
332334
new_code.append(
333-
"\t\t\tcase " +
335+
tab + tab + tab +
336+
"case " +
334337
options.enum_name +
335338
": return \"" +
336339
options.enum_name +
@@ -368,7 +371,8 @@ def write_cli(options):
368371
# modify the checklist with the newly appended technique here
369372
if "// ADD NEW TECHNIQUE CHECKER HERE" in line:
370373
new_code.append(
371-
"\tchecker(VM::" +
374+
tab +
375+
"checker(VM::" +
372376
options.enum_name +
373377
", \"" +
374378
options.short_description +
@@ -377,15 +381,15 @@ def write_cli(options):
377381

378382
if "// ADD LINUX FLAG" in line:
379383
if options.is_linux:
380-
new_code.append("\t\t\tcase VM::" + options.enum_name + ":\n")
384+
new_code.append(tab + tab + tab + "case VM::" + options.enum_name + ":\n")
381385

382386
if "// ADD WINDOWS FLAG" in line:
383387
if options.is_win:
384-
new_code.append("\t\t\tcase VM::" + options.enum_name + ":\n")
388+
new_code.append(tab + tab + tab + "case VM::" + options.enum_name + ":\n")
385389

386390
if "// ADD MACOS FLAG" in line:
387391
if options.is_mac:
388-
new_code.append("\t\t\tcase VM::" + options.enum_name + ":\n")
392+
new_code.append(tab + tab + tab + "case VM::" + options.enum_name + ":\n")
389393

390394
# add the line in the buffer array
391395
new_code.append(line)

‎auxiliary/vmtest.cpp‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,10 @@ int main(void) {
2828
//const bool test2 = VM::detect(VM::ALL);
2929
//const bool test3 = VM::detect(VM::DEFAULT);
3030
//const bool test4 = VM::detect(VM::DEFAULT, VM::ALL);
31-
const bool test4 = VM::detect(VM::DISABLE(VM::TIMER));
32-
const bool test5 = VM::detect(VM::DEFAULT, VM::DISABLE(VM::TIMER));
33-
const bool test6 = VM::detect(VM::DEFAULT, VM::DISABLE(VM::TIMER, VM::GPU));
34-
//const bool test7 = VM::detect(VM::NO_MEMO, VM::EXTREME, VM::MULTIPLE, VM::ENABLE_HYPERV_HOST);
31+
//const bool test5 = VM::detect(VM::DISABLE(VM::TIMER));
32+
//const bool test6 = VM::detect(VM::DEFAULT, VM::HIGH_THRESHOLD, VM::DISABLE(VM::TIMER));
33+
//const bool test7 = VM::detect(VM::DEFAULT, VM::DISABLE(VM::TIMER, VM::GPU));
3534
//const std::string test8 = VM::brand();
36-
//const uint8_t test9 = VM::percentage(VM::SPOOFABLE);
3735
//std::cout << (int)test9 << "\n";
3836

3937
//VM::vmaware vm;

‎docs/documentation.md‎

Lines changed: 109 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -42,31 +42,22 @@ int main() {
4242

4343
/**
4444
* All checks are performed including spoofable techniques
45-
* and a few other techniques that are disabled by default,
46-
* one of which is VM::CURSOR which waits 5 seconds for any
47-
* human mouse interaction to detect automated virtual environments.
48-
* If you're fine with having a 5 second delay, add VM::ALL
45+
* and a few other techniques that are disabled by default
46+
* for a variety of reasons. Only 1 or 2 techniques are
47+
* disabled by default, and this flag will include both of
48+
* them. This isn't the default due to potential instability
49+
* concerns, but if that's fine for you then use this flag
50+
* for the sake of completeness.
4951
*/
5052
bool is_vm3 = VM::detect(VM::ALL);
5153

5254

53-
/**
54-
* If you don't want the value to be memoized for whatever reason,
55-
* you can set the VM::NO_MEMO flag and the result will not be cached.
56-
* It's recommended to use this flag if you're only using one function
57-
* from the public interface a single time in total, so no unneccessary
58-
* caching will be operated when you're not going to re-use the previously
59-
* stored result at the end.
60-
*/
61-
bool is_vm4 = VM::detect(VM::NO_MEMO);
62-
63-
6455
/**
6556
* This will set the threshold bar to detect a VM higher than the default threshold.
6657
* Use this if you want to be extremely sure if it's a VM, but this can risk the result
6758
* to be a false negative. Use VM::percentage() for a more precise result if you want.
6859
*/
69-
bool is_vm5 = VM::detect(VM::HIGH_THRESHOLD);
60+
bool is_vm4 = VM::detect(VM::HIGH_THRESHOLD);
7061

7162

7263
/**
@@ -76,30 +67,39 @@ int main() {
7667
* a single technique, use VM::check() instead. Also, read the flag table
7768
* at the end of this doc file for a full list of technique flags.
7869
*/
79-
bool is_vm6 = VM::detect(VM::CPU_BRAND, VM::MAC, VM::HYPERVISOR_BIT);
70+
bool is_vm5 = VM::detect(VM::CPU_BRAND, VM::MAC, VM::HYPERVISOR_BIT);
8071

8172

8273
/**
8374
* If you want to disable any technique for whatever reason, use VM::DISABLE(...).
8475
* This code snippet essentially means "perform all the default flags, but only
8576
* disable the VM::RDTSC technique".
8677
*/
87-
bool is_vm7 = VM::detect(VM::DISABLE(VM::RDTSC));
78+
bool is_vm6 = VM::detect(VM::DISABLE(VM::RDTSC));
8879

8980

9081
/**
9182
* Same as above, but you can disable multiple techniques at the same time.
9283
*/
93-
bool is_vm8 = VM::detect(VM::DISABLE(VM::VMID, VM::RDTSC, VM::HYPERVISOR_BIT));
84+
bool is_vm7 = VM::detect(VM::DISABLE(VM::VMID, VM::RDTSC, VM::HYPERVISOR_BIT));
85+
86+
87+
/**
88+
* If you don't want the value to be memoized for whatever reason,
89+
* you can set the VM::NO_MEMO flag and the result will not be cached.
90+
* It's recommended to use this flag if you're only using one function
91+
* from the public interface a single time in total, so no unneccessary
92+
* caching will be operated when you're not going to re-use the previously
93+
* stored result at the end.
94+
*/
95+
bool is_vm8 = VM::detect(VM::NO_MEMO);
9496

9597

9698
/**
9799
* This is just an example to show that you can use a combination of
98100
* different flags and non-technique flags with the above examples.
99101
*/
100102
bool is_vm9 = VM::detect(VM::NO_MEMO, VM::HIGH_THRESHOLD, VM::DISABLE(VM::RDTSC, VM::VMID));
101-
102-
return 0;
103103
}
104104
```
105105

@@ -295,7 +295,25 @@ The `[brand]` part might contain a brand or may as well be empty, depending on w
295295
<br>
296296

297297
## `VM::detected_count()`
298-
This will fetch the number of techniques that have been detected as a `std::uint8_t`. Can't get any more simpler than that ¯\_(ツ)_/¯, how's your day btw?
298+
This will fetch the number of techniques that have been detected as a `std::uint8_t`. Can't get any more simpler than that.
299+
```cpp
300+
#include "vmaware.hpp"
301+
#include <iostream>
302+
303+
int main() {
304+
const std::uint8_t count = VM::detected_count();
305+
306+
// output: 7 techniques were detected
307+
std::cout << count << " techniques were detected" << "\n";
308+
309+
// note that if it's baremetal, it should be 0.
310+
// if it's a VM, it should have at least 4 to
311+
// maybe around 15 max. The most I've seen was
312+
// around 18 but that only occurs very rarely.
313+
314+
return 0;
315+
}
316+
```
299317

300318
<br>
301319

@@ -307,9 +325,9 @@ This will take a technique flag enum as an argument and return the string versio
307325

308326
int main() {
309327
const std::string name = VM::flag_to_string(VM::VMID);
328+
329+
// output: VM::VMID
310330
std::cout << "VM::" << name << "\n";
311-
// Output: VM::VMID
312-
// (nothing more, nothing less)
313331

314332
return 0;
315333
}
@@ -527,74 +545,74 @@ This is the table of all the brands the lib supports.
527545

528546
| String | Variable alias | VM type | Notes |
529547
| -------------- | ------ | ------- | ----- |
530-
| Unknown | `VM::brands::NULL_BRAND` | Unknown | This is the default brand it returns if none were found |
531-
| VirtualBox | `VM::brands::VBOX` | Hypervisor (type 2) | |
532-
| VMware | `VM::brands::VMWARE` | Hypervisor (type 2) | |
533-
| VMware Express | `VM::brands::VMWARE_EXPRESS` | Hypervisor (type 2) | |
534-
| VMware ESX | `VM::brands::VMWARE_ESX` | Hypervisor (type 1) | |
535-
| VMware GSX | `VM::brands::VMWARE_GSX` | Hypervisor (type 2) | |
536-
| VMware Workstation | `VM::brands::VMWARE_WORKSTATION` | Hypervisor (type 2) | |
537-
| VMware Fusion | `VM::brands::VMWARE_FUSION` | Hypervisor (type 2) | |
538-
| VMware (with VmwareHardenedLoader) | `VM::brands::VMWARE_HARD` | Hypervisor (type 2) | See the [repository](https://github.com/hzqst/VmwareHardenedLoader) |
539-
| bhyve | `VM::brands::BHYVE` | Hypervisor (type 2) | |
540-
| KVM | `VM::brands::KVM` | Hypervisor (type 1) | |
541-
| QEMU | `VM::brands::QEMU` | Emulator/Hypervisor (type 2) | |
542-
| QEMU+KVM | `VM::brands::QEMU_KVM` | Hypervisor (type 1) | |
543-
| KVM Hyper-V Enlightenment | `VM::brands::KVM_HYPERV` | Hypervisor (type 1) | |
544-
| QEMU+KVM Hyper-V Enlightenment | `VM::brands::QEMU_KVM_HYPERV` | Hypervisor (type 1) | |
545-
| Microsoft Hyper-V | `VM::brands::HYPERV` | Hypervisor (type 1) | |
546-
| Microsoft Virtual PC/Hyper-V | `VM::brands::HYPERV_VPC` | Hypervisor (either type 1 or 2) | |
547-
| Parallels | `VM::brands::PARALLELS` | Hypervisor (type 2) | |
548-
| Xen HVM | `VM::brands::XEN` | Hypervisor (type 1) | |
549-
| ACRN | `VM::brands::ACRN` | Hypervisor (type 1) | |
550-
| QNX hypervisor | `VM::brands::QNX` | Hypervisor (type 1) | |
551-
| Hybrid Analysis | `VM::brands::HYBRID` | Sandbox | |
552-
| Sandboxie | `VM::brands::SANDBOXIE` | Sandbox | |
553-
| Docker | `VM::brands::DOCKER` | Container | |
554-
| Wine | `VM::brands::WINE` | Compatibility layer | |
555-
| Virtual PC | `VM::brands::VPC` | Hypervisor (type 2) | |
556-
| Anubis | `VM::brands::ANUBIS` | Sandbox | |
557-
| JoeBox | `VM::brands::JOEBOX` | Sandbox | |
558-
| ThreatExpert | `VM::brands::THREATEXPERT` | Sandbox | |
559-
| CWSandbox | `VM::brands::CWSANDBOX` | Sandbox | |
560-
| Comodo | `VM::brands::COMODO` | Sandbox | |
561-
| Bochs | `VM::brands::BOCHS` | Emulator | |
562-
| NetBSD NVMM | `VM::brands::NVMM` | Hypervisor (type 2) | |
563-
| OpenBSD VMM | `VM::brands::BSD_VMM` | Hypervisor (type 2) | |
564-
| Intel HAXM | `VM::brands::INTEL_HAXM` | Hypervisor (type 1) | |
565-
| Unisys s-Par | `VM::brands::UNISYS` | Partitioning Hypervisor | |
566-
| Lockheed Martin LMHS | `VM::brands::LMHS` | Hypervisor (unknown type) | Yes, you read that right. The lib can detect VMs running on US military fighter jets, apparently |
567-
| Cuckoo | `VM::brands::CUCKOO` | Sandbox | |
568-
| BlueStacks | `VM::brands::BLUESTACKS` | Emulator | |
569-
| Jailhouse | `VM::brands::JAILHOUSE` | Partitioning Hypervisor | |
570-
| Apple VZ | `VM::brands::APPLE_VZ` | Unknown | |
571-
| Intel KGT (Trusty) | `VM::brands::INTEL_KGT` | Hypervisor (type 1) | |
572-
| Microsoft Azure Hyper-V | `VM::brands::AZURE_HYPERV` | Hypervisor (type 1) | |
573-
| Xbox NanoVisor (Hyper-V) | `VM::brands::NANOVISOR` | Hypervisor (type 1) | |
574-
| SimpleVisor | `VM::brands::SIMPLEVISOR` | Hypervisor (type 1) | |
575-
| Hyper-V artifact (not an actual VM) | `VM::brands::HYPERV_ARTIFACT` | Unknown | |
576-
| User-mode Linux | `VM::brands::UML` | Paravirtualised/Hypervisor (type 2) | |
577-
| IBM PowerVM | `VM::brands::POWERVM` | Hypervisor (type 1) | |
578-
| OpenStack (KVM) | `VM::brands::OPENSTACK` | Hypervisor (type 1) | |
579-
| KubeVirt (KVM) | `VM::brands::KUBEVIRT` | Hypervisor (type 1) | |
580-
| AWS Nitro System EC2 (KVM-based) | `VM::brands::AWS_NITRO` | Hypervisor (type 1) | |
581-
| Podman | `VM::brands::PODMAN` | Container | |
582-
| WSL | `VM::brands::WSL` | Hybrid Hyper-V (type 1 and 2) | The type is debatable, it's not exactly clear |
583-
| OpenVZ | `VM::brands::OPENVZ` | Container | |
548+
| Unknown | `brands::NULL_BRAND` | Unknown | This is the default brand it returns if none were found |
549+
| VirtualBox | `brands::VBOX` | Hypervisor (type 2) | |
550+
| VMware | `brands::VMWARE` | Hypervisor (type 2) | |
551+
| VMware Express | `brands::VMWARE_EXPRESS` | Hypervisor (type 2) | |
552+
| VMware ESX | `brands::VMWARE_ESX` | Hypervisor (type 1) | |
553+
| VMware GSX | `brands::VMWARE_GSX` | Hypervisor (type 2) | |
554+
| VMware Workstation | `brands::VMWARE_WORKSTATION` | Hypervisor (type 2) | |
555+
| VMware Fusion | `brands::VMWARE_FUSION` | Hypervisor (type 2) | |
556+
| VMware (with VmwareHardenedLoader) | `brands::VMWARE_HARD` | Hypervisor (type 2) | See the [repository](https://github.com/hzqst/VmwareHardenedLoader) |
557+
| bhyve | `brands::BHYVE` | Hypervisor (type 2) | |
558+
| KVM | `brands::KVM` | Hypervisor (type 1) | |
559+
| QEMU | `brands::QEMU` | Emulator/Hypervisor (type 2) | |
560+
| QEMU+KVM | `brands::QEMU_KVM` | Hypervisor (type 1) | |
561+
| KVM Hyper-V Enlightenment | `brands::KVM_HYPERV` | Hypervisor (type 1) | |
562+
| QEMU+KVM Hyper-V Enlightenment | `brands::QEMU_KVM_HYPERV` | Hypervisor (type 1) | |
563+
| Microsoft Hyper-V | `brands::HYPERV` | Hypervisor (type 1) | |
564+
| Microsoft Virtual PC/Hyper-V | `brands::HYPERV_VPC` | Hypervisor (either type 1 or 2) | |
565+
| Parallels | `brands::PARALLELS` | Hypervisor (type 2) | |
566+
| Xen HVM | `brands::XEN` | Hypervisor (type 1) | |
567+
| ACRN | `brands::ACRN` | Hypervisor (type 1) | |
568+
| QNX hypervisor | `brands::QNX` | Hypervisor (type 1) | |
569+
| Hybrid Analysis | `brands::HYBRID` | Sandbox | |
570+
| Sandboxie | `brands::SANDBOXIE` | Sandbox | |
571+
| Docker | `brands::DOCKER` | Container | |
572+
| Wine | `brands::WINE` | Compatibility layer | |
573+
| Virtual PC | `brands::VPC` | Hypervisor (type 2) | |
574+
| Anubis | `brands::ANUBIS` | Sandbox | |
575+
| JoeBox | `brands::JOEBOX` | Sandbox | |
576+
| ThreatExpert | `brands::THREATEXPERT` | Sandbox | |
577+
| CWSandbox | `brands::CWSANDBOX` | Sandbox | |
578+
| Comodo | `brands::COMODO` | Sandbox | |
579+
| Bochs | `brands::BOCHS` | Emulator | |
580+
| NetBSD NVMM | `brands::NVMM` | Hypervisor (type 2) | |
581+
| OpenBSD VMM | `brands::BSD_VMM` | Hypervisor (type 2) | |
582+
| Intel HAXM | `brands::INTEL_HAXM` | Hypervisor (type 1) | |
583+
| Unisys s-Par | `brands::UNISYS` | Partitioning Hypervisor | |
584+
| Lockheed Martin LMHS | `brands::LMHS` | Hypervisor (unknown type) | Yes, you read that right. The lib can detect VMs running on US military fighter jets, apparently |
585+
| Cuckoo | `brands::CUCKOO` | Sandbox | |
586+
| BlueStacks | `brands::BLUESTACKS` | Emulator | |
587+
| Jailhouse | `brands::JAILHOUSE` | Partitioning Hypervisor | |
588+
| Apple VZ | `brands::APPLE_VZ` | Unknown | |
589+
| Intel KGT (Trusty) | `brands::INTEL_KGT` | Hypervisor (type 1) | |
590+
| Microsoft Azure Hyper-V | `brands::AZURE_HYPERV` | Hypervisor (type 1) | |
591+
| Xbox NanoVisor (Hyper-V) | `brands::NANOVISOR` | Hypervisor (type 1) | |
592+
| SimpleVisor | `brands::SIMPLEVISOR` | Hypervisor (type 1) | |
593+
| Hyper-V artifact (not an actual VM) | `brands::HYPERV_ARTIFACT` | Unknown | |
594+
| User-mode Linux | `brands::UML` | Paravirtualised/Hypervisor (type 2) | |
595+
| IBM PowerVM | `brands::POWERVM` | Hypervisor (type 1) | |
596+
| OpenStack (KVM) | `brands::OPENSTACK` | Hypervisor (type 1) | |
597+
| KubeVirt (KVM) | `brands::KUBEVIRT` | Hypervisor (type 1) | |
598+
| AWS Nitro System EC2 (KVM-based) | `brands::AWS_NITRO` | Hypervisor (type 1) | |
599+
| Podman | `brands::PODMAN` | Container | |
600+
| WSL | `brands::WSL` | Hybrid Hyper-V (type 1 and 2) | The type is debatable, it's not exactly clear |
601+
| OpenVZ | `brands::OPENVZ` | Container | |
584602
| ANY.RUN | N/A | Sandbox | Removed from the lib, available only in the CLI |
585-
| Barevisor | `VM::brands::BAREVISOR` | Hypervisor (type 1) | |
586-
| HyperPlatform | `VM::brands::HYPERPLATFORM` | Hypervisor (type 1) | |
587-
| MiniVisor | `VM::brands::MINIVISOR` | Hypervisor (type 1) | |
588-
| Intel TDX | `VM::brands::INTEL_TDX` | Trusted Domain | |
589-
| LKVM | `VM::brands::LKVM` | Hypervisor (type 1) | |
590-
| AMD SEV | `VM::brands::AMD_SEV` | VM encryptor | |
591-
| AMD SEV-ES | `VM::brands::AMD_SEV_ES` | VM encryptor | |
592-
| AMD SEV-SNP | `VM::brands::AMD_SEV_SNP` | VM encryptor | |
593-
| Neko Project II | `VM::brands::NEKO_PROJECT` | Emulator | |
594-
| Google Compute Engine (KVM) | `VM::brands::GCE` | Cloud VM service | |
595-
| NoirVisor | `VM::brands::NOIRVISOR` | Hypervisor (type 1) | |
596-
| Qihoo 360 Sandbox | `VM::brands::QIHOO` | Sandbox | |
597-
| nsjail | `VM::brands::NSJAIL` | Process isolator | |
603+
| Barevisor | `brands::BAREVISOR` | Hypervisor (type 1) | |
604+
| HyperPlatform | `brands::HYPERPLATFORM` | Hypervisor (type 1) | |
605+
| MiniVisor | `brands::MINIVISOR` | Hypervisor (type 1) | |
606+
| Intel TDX | `brands::INTEL_TDX` | Trusted Domain | |
607+
| LKVM | `brands::LKVM` | Hypervisor (type 1) | |
608+
| AMD SEV | `brands::AMD_SEV` | VM encryptor | |
609+
| AMD SEV-ES | `brands::AMD_SEV_ES` | VM encryptor | |
610+
| AMD SEV-SNP | `brands::AMD_SEV_SNP` | VM encryptor | |
611+
| Neko Project II | `brands::NEKO_PROJECT` | Emulator | |
612+
| Google Compute Engine (KVM) | `brands::GCE` | Cloud VM service | |
613+
| NoirVisor | `brands::NOIRVISOR` | Hypervisor (type 1) | |
614+
| Qihoo 360 Sandbox | `brands::QIHOO` | Sandbox | |
615+
| nsjail | `brands::NSJAIL` | Process isolator | |
598616

599617
<br>
600618

0 commit comments

Comments
 (0)