Merge pull request #91 from kernelwernel/dev

pre-1.5 update

Author: kernelwernel

README.md

@@ -15,7 +15,7 @@ The library is:
 - Very easy to use, with only 5 functions in its public interface
 - Cross-platform (Windows + MacOS + Linux)
 - Compatible with x86 and ARM, with backwards compatibility for 32-bit systems
-- Features up to 80+ unique VM detection techniques
+- Features up to 80+ unique VM detection techniques ([list](https://github.com/kernelwernel/VMAware/blob/main/docs/documentation.md#flag-table))
 - Very flexible, with total fine-grained control over which techniques get executed
 - Header-only
 - Available with C++11 and above
@@ -114,10 +114,10 @@ You can view the full docs [here](docs/documentation.md). Trust me, it's not too
 > Yes. There are some techniques that are trivially spoofable, and there's nothing the library can do about it whether it's a deliberate false positive or even a false negative. This is a problem that every VM detection project is facing, which is why the library is trying to test every technique possible to get the best result based on the environment it's running under. 
 
 - What about using this for malware?
-> This project is not soliciting the development of malware for obvious reasons. Even if you intend to use it for concealment purposes, it'll most likely be flagged by antiviruses anyway and nothing is obfuscated to begin with. You're not a slick l33t haxxor for abusing the library for malware, and good luck manually obfuscating 6000 lines of C++ code lmfao
+> This project is not soliciting the development of malware for obvious reasons. Even if you intend to use it for concealment purposes, it'll most likely be flagged by antiviruses anyway and nothing is obfuscated to begin with. You're not a slick l33t edgel0rd h4xx0r for abusing the library for malicious shit, you're just a fucking moron. Good luck manually obfuscating over 7000 lines of C++ code lmfao
 
 - Why GPL 3.0 and MIT? 
-> I would've made it strictly MIT so proprietary software can make use of the library, but some of the techniques employed are from GPL 3.0 projects, and I have no choice but to use the same license for legal reasons. This gave me an idea to make an MIT version without all of the GPL code so it can also be used without forcing your code to be open-source. It should be noted that the MIT version removes **10** techniques out of 85 (as of 1.3 version), and the lesser the number of mechanisms, the less accurate the overall result might be.
+> I would've made it strictly MIT so proprietary software can make use of the library, but some of the techniques employed are from GPL 3.0 projects, and I have no choice but to use the same license for legal reasons. This gave me an idea to make an MIT version without all of the GPL code so it can also be used without forcing your code to be open-source. It should be noted that the MIT version removes **10** techniques out of 85 (as of 1.4 version), and the lesser the number of mechanisms, the less accurate the overall result might be.
 
 - The tool has many false positives under a Windows 11 host, why?
 > This is because it is in fact running under a VM. More specifically, Hyper-V might be used by default for every program that's running in Windows 11. 

auxiliary/test_standards.sh

@@ -0,0 +1,22 @@
+#
+# ██╗   ██╗███╗   ███╗ █████╗ ██╗    ██╗ █████╗ ██████╗ ███████╗
+# ██║   ██║████╗ ████║██╔══██╗██║    ██║██╔══██╗██╔══██╗██╔════╝
+# ██║   ██║██╔████╔██║███████║██║ █╗ ██║███████║██████╔╝█████╗  
+# ╚██╗ ██╔╝██║╚██╔╝██║██╔══██║██║███╗██║██╔══██║██╔══██╗██╔══╝  
+#  ╚████╔╝ ██║ ╚═╝ ██║██║  ██║╚███╔███╔╝██║  ██║██║  ██║███████╗
+#   ╚═══╝  ╚═╝     ╚═╝╚═╝  ╚═╝ ╚══╝╚══╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝
+# 
+#  C++ VM detection library
+# 
+# ===============================================================
+#
+# This script is designed to test different C++ standards to see
+# if there are any edgecases before releasing it
+# 
+# ===============================================================
+# 
+#  - Made by: @kernelwernel (https://github.com/kernelwernel)
+#  - Repository: https://github.com/kernelwernel/VMAware
+#  - License: GPL 3.0
+
+

docs/documentation.md

@@ -33,7 +33,7 @@ int main() {
      * a single technique, use VM::check() instead. Also, read the flag table
      * at the end of this doc file for a full list of technique flags.
      */
-    bool is_vm2 = VM::detect(VM::BRAND | VM::MAC | VM::HYPERV_BIT);
+    bool is_vm2 = VM::detect(VM::BRAND, VM::MAC, VM::HYPERV_BIT);
 
 
     /**
@@ -53,7 +53,7 @@ int main() {
      * from the public interface a single time in total, so no unneccessary 
      * caching will be operated when you're not going to re-use the previous result. 
      */ 
-    bool is_vm4 = VM::detect(VM::ALL | VM::NO_MEMO);
+    bool is_vm4 = VM::detect(VM::ALL, VM::NO_MEMO);
 
 
     /**
@@ -254,16 +254,16 @@ VM::add_custom(50, new_technique);
 VMAware provides a convenient way to not only check for VMs, but also have the flexibility and freedom for the end-user to choose what techniques are used with complete control over what gets executed or not. This is handled with a flag system.
 
 
-| Flag alias | Description | Cross-platform? | Certainty | Admin? | GPL-3.0? | 32-bit? |
+| Flag alias | Description | Cross-platform? (empty = yes) | Certainty | Admin? | GPL-3.0? | 32-bit? |
 | ---------- | ----------- | --------------- | --------- | ------ | -------- | ------- |
-| `VM::VMID` | Check if the CPU manufacturer ID matches that of a VM brand | Yes | 100% |  |  |  |
-| `VM::BRAND` | Check if the CPU brand string contains any indications of VM keywords | Yes | 50% |  |  |  |
-| `VM::HYPERVISOR_BIT` | Check if the hypervisor bit is set (always false on physical CPUs) | Yes | 100% |  |  |  |
-|`VM::CPUID_0X4` | Check if there are any leaf values between 0x40000000 and 0x400000FF that changes the CPUID output | Yes | 70% |  |  |  |
-| `VM::HYPERVISOR_STR` | Check if brand string length is long enough (would be around 2 characters in a host machine while it's longer in a hypervisor) | Yes | 45% |  |  |  |
+| `VM::VMID` | Check if the CPU manufacturer ID matches that of a VM brand |  | 100% |  |  |  |
+| `VM::BRAND` | Check if the CPU brand string contains any indications of VM keywords |  | 50% |  |  |  |
+| `VM::HYPERVISOR_BIT` | Check if the hypervisor bit is set (always false on physical CPUs) |  | 100% |  |  |  |
+|`VM::CPUID_0X4` | Check if there are any leaf values between 0x40000000 and 0x400000FF that changes the CPUID output |  | 70% |  |  |  |
+| `VM::HYPERVISOR_STR` | Check if brand string length is long enough (would be around 2 characters in a host machine while it's longer in a hypervisor) |  | 45% |  |  |  |
 | `VM::RDTSC` | Benchmark RDTSC and evaluate its speed, usually it's very slow in VMs | Linux and Windows | 10% |  |  |  |
 | `VM::SIDT5` | Check if the 5th byte after sidt is null | Linux | 45% |  |  |  |
-| `VM::THREADCOUNT` | Check if there are only 1 or 2 threads, which is a common pattern in VMs with default settings (nowadays physical CPUs should have at least 4 threads for modern CPUs) | Yes | 35% |  |  |  |
+| `VM::THREADCOUNT` | Check if there are only 1 or 2 threads, which is a common pattern in VMs with default settings (nowadays physical CPUs should have at least 4 threads for modern CPUs) |  | 35% |  |  |  |
 | `VM::MAC` | Check if the system's MAC address matches with preset values for certain VMs | Linux and Windows | 90% |  |  |  |
 | `VM::TEMPERATURE` | Check for the presence of CPU temperature sensors (mostly not present in VMs) | Linux | 15% |    |  |
 | `VM::SYSTEMD` | Get output from systemd-detect-virt tool | Linux | 70% |  |  |  |
@@ -293,12 +293,12 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
 | `VM::LINUX_USER_HOST` | Check for default VM username and hostname for linux | Linux | 25% |  |  |  |
 | `VM::VBOX_WINDOW_CLASS` | Check for the window class for VirtualBox | Windows | 10% |  | GPL |  |
 | `VM::GAMARUE` | Check for Gamarue ransomware technique which compares VM-specific Window product IDs | Windows | 40% |  |  |  |
-| `VM::VMID_0X4` | Check if the CPU manufacturer ID matches that of a VM brand with leaf 0x40000000 | Yes | 100% |  |  |  |
+| `VM::VMID_0X4` | Check if the CPU manufacturer ID matches that of a VM brand with leaf 0x40000000 |  | 100% |  |  |  |
 | `VM::PARALLELS_VM` | Check for indications of Parallels VM | Windows | 50% |  |  |  |
-| `VM::RDTSC_VMEXIT` | Check for RDTSC technique with VMEXIT | Yes | 50% |  |  |  |
+| `VM::RDTSC_VMEXIT` | Check for RDTSC technique with VMEXIT |  | 50% |  |  |  |
 | `VM::LOADED_DLLS` | Check for DLLs of multiple VM brands | Windows | 75% |  | GPL |  |
-| `VM::QEMU_BRAND` | Check for QEMU CPU brand with cpuid | Yes | 100% |  |  |  |
-| `VM::BOCHS_CPU` | Check for Bochs cpuid emulation oversights | Yes | 95% |  |  |  |
+| `VM::QEMU_BRAND` | Check for QEMU CPU brand with cpuid |  | 100% |  |  |  |
+| `VM::BOCHS_CPU` | Check for Bochs cpuid emulation oversights |  | 95% |  |  |  |
 | `VM::VPC_BOARD` | Check for VPC specific string in motherboard manufacturer | Windows | 20% |  |  |  |
 | `VM::HYPERV_WMI` | Check for Hyper-V wmi output | Windows | 80% |  |  |  |
 | `VM::HYPERV_REG` | Check for Hyper-V strings in registry | Windows | 80% |  |  |  |
@@ -338,10 +338,10 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
 | `VM::VMWARE_PORT_MEM` | Check for VMware memory using IO port backdoor | Windows | 85% |  |  | 32-bit |
 | `VM::SMSW` | Check for SMSW assembly instruction technique | Windows | 30% |  |  | 32-bit |
 | `VM::MUTEX` | Check for mutex strings of VM brands | Windows | 85% |  |  |  |
-| `VM::UPTIME` | Check if uptime is less than or equal to 2 minutes | Yes | 10% |  |  |  |
-| `VM::ODD_CPU_THREADS` | Check if the CPU has an odd number of CPU threads | Yes | 80% |  |  |  |
-| `VM::INTEL_THREAD_MISMATCH` | Check if Intel "i series" CPUs have mismatched thread counts based on a database of threads on models | Yes | 85% |  |  |  |
-| `VM::XEON_THREAD_MISMATCH` | Check if Intel Xeon CPUs have mismatched threads (same as above technique) | Yes | 85% |  |  |  |
+| `VM::UPTIME` | Check if uptime is less than or equal to 2 minutes |  | 10% |  |  |  |
+| `VM::ODD_CPU_THREADS` | Check if the CPU has an odd number of CPU threads |  | 80% |  |  |  |
+| `VM::INTEL_THREAD_MISMATCH` | Check if Intel "i series" CPUs have mismatched thread counts based on a database of threads on models |  | 85% |  |  |  |
+| `VM::XEON_THREAD_MISMATCH` | Check if Intel Xeon CPUs have mismatched threads (same as above technique) |  | 85% |  |  |  |
 
 
 <br>