Skip to content

Commit 40564cf

Browse files
author
Requiem
committed
style: updated architecture clauses
1 parent df1e912 commit 40564cf

1 file changed

Lines changed: 47 additions & 60 deletions

File tree

‎src/vmaware.hpp‎

Lines changed: 47 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -4169,9 +4169,7 @@ struct VM {
41694169
* @implements VM::TIMER
41704170
*/
41714171
[[nodiscard]] static bool timer() {
4172-
#if (ARM || !x86)
4173-
return false;
4174-
#else
4172+
#if (x86)
41754173
if (util::is_running_under_translator()) {
41764174
debug("TIMER: Running inside a binary translation layer");
41774175
return false;
@@ -4182,9 +4180,9 @@ struct VM {
41824180
}
41834181

41844182
#if (WINDOWS)
4185-
const HANDLE th = GetCurrentThread();
4183+
const HANDLE hCurrentThread = reinterpret_cast<HANDLE>(-2LL);
41864184
const DWORD_PTR wantedMask = (DWORD_PTR)1;
4187-
const DWORD_PTR prevMask = SetThreadAffinityMask(th, wantedMask);
4185+
const DWORD_PTR prevMask = SetThreadAffinityMask(hCurrentThread, wantedMask);
41884186
#endif
41894187

41904188
// Case A - Hypervisor without RDTSC patch
@@ -4342,16 +4340,16 @@ struct VM {
43424340
debug("TIMER: RDTSC -> ", firstRatio, ", QIT -> ", secondRatio, ", Ratio: ", difference);
43434341

43444342
if (prevMask != 0) {
4345-
SetThreadAffinityMask(th, prevMask);
4343+
SetThreadAffinityMask(hCurrentThread, prevMask);
43464344
}
43474345

43484346
if (difference > 10) {
43494347
return true; // both ratios will always differ if a RDTSC trap is present, since the hypervisor can't account for the XOR/NOP loop
43504348
}
43514349
// TLB flushes or side channel cache attacks are not even tried due to how ineffective they are against stealthy hypervisors
43524350
#endif
4353-
return false;
43544351
#endif
4352+
return false;
43554353
}
43564354

43574355
#if (LINUX)
@@ -5368,7 +5366,7 @@ struct VM {
53685366
* @implements VM::SIDT
53695367
*/
53705368
[[nodiscard]] static bool sidt() {
5371-
#if (LINUX && (GCC || CLANG))
5369+
#if (LINUX && (GCC || CLANG) && x86)
53725370
u8 values[10] = { 0 };
53735371

53745372
fflush(stdout);
@@ -5398,15 +5396,15 @@ struct VM {
53985396
#else
53995397
return false;
54005398
#endif
5401-
#elif (WINDOWS)
5399+
#elif (WINDOWS && x86)
54025400
SYSTEM_INFO si;
54035401
GetNativeSystemInfo(&si);
5404-
54055402
DWORD_PTR originalMask = 0;
5403+
const HANDLE hCurrentThread = reinterpret_cast<HANDLE>(-2LL);
54065404

54075405
for (DWORD i = 0; i < si.dwNumberOfProcessors; ++i) {
54085406
const DWORD_PTR mask = (DWORD_PTR)1 << i;
5409-
const DWORD_PTR previousMask = SetThreadAffinityMask(GetCurrentThread(), mask);
5407+
const DWORD_PTR previousMask = SetThreadAffinityMask(hCurrentThread, mask);
54105408

54115409
if (previousMask == 0) {
54125410
continue;
@@ -5449,14 +5447,14 @@ struct VM {
54495447
debug("SIDT: VPC/Hyper-V signature detected on core %u", i);
54505448

54515449
if (originalMask != 0) {
5452-
SetThreadAffinityMask(GetCurrentThread(), originalMask);
5450+
SetThreadAffinityMask(hCurrentThread, originalMask);
54535451
}
54545452
return core::add(brands::VPC);
54555453
}
54565454
}
54575455

54585456
if (originalMask != 0) {
5459-
SetThreadAffinityMask(GetCurrentThread(), originalMask);
5457+
SetThreadAffinityMask(hCurrentThread, originalMask);
54605458
}
54615459

54625460
return false;
@@ -5493,7 +5491,9 @@ struct VM {
54935491
* @implements VM::GENERAL_HOSTNAME
54945492
*/
54955493
[[nodiscard]] static bool general_hostname() {
5496-
std::string hostname = util::get_hostname();
5494+
const std::string hostname = util::get_hostname();
5495+
5496+
debug("GENERAL_HOSTNAME: ", hostname);
54975497

54985498
auto cmp = [&](const char* str2) -> bool {
54995499
return (hostname == str2);
@@ -6314,7 +6314,7 @@ struct VM {
63146314

63156315
#if (LINUX || APPLE)
63166316
/**
6317-
* @brief Check if there are only 1 or 2 threads, which is a common pattern in VMs with default settings (nowadays physical CPUs should have at least 4 threads for modern CPUs
6317+
* @brief Check if there are only 1 or 2 threads, which is a common pattern in VMs with default settings, nowadays physical CPUs should have at least 4 threads for modern CPUs
63186318
* @category x86 (ARM might have very low thread counts, which is why it should be only for x86)
63196319
* @implements VM::THREAD_COUNT
63206320
*/
@@ -6649,7 +6649,6 @@ struct VM {
66496649
#if (_WIN32_WINNT < _WIN32_WINNT_WIN8)
66506650
return false;
66516651
#else
6652-
66536652
__try {
66546653
BOOL isNativeVhdBoot = 0;
66556654
// we dont call NtQuerySystemInformation with SystemPrefetchPathInformation | SystemHandleInformation
@@ -6844,8 +6843,8 @@ struct VM {
68446843
* @implements VM::VPC_INVALID
68456844
*/
68466845
[[nodiscard]] static bool vpc_invalid() {
6847-
#if (x86_32 && !CLANG)
68486846
bool rc = false;
6847+
#if (x86_32 && !CLANG)
68496848

68506849
auto IsInsideVPC_exceptionFilter = [](PEXCEPTION_POINTERS ep) -> DWORD {
68516850
PCONTEXT ctx = ep->ContextRecord;
@@ -6883,11 +6882,8 @@ struct VM {
68836882
__except (IsInsideVPC_exceptionFilter(GetExceptionInformation())) {
68846883
rc = false;
68856884
}
6886-
6887-
return rc;
6888-
#else
6889-
return false;
68906885
#endif
6886+
return rc;
68916887
}
68926888

68936889

@@ -6902,12 +6898,12 @@ struct VM {
69026898
#if (x86)
69036899
SYSTEM_INFO si;
69046900
GetNativeSystemInfo(&si);
6905-
69066901
DWORD_PTR originalMask = 0;
6902+
const HANDLE hCurrentThread = reinterpret_cast<HANDLE>(-2LL);
69076903

69086904
for (DWORD i = 0; i < si.dwNumberOfProcessors; ++i) {
69096905
const DWORD_PTR mask = (DWORD_PTR)1 << i;
6910-
const DWORD_PTR previousMask = SetThreadAffinityMask(GetCurrentThread(), mask);
6906+
const DWORD_PTR previousMask = SetThreadAffinityMask(hCurrentThread, mask);
69116907

69126908
if (previousMask == 0) {
69136909
continue;
@@ -6956,7 +6952,7 @@ struct VM {
69566952
}
69576953

69586954
if (originalMask != 0) {
6959-
SetThreadAffinityMask(GetCurrentThread(), originalMask);
6955+
SetThreadAffinityMask(hCurrentThread, originalMask);
69606956
}
69616957
#endif
69626958
return found;
@@ -6972,16 +6968,17 @@ struct VM {
69726968
* @implements VM::SLDT
69736969
*/
69746970
[[nodiscard]] static bool sldt() {
6971+
bool found = false;
69756972
#if (x86_32)
69766973
SYSTEM_INFO si;
69776974
GetNativeSystemInfo(&si);
6978-
const DWORD_PTR origMask = SetThreadAffinityMask(GetCurrentThread(), 1);
6979-
SetThreadAffinityMask(GetCurrentThread(), origMask);
6975+
const HANDLE hCurrentThread = reinterpret_cast<HANDLE>(-2LL);
6976+
const DWORD_PTR origMask = SetThreadAffinityMask(hCurrentThread, 1);
6977+
SetThreadAffinityMask(hCurrentThread, origMask);
69806978

6981-
bool found = false;
69826979
for (DWORD i = 0; i < si.dwNumberOfProcessors; ++i) {
69836980
const DWORD_PTR mask = (DWORD_PTR)1 << i;
6984-
if (SetThreadAffinityMask(GetCurrentThread(), mask) == 0)
6981+
if (SetThreadAffinityMask(hCurrentThread, mask) == 0)
69856982
continue;
69866983

69876984
u8 ldtr_buf[4] = { 0xEF, 0xBE, 0xAD, 0xDE };
@@ -7013,11 +7010,9 @@ struct VM {
70137010
break;
70147011
}
70157012

7016-
SetThreadAffinityMask(GetCurrentThread(), origMask);
7017-
return found;
7018-
#else
7019-
return false;
7013+
SetThreadAffinityMask(hCurrentThread, origMask);
70207014
#endif
7015+
return found;
70217016
}
70227017

70237018

@@ -7028,9 +7023,7 @@ struct VM {
70287023
* @implements VM::SMSW
70297024
*/
70307025
[[nodiscard]] static bool smsw() {
7031-
#if (!x86_64)
7032-
return false;
7033-
#elif (x86_32)
7026+
#if (x86_32)
70347027
u32 reax = 0;
70357028

70367029
__asm
@@ -7066,9 +7059,11 @@ struct VM {
70667059
if ((tr & 0xFF) == 0x00 && ((tr >> 8) & 0xFF) == 0x40) {
70677060
return core::add(brands::VMWARE);
70687061
}
7069-
#endif
70707062

70717063
return false;
7064+
#else
7065+
return false;
7066+
#endif
70727067
}
70737068

70747069

@@ -7080,13 +7075,13 @@ struct VM {
70807075
* @implements VM::VMWARE_BACKDOOR
70817076
*/
70827077
[[nodiscard]] static bool vmware_backdoor() {
7078+
bool is_vm = false;
70837079
#if (x86_32 && !CLANG)
70847080
u32 a = 0;
70857081
u32 b = 0;
70867082

70877083
constexpr std::array<i16, 2> ioports = { { 'VX' , 'VY' } };
70887084
i16 ioport;
7089-
bool is_vm = false;
70907085

70917086
for (u8 i = 0; i < ioports.size(); ++i) {
70927087
ioport = ioports[i];
@@ -7121,18 +7116,15 @@ struct VM {
71217116

71227117
if (is_vm) {
71237118
switch (b) {
7124-
case 1: return core::add(brands::VMWARE_EXPRESS);
7125-
case 2: return core::add(brands::VMWARE_ESX);
7126-
case 3: return core::add(brands::VMWARE_GSX);
7127-
case 4: return core::add(brands::VMWARE_WORKSTATION);
7128-
default: return core::add(brands::VMWARE);
7119+
case 1: return core::add(brands::VMWARE_EXPRESS);
7120+
case 2: return core::add(brands::VMWARE_ESX);
7121+
case 3: return core::add(brands::VMWARE_GSX);
7122+
case 4: return core::add(brands::VMWARE_WORKSTATION);
7123+
default: return core::add(brands::VMWARE);
71297124
}
71307125
}
7131-
7132-
return false;
7133-
#else
7134-
return false;
71357126
#endif
7127+
return is_vm;
71367128
}
71377129

71387130

@@ -8485,9 +8477,9 @@ struct VM {
84858477

84868478
CONTEXT origCtx{};
84878479
origCtx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
8488-
const HANDLE thrHandle = GetCurrentThread();
8480+
const HANDLE hCurrentThread = reinterpret_cast<HANDLE>(-2LL);
84898481

8490-
if (!NT_SUCCESS(pNtGetContextThread(thrHandle, &origCtx))) {
8482+
if (!NT_SUCCESS(pNtGetContextThread(hCurrentThread, &origCtx))) {
84918483
PVOID freeBase = execMem; SIZE_T freeSize = trampSize;
84928484
pNtFreeVirtualMemory(hCurrentProcess, &freeBase, &freeSize, MEM_RELEASE);
84938485
return false;
@@ -8499,8 +8491,8 @@ struct VM {
84998491
dbgCtx.Dr0 = baseAddr + 11; // single step breakpoint address
85008492
dbgCtx.Dr7 = 1; // enable local breakpoint 0
85018493

8502-
if (!NT_SUCCESS(pNtSetContextThread(thrHandle, &dbgCtx))) {
8503-
pNtSetContextThread(thrHandle, &origCtx);
8494+
if (!NT_SUCCESS(pNtSetContextThread(hCurrentThread, &dbgCtx))) {
8495+
pNtSetContextThread(hCurrentThread, &origCtx);
85048496
PVOID freeBase = execMem; SIZE_T freeSize = trampSize;
85058497
pNtFreeVirtualMemory(hCurrentProcess, &freeBase, &freeSize, MEM_RELEASE);
85068498
return false;
@@ -8540,11 +8532,10 @@ struct VM {
85408532
}
85418533
}
85428534

8543-
pNtSetContextThread(thrHandle, &origCtx);
8535+
pNtSetContextThread(hCurrentThread, &origCtx);
85448536

85458537
PVOID freeBase = execMem; SIZE_T freeSize = trampSize;
85468538
pNtFreeVirtualMemory(hCurrentProcess, &freeBase, &freeSize, MEM_RELEASE);
8547-
85488539
#endif
85498540
return hypervisorCaught;
85508541
}
@@ -8556,8 +8547,6 @@ struct VM {
85568547
* @implements VM::UD
85578548
*/
85588549
[[nodiscard]] static bool ud() {
8559-
bool saw_ud = false;
8560-
85618550
#if (x86)
85628551
// ud2; ret
85638552
constexpr u8 ud_opcodes[] = { 0x0F, 0x0B, 0xC3 };
@@ -8571,9 +8560,10 @@ struct VM {
85718560
constexpr u8 ud_opcodes[] = { 0x00, 0x00, 0x40, 0xD4, 0xC0, 0x03, 0x5F, 0xD6 };
85728561
#else
85738562
// architecture not supported by this check
8574-
return saw_ud;
8563+
return false;
85758564
#endif
85768565

8566+
bool saw_ud = false;
85778567
const HMODULE ntdll = util::get_ntdll();
85788568
if (!ntdll) return false;
85798569

@@ -9384,6 +9374,7 @@ struct VM {
93849374
* @implements VM::CPU_HEURISTIC
93859375
*/
93869376
[[nodiscard]] static bool cpu_heuristic() {
9377+
bool spoofed = false;
93879378
#if (x86)
93889379
if (util::is_running_under_translator()) {
93899380
debug("CPU_HEURISTIC: Running inside a binary translation layer");
@@ -9507,7 +9498,6 @@ struct VM {
95079498
return false; // Zhaoxin? VIA/Centaur?
95089499
}
95099500

9510-
bool spoofed = false;
95119501
bool proceed = true;
95129502
bool exception = false;
95139503

@@ -9640,11 +9630,8 @@ struct VM {
96409630
pNtFreeVirtualMemory(hCurrentProcess, &freeBase, &freeSize, MEM_RELEASE);
96419631
amd_target_mem = nullptr;
96429632
}
9643-
9644-
return spoofed;
9645-
#else
9646-
return false;
96479633
#endif
9634+
return spoofed;
96489635
}
96499636

96509637

0 commit comments

Comments
 (0)