|
4 | 4 | * ██║ ██║██╔████╔██║███████║██║ █╗ ██║███████║██████╔╝█████╗ |
5 | 5 | * ╚██╗ ██╔╝██║╚██╔╝██║██╔══██║██║███╗██║██╔══██║██╔══██╗██╔══╝ |
6 | 6 | * ╚████╔╝ ██║ ╚═╝ ██║██║ ██║╚███╔███╔╝██║ ██║██║ ██║███████╗ |
7 | | - * ╚═══╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝ Experimental post-2.5.0 (January 2026) |
| 7 | + * ╚═══╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝ 2.6.0 (January 2026) |
8 | 8 | * |
9 | 9 | * C++ VM detection library |
10 | 10 | * |
|
23 | 23 | * - Teselka (https://github.com/Teselka) |
24 | 24 | * - Kyun-J (https://github.com/Kyun-J) |
25 | 25 | * - luukjp (https://github.com/luukjp) |
| 26 | + * - Lorenzo Rizzotti (https://github.com/Dreaming-Codes) |
26 | 27 | * - Repository: https://github.com/kernelwernel/VMAware |
27 | 28 | * - Docs: https://github.com/kernelwernel/VMAware/docs/documentation.md |
28 | 29 | * - Full credits: https://github.com/kernelwernel/VMAware#credits-and-contributors-%EF%B8%8F |
@@ -6166,9 +6167,9 @@ struct VM { |
6166 | 6167 | /** |
6167 | 6168 | * @brief Check for default Azure hostname format (Azure uses Hyper-V as their base VM brand) |
6168 | 6169 | * @category Windows, Linux |
6169 | | - * @implements VM::HYPERV_HOSTNAME |
| 6170 | + * @implements VM::AZURE |
6170 | 6171 | */ |
6171 | | - [[nodiscard]] static bool hyperv_hostname() { |
| 6172 | + [[nodiscard]] static bool azure() { |
6172 | 6173 | std::string hostname; |
6173 | 6174 |
|
6174 | 6175 | #if (WINDOWS) |
@@ -10171,31 +10172,6 @@ struct VM { |
10171 | 10172 | else if (var_name_view == L"KEKDefault") (void)read_variable_to_buffer(std::wstring(var_name_view), current_var->VendorGuid, kek_default_buf, kek_default_len); |
10172 | 10173 | else if (var_name_view == L"KEK") (void)read_variable_to_buffer(std::wstring(var_name_view), current_var->VendorGuid, kek_buf, kek_len); |
10173 | 10174 |
|
10174 | | - if (var_name_view == L"Boot0000") { // should be Windows Boot Manager |
10175 | | - BYTE* boot_buf = nullptr; SIZE_T boot_len = 0; |
10176 | | - if (read_variable_to_buffer(var_name_view, current_var->VendorGuid, boot_buf, boot_len)) { |
10177 | | - bool anomaly = (boot_len < 6); |
10178 | | - if (!anomaly) { |
10179 | | - unsigned short fpl_len = 0; |
10180 | | - memcpy(&fpl_len, boot_buf + 4, sizeof(fpl_len)); |
10181 | | - // we could also check if loadOptionsLength is 136 |
10182 | | - if (fpl_len != 116) anomaly = true; |
10183 | | - } |
10184 | | - |
10185 | | - if (boot_buf) { |
10186 | | - PVOID b_ptr = boot_buf; SIZE_T z_sz = 0; |
10187 | | - nt_free_memory(current_process_handle, &b_ptr, &z_sz, 0x8000); |
10188 | | - } |
10189 | | - |
10190 | | - if (anomaly) { |
10191 | | - debug("NVRAM: Environment was loaded using a virtual boot loader"); // "virtual" here -> non genuine |
10192 | | - detection_result = true; |
10193 | | - should_break_loop = true; |
10194 | | - break; |
10195 | | - } |
10196 | | - } |
10197 | | - } |
10198 | | - |
10199 | 10175 | if (current_var->NextEntryOffset == 0) break; |
10200 | 10176 | const SIZE_T next_entry_off = static_cast<SIZE_T>(current_var->NextEntryOffset); |
10201 | 10177 | const size_t next_var_offset = current_offset + next_entry_off; |
@@ -12718,7 +12694,7 @@ std::array<VM::core::technique, VM::enum_size + 1> VM::core::technique_table = [ |
12718 | 12694 | {VM::FIRMWARE, {100, VM::firmware}}, |
12719 | 12695 | {VM::PCI_DEVICES, {95, VM::pci_devices}}, |
12720 | 12696 | {VM::SIDT, {50, VM::sidt}}, |
12721 | | - {VM::AZURE, {30, VM::hyperv_hostname}}, |
| 12697 | + {VM::AZURE, {30, VM::azure}}, |
12722 | 12698 | #endif |
12723 | 12699 |
|
12724 | 12700 | #if (LINUX) |
|
0 commit comments