Skip to content

Commit eaf62bd

Browse files
committed
updated docs
1 parent 7f0acab commit eaf62bd

File tree

3 files changed

+40
-34
lines changed

3 files changed

+40
-34
lines changed

TODO.md

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,20 @@
1-
- [ ] add C++20 concepts for the VM::add_custom() function
2-
- [ ] add c++20 module support
31
- [ ] upload the lib to dnf
42
- [ ] upload the lib to apt
5-
- [ ] make a man file in markdown for the cli tool
63
- [ ] implement techniques from here https://stackoverflow.com/questions/43026032/detect-running-on-virtual-machine
74
- [ ] check if bios date in /sys/class/dmi/id/ could be useful under QEMU
8-
- [ ] add a .so, .dll, and .dylib shared object files in the release
95
- [ ] /sys/class/dmi/id/product_name check this in qemu
10-
- [ ] fix "dmidecode not found" error
116
- [ ] implement techniques from here https://www.cyberciti.biz/faq/linux-determine-virtualization-technology-command/
127
- [ ] implement techniques from virt-what
13-
- implement empty /sys/class dirs:
14-
- iommu
15-
- power_supply
16-
- check for presence of /dev/virtio-ports dir
17-
- replace all thread mismatch techniques to C style arrays
18-
8+
- [ ] implement empty /sys/class dirs:
9+
- [ ] iommu
10+
- [ ] power_supply
11+
- [ ] check for presence of /dev/virtio-ports dir
12+
- [ ] add the library to conan.io
13+
- [ ] add a reliable ci/cd for the debug binary
14+
- [ ] add an extra faq on ignoring false negatives and virtual devices on host
15+
- [ ] research 86box and pcem detection vectors
1916

2017
# Distant plans
21-
- add the library to conan.io when released
2218
- add a python version of the library (or any other lang for that matter)
2319
- add a GUI version of the lib
2420
- add a rust version of the lib

docs/documentation.md

Lines changed: 30 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@
1010
- [`VM::conclusion()`](#vmconclusion)
1111
- [`VM::detected_count()`](#vmdetected_count)
1212
- [`VM::is_hardened()`](#vmis_hardened)
13-
- [`(advanced) VM::flag_to_string()`](#vmflag_to_string)
14-
- [`(advanced) VM::detected_enums()`](#vmdetected_enums)
13+
- [`(Advanced) VM::flag_to_string()`](#advanced-vmflag_to_string)
14+
- [`(Advanced) VM::detected_enums()`](#advanced-vmdetected_enums)
1515
- [vmaware struct](#vmaware-struct)
1616
- [Notes and overall things to avoid](#notes-and-overall-things-to-avoid)
1717
- [Flag table](#flag-table)
@@ -25,7 +25,7 @@
2525

2626
## `VM::detect()`
2727

28-
This is basically the main function you're looking for, which returns a bool. If no parameter is provided, all the recommended checks will be performed. But you can optionally set what techniques are used.
28+
This is basically the main function you're looking for, which returns a bool. If no parameter is provided, all the recommended checks will be performed. But you can optionally set which techniques are used.
2929

3030
```cpp
3131
#include "vmaware.hpp"
@@ -46,10 +46,9 @@ int main() {
4646

4747
/**
4848
* All checks are performed including techniques that are
49-
* disabled by default for a viariety of reasons. There are
50-
* around 5 technique that are disabled. If you want all
51-
* techniques for the sake of completeness, then you can use
52-
* this flag but remember that there may be potential
49+
* disabled by default for a viariety of reasons. If you
50+
* want all techniques for the sake of completeness, then
51+
* you can use this flag but remember that there may be potential
5352
* performance bottlenecks and an increase in false positives.
5453
*/
5554
bool is_vm3 = VM::detect(VM::ALL);
@@ -99,7 +98,7 @@ int main() {
9998
<br>
10099

101100
## `VM::percentage()`
102-
This will return a `std::uint8_t` between 0 and 100. It'll return the certainty of whether it has detected a VM based on all the techniques available as a percentage. The lower the value, the less chance it's a VM. The higher the value, the more likely it is.
101+
This will return a `std::uint8_t` between 0 and 100. It'll return the certainty of whether it has detected a VM based on all the techniques available as a percentage.
103102

104103
```cpp
105104
#include "vmaware.hpp"
@@ -118,8 +117,8 @@ int main() {
118117
std::cout << "Unsure if it's a VM\n";
119118
}
120119

121-
// converted to std::uint32_t for console character encoding reasons
122-
std::cout << "percentage: " << static_cast<std::uint32_t>(percent) << "%\n";
120+
// converted to int for console character encoding reasons
121+
std::cout << "percentage: " << static_cast<int>(percent) << "%\n";
123122

124123
return 0;
125124
}
@@ -322,22 +321,18 @@ This will detect whether the environment has any hardening indications as a `boo
322321

323322
Internally, this function works by analysing which combination of techniques are expected to be detected together. If a certain combination rule is mismatched, it indicates some kind of tampering of the system which assumes some sort of VM hardening.
324323

325-
326-
> [!WARNING]
327-
> This function should **NOT** be depended on for critical code. This is still a beta feature that hasn't been widely stress-tested as of 2.5.0. It works more as a heuristic assumption rather than a concrete guarantee.
324+
Similiary to `VM::brand()`, do not rely on this function for critical operations. This is meant to be a heuristic assumption rather than a concrete guarantee.
328325

329326

330327
```cpp
331328
#include "vmaware.hpp"
332329
#include <iostream>
333330

334331
int main() {
335-
if (VM::detect()) {
336-
if (VM::is_hardened()) {
337-
std::cout << "Potential hardening detected" << "\n";
338-
} else {
339-
std::cout << "Unsure if hardened" << "\n";
340-
}
332+
if (VM::is_hardened()) {
333+
std::cout << "Potential hardening detected" << "\n";
334+
} else {
335+
std::cout << "Unsure if hardened" << "\n";
341336
}
342337

343338
return 0;
@@ -346,8 +341,13 @@ int main() {
346341

347342
<br>
348343

349-
## `VM::flag_to_string()`
344+
## (Advanced) `VM::flag_to_string()`
345+
346+
<details>
347+
<summary>Show</summary>
348+
350349
This will take a technique flag enum as an argument and return the string version of it. For example:
350+
351351
```cpp
352352
#include "vmaware.hpp"
353353
#include <iostream>
@@ -362,7 +362,7 @@ int main() {
362362
}
363363
```
364364

365-
The reason why this exists is because it can be useful for debugging purposes. It should be noted that the "VM::" part is not included in the string output, so that's based on the programmer's choice if it should remain in the string or not. The example given above is obviously useless since the whole code can be manually handwritten, but the function is especially convenient if it's being used with [`VM::technique_vector`](#variables). For example:
365+
The reason why this exists is because it can be useful for debugging and infodumping purposes. It should be noted that the "VM::" part is not included in the string output, so that's based on the programmer's choice if it should remain in the string or not. The example given above is obviously useless since the whole code can be manually handwritten, but the function is especially convenient if it's being used with [`VM::technique_vector`](#variables). For example:
366366

367367
```cpp
368368
#include "vmaware.hpp"
@@ -382,9 +382,15 @@ int main() {
382382
}
383383
```
384384

385+
</details>
386+
385387
<br>
386388

387-
## `VM::detected_enums()`
389+
## (Advanced) `VM::detected_enums()`
390+
391+
<details>
392+
<summary>Show</summary>
393+
388394
This is a function that will return a vector of all the technique flags that were detected as running in a VM. The return type is `std::vector<VM::enum_flags>`, and it's designed to give a more programmatic overview of the result.
389395

390396
```cpp
@@ -402,6 +408,8 @@ int main() {
402408
}
403409
```
404410

411+
</details>
412+
405413
<br>
406414

407415
# vmaware struct

src/vmaware.hpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12426,6 +12426,8 @@ struct VM {
1242612426
* @return bool
1242712427
*/
1242812428
static bool is_hardened() {
12429+
// this lambda basically detects whether a technique has found a brand.
12430+
// Might rewrite this or redesign the whole concept behind it, this is really janky.
1242912431
auto detected_brand = [](const enum_flags flag) -> const char* {
1243012432
memo::uncache(flag);
1243112433

0 commit comments

Comments
 (0)