Skip to content

Commit ee2aa17

Browse files
NotRequiemNotRequiem
authored
Merge pull request #642 from NotRequiem/main
updated core, boot logo and power capabilities checks
2 parents d662c6a + 5988f37 commit ee2aa17

File tree

2 files changed

+36
-30
lines changed

2 files changed

+36
-30
lines changed

‎src/cli.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -941,7 +941,7 @@ static void general(
941941
checker(VM::IOREG_GREP, "IO registry grep");
942942
checker(VM::MAC_SIP, "MacOS SIP");
943943
checker(VM::AUDIO, "audio devices");
944-
checker(VM::DEVICE_HANDLES, "device handles");
944+
checker(VM::HANDLES, "device handles");
945945
checker(VM::VPC_INVALID, "VPC invalid instructions");
946946
checker(VM::SYSTEM_REGISTERS, "Task segment and descriptor tables");
947947
checker(VM::VMWARE_IOMEM, "/proc/iomem file");
@@ -986,7 +986,7 @@ static void general(
986986
checker(VM::FIRMWARE, "firmware");
987987
checker(VM::FILE_ACCESS_HISTORY, "low file access count");
988988
checker(VM::NSJAIL_PID, "nsjail PID");
989-
checker(VM::PCI_DEVICES, "PCI vendor/device ID");
989+
checker(VM::DEVICES, "PCI vendor/device ID");
990990
checker(VM::ACPI_SIGNATURE, "ACPI device signatures");
991991
checker(VM::TRAP, "hypervisor interception");
992992
checker(VM::UD, "undefined exceptions");

‎src/vmaware.hpp‎

Lines changed: 34 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -555,7 +555,7 @@ struct VM {
555555
DISK_SERIAL,
556556
IVSHMEM,
557557
DRIVERS,
558-
DEVICE_HANDLES,
558+
HANDLES,
559559
VIRTUAL_PROCESSORS,
560560
HYPERVISOR_QUERY,
561561
AUDIO,
@@ -586,7 +586,7 @@ struct VM {
586586
// Linux and Windows
587587
SYSTEM_REGISTERS,
588588
FIRMWARE,
589-
PCI_DEVICES,
589+
DEVICES,
590590
AZURE,
591591

592592
// Linux
@@ -6817,7 +6817,7 @@ struct VM {
68176817
* @brief Check for PCI vendor and device IDs that are VM-specific
68186818
* @link https://www.pcilookup.com/?ven=&dev=&action=submit
68196819
* @category Linux, Windows
6820-
* @implements VM::PCI_DEVICES
6820+
* @implements VM::DEVICES
68216821
*/
68226822
[[nodiscard]] static bool pci_devices() {
68236823
struct pci_device { u16 vendor_id; u32 device_id; };
@@ -7090,7 +7090,7 @@ struct VM {
70907090
case 0x1af41045: case 0x1af41048: case 0x1af41049: case 0x1af41050:
70917091
case 0x1af41052: case 0x1af41053: case 0x1af4105a: case 0x1af41100:
70927092
case 0x1af41110: case 0x1af41b36:
7093-
debug("PCI_DEVICES: Detected Red Hat + Virtio device -> ", std::hex, id32);
7093+
debug("DEVICES: Detected Red Hat + Virtio device -> 0x", std::hex, id32);
70947094
return true;
70957095

70967096
// VMware
@@ -7101,47 +7101,47 @@ struct VM {
71017101
case 0x0e0f0001: case 0x0e0f0002: case 0x0e0f0003: case 0x0e0f0004:
71027102
case 0x0e0f0005: case 0x0e0f0006: case 0x0e0f000a: case 0x0e0f8001:
71037103
case 0x0e0f8002: case 0x0e0f8003: case 0x0e0ff80a:
7104-
debug("PCI_DEVICES: Detected VMWARE device -> ", std::hex, id32);
7104+
debug("DEVICES: Detected VMWARE device -> 0x", std::hex, id32);
71057105
return core::add(brands::VMWARE);
71067106

71077107
// Red Hat + QEMU
71087108
case 0x1b360001: case 0x1b360002: case 0x1b360003: case 0x1b360004:
71097109
case 0x1b360005: case 0x1b360008: case 0x1b360009: case 0x1b36000b:
71107110
case 0x1b36000c: case 0x1b36000d: case 0x1b360010: case 0x1b360011:
71117111
case 0x1b360013: case 0x1b360100:
7112-
debug("PCI_DEVICES: Detected Red Hat + QEMU device -> ", std::hex, id32);
7112+
debug("DEVICES: Detected Red Hat + QEMU device -> 0x", std::hex, id32);
71137113
return core::add(brands::QEMU);
71147114

71157115
// QEMU
71167116
case 0x06270001: case 0x1d1d1f1f: case 0x80865845: case 0x1d6b0200:
7117-
debug("PCI_DEVICES: Detected QEMU device -> ", std::hex, id32);
7117+
debug("DEVICES: Detected QEMU device -> 0x", std::hex, id32);
71187118
return core::add(brands::QEMU);
71197119

71207120
// vGPUs (NVIDIA + others)
71217121
case 0x10de0fe7: case 0x10de0ff7: case 0x10de118d: case 0x10de11b0:
71227122
case 0x1ec6020f:
7123-
debug("PCI_DEVICES: Detected virtual gpu device -> ", std::hex, id32);
7123+
debug("DEVICES: Detected virtual gpu device -> 0x", std::hex, id32);
71247124
return true;
71257125

71267126
// VirtualBox
71277127
case 0x80ee0021: case 0x80ee0022: case 0x80eebeef: case 0x80eecafe:
7128-
debug("PCI_DEVICES: Detected VirtualBox device -> ", std::hex, id32);
7128+
debug("DEVICES: Detected VirtualBox device -> 0x", std::hex, id32);
71297129
return core::add(brands::VBOX);
71307130

71317131
// Parallels
71327132
case 0x1ab84000: case 0x1ab84005: case 0x1ab84006:
7133-
debug("PCI_DEVICES: Detected Parallels device -> ", std::hex, id32);
7133+
debug("DEVICES: Detected Parallels device -> 0x", std::hex, id32);
71347134
return core::add(brands::PARALLELS);
71357135

71367136
// Xen
71377137
case 0x5853c000: case 0xfffd0101: case 0x5853c147:
71387138
case 0x5853c110: case 0x5853c200: case 0x58530001:
7139-
debug("PCI_DEVICES: Detected Xen device -> ", std::hex, id32);
7139+
debug("DEVICES: Detected Xen device -> 0x", std::hex, id32);
71407140
return core::add(brands::XEN);
71417141

71427142
// Connectix (VirtualPC)
71437143
case 0x29556e61:
7144-
debug("PCI_DEVICES: Detected VirtualPC device -> ", std::hex, id32);
7144+
debug("DEVICES: Detected VirtualPC device -> 0x", std::hex, id32);
71457145
return core::add(brands::VPC);
71467146
}
71477147

@@ -7156,11 +7156,11 @@ struct VM {
71567156
case 0x0000000010131100ULL:
71577157
case 0x00000000106b1100ULL:
71587158
case 0x0000000010221100ULL:
7159-
debug("PCI_DEVICES: Detected QEMU device -> ", std::hex, id64);
7159+
debug("DEVICES: Detected QEMU device -> 0x", std::hex, id64);
71607160
return core::add(brands::QEMU);
71617161

71627162
case 0x0000000015ad0800ULL: // Hypervisor ROM Interface
7163-
debug("PCI_DEVICES: Detected Hypervisor ROM interface -> ", std::hex, id64);
7163+
debug("DEVICES: Detected Hypervisor ROM interface -> 0x", std::hex, id64);
71647164
return core::add(brands::VMWARE);
71657165
}
71667166
}
@@ -7665,9 +7665,9 @@ struct VM {
76657665
}
76667666

76677667
// could check for HKLM\\SYSTEM\\CurrentControlSet\\Control\\Power\\PlatformAoAcOverride
7668-
const bool no_sleep_states = !s0_supported && !s1_supported && !s2_supported && !s3_supported;
7668+
const bool no_sleep_states = !s0_supported && !s1_supported && !s2_supported && !s3_supported && !s4_supported && !hiber_file_present;
76697669
if (no_sleep_states) {
7670-
debug("POWER_CAPABILITIES: Detected !(S0||S1||S2||S3) pattern"); // can sometimes false flag baremetal devices
7670+
debug("POWER_CAPABILITIES: Detected !(S0||S1||S2||S3||S4||H) pattern");
76717671
return true;
76727672
}
76737673

@@ -8640,7 +8640,7 @@ struct VM {
86408640
/**
86418641
* @brief Check for vm-specific devices
86428642
* @category Windows
8643-
* @implements VM::DEVICE_HANDLES
8643+
* @implements VM::HANDLES
86448644
*/
86458645
[[nodiscard]] static bool device_handles() {
86468646
const HMODULE ntdll = util::get_ntdll();
@@ -8721,17 +8721,17 @@ struct VM {
87218721
}
87228722

87238723
if (vbox) {
8724-
debug("DEVICE_HANDLES: Detected VBox related device handles");
8724+
debug("HANDLES: Detected VBox related device handles");
87258725
return core::add(brands::VBOX);
87268726
}
87278727

87288728
if (vmware) {
8729-
debug("DEVICE_HANDLES: Detected VMware related device (HGFS)");
8729+
debug("HANDLES: Detected VMware related device (HGFS)");
87308730
return core::add(brands::VMWARE);
87318731
}
87328732

87338733
if (cuckoo) {
8734-
debug("DEVICE_HANDLES: Detected Cuckoo related device (pipe)");
8734+
debug("HANDLES: Detected Cuckoo related device (pipe)");
87358735
return core::add(brands::CUCKOO);
87368736
}
87378737

@@ -9718,7 +9718,7 @@ struct VM {
97189718
switch (hash) {
97199719
case 0x110350C5: return core::add(brands::QEMU); // TianoCore EDK2
97209720
case 0x87c39681: return core::add(brands::HYPERV);
9721-
case 0xf6829262: return core::add(brands::VBOX);
9721+
case 0x9502cb33: return core::add(brands::VBOX);
97229722
default: return false;
97239723
}
97249724
#else
@@ -10083,8 +10083,6 @@ struct VM {
1008310083
// ---------------------------------------------------------------------
1008410084
// Constants & Data
1008510085
// ---------------------------------------------------------------------
10086-
constexpr const char* vendor_list_ascii[] = { "msi","asrock","asus","asustek","gigabyte","giga-byte","micro-star","microstar" };
10087-
constexpr const wchar_t* vendor_list_wide[] = { L"msi",L"asrock",L"asus",L"asustek",L"gigabyte",L"giga-byte",L"micro-star",L"microstar" };
1008810086
constexpr const char redhat_sig_ascii[] = "red hat";
1008910087
constexpr const wchar_t redhat_sig_wide[] = L"red hat";
1009010088

@@ -11998,6 +11996,14 @@ struct VM {
1199811996
}
1199911997
}
1200011998

11999+
// remove "Unknown" if detected with other brands
12000+
if (active_count > 1) {
12001+
const int idx = find_index(brands::NULL_BRAND);
12002+
if (idx != -1) {
12003+
remove_at(idx);
12004+
}
12005+
}
12006+
1200112007
if (active_count > 1) {
1200212008
std::sort(active_brands.begin(), active_brands.begin() + static_cast<std::ptrdiff_t>(active_count), [](
1200312009
const brand_element_t& a,
@@ -12246,7 +12252,7 @@ struct VM {
1224612252
case DISK_SERIAL: return "DISK_SERIAL";
1224712253
case IVSHMEM: return "IVSHMEM";
1224812254
case GPU_CAPABILITIES: return "GPU_CAPABILITIES";
12249-
case DEVICE_HANDLES: return "DEVICE_HANDLES";
12255+
case HANDLES: return "HANDLES";
1225012256
case QEMU_FW_CFG: return "QEMU_FW_CFG";
1225112257
case VIRTUAL_PROCESSORS: return "VIRTUAL_PROCESSORS";
1225212258
case HYPERVISOR_QUERY: return "HYPERVISOR_QUERY";
@@ -12256,7 +12262,7 @@ struct VM {
1225612262
case FILE_ACCESS_HISTORY: return "FILE_ACCESS_HISTORY";
1225712263
case AUDIO: return "AUDIO";
1225812264
case NSJAIL_PID: return "NSJAIL_PID";
12259-
case PCI_DEVICES: return "PCI_DEVICES";
12265+
case DEVICES: return "DEVICES";
1226012266
case ACPI_SIGNATURE: return "ACPI_SIGNATURE";
1226112267
case TRAP: return "TRAP";
1226212268
case UD: return "UNDEFINED_INSTRUCTION";
@@ -12613,7 +12619,7 @@ struct VM {
1261312619
}
1261412620

1261512621
auto hardened_logic = []() -> bool {
12616-
// Helper to get the specific brand associated with a technique using the cache.
12622+
// Helper to get the specific brand associated with a technique using the cache
1261712623
auto detected_brand = [](const enum_flags flag) -> const char* {
1261812624
if (!check(flag)) {
1261912625
return brands::NULL_BRAND;
@@ -12887,7 +12893,7 @@ std::array<VM::core::technique, VM::enum_size + 1> VM::core::technique_table = [
1288712893
{VM::EDID, {100, VM::edid}},
1288812894
{VM::IVSHMEM, {100, VM::ivshmem}},
1288912895
{VM::DRIVERS, {100, VM::drivers}},
12890-
{VM::DEVICE_HANDLES, {100, VM::device_handles}},
12896+
{VM::HANDLES, {100, VM::device_handles}},
1289112897
{VM::VIRTUAL_PROCESSORS, {100, VM::virtual_processors}},
1289212898
{VM::KERNEL_OBJECTS, {100, VM::kernel_objects}},
1289312899
{VM::HYPERVISOR_QUERY, {100, VM::hypervisor_query}},
@@ -12911,7 +12917,7 @@ std::array<VM::core::technique, VM::enum_size + 1> VM::core::technique_table = [
1291112917

1291212918
#if (LINUX || WINDOWS)
1291312919
{VM::FIRMWARE, {100, VM::firmware}},
12914-
{VM::PCI_DEVICES, {95, VM::pci_devices}},
12920+
{VM::DEVICES, {95, VM::pci_devices}},
1291512921
{VM::SYSTEM_REGISTERS, {50, VM::system_registers}},
1291612922
{VM::AZURE, {30, VM::azure}},
1291712923
#endif

0 commit comments

Comments
 (0)