Merge pull request #617 from Scrut1ny/patch-1

Add FADT Hypervisor Vendor Identity check to VM::FIRMWARE

Author: NotRequiem

src/vmaware.hpp

@@ -6604,6 +6604,16 @@ struct VM {
                     debug("FIRMWARE: C2 and C3 latencies indicate VM");
                     return true;
                 }
+
+                if (buffer_len >= 276) {
+                    u64 hypervisor_vid = 0;
+                    memcpy(&hypervisor_vid, buffer + 268, 8);
+
+                    if (hypervisor_vid != 0) {
+                        debug("FIRMWARE: FACP 'Hypervisor Vendor Identity' field is occupied");
+                        return true;
+                    }
+                }
             }
 
             return false;