Skip to content

Commit ffc45ad

Browse files
NotRequiemNotRequiem
authored
Merge pull request #344 from kernelwernel/dev
Major changes
2 parents df0b228 + 06ee1e8 commit ffc45ad

File tree

6 files changed

+1334
-1597
lines changed

6 files changed

+1334
-1597
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
The library is:
1515
- Very easy to use
1616
- Cross-platform (Windows + MacOS + Linux)
17-
- Features up to 115+ unique VM detection techniques [[list](https://github.com/kernelwernel/VMAware/blob/main/docs/documentation.md#flag-table)]
17+
- Features up to 100+ unique VM detection techniques [[list](https://github.com/kernelwernel/VMAware/blob/main/docs/documentation.md#flag-table)]
1818
- Features the most cutting-edge techniques
1919
- Able to detect 65+ VM brands including VMware, VirtualBox, QEMU, Hyper-V, and much more [[list](https://github.com/kernelwernel/VMAware/blob/main/docs/documentation.md#brand-table)]
2020
- Able to beat VM hardeners
@@ -239,7 +239,7 @@ You can view the full docs [here](docs/documentation.md). All the details such a
239239

240240
> I would've made it strictly MIT so proprietary software can make use of the library, but some of the techniques employed are from GPL projects, and I have no choice but to use the same license for legal reasons.
241241
>
242-
> This gave me an idea to make an MIT version without all of the GPL code so it can also be used without forcing your code to be open source. It should be noted that the MIT version removes <b>7</b> techniques out of 116 (as of 2.0 version), and the lesser the number of techniques, the less accurate the overall result might be.
242+
> This gave me an idea to make an MIT version without all of the GPL code so it can also be used without forcing your code to be open source. It should be noted that the MIT version removes <b>7</b> techniques out of 109 (as of 2.0 version), and the lesser the number of techniques, the less accurate the overall result might be.
243243
244244
</details>
245245

‎docs/documentation.md‎

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -440,7 +440,6 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
440440
| `VM::DMIDECODE` | Check if dmidecode output matches a VM brand | Linux | 55% | Admin | | | |
441441
| `VM::DMESG` | Check if dmesg output matches a VM brand | Linux | 55% | Admin | | | |
442442
| `VM::HWMON` | Check if /sys/class/hwmon/ directory is present. If not, likely a VM | Linux | 35% | | | | |
443-
| `VM::SIDT5` | Check if the 5th byte after sidt is null | Linux | 45% | | | | |
444443
| `VM::DLL` | Check for VM-specific DLLs | Windows | 25% | | | | |
445444
| `VM::REGISTRY` | Check for VM-specific registry values | Windows | 50% | | | | |
446445
| `VM::VM_FILES` | Find for VM-specific specific files | Windows | 25% | | | | |
@@ -465,15 +464,10 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
465464
| `VM::IOREG_GREP` | Check for VM-strings in ioreg commands for MacOS | MacOS | 100% | | | | |
466465
| `VM::MAC_SIP` | Check if System Integrity Protection is disabled (likely a VM if it is) | MacOS | 40% | | | | |
467466
| `VM::HKLM_REGISTRIES` | Check HKLM registries for specific VM strings | Windows | 25% | | | | |
468-
| `VM::QEMU_GA` | Check for "qemu-ga" process | Linux | 10% | | | | |
469467
| `VM::VPC_INVALID` | Check for official VPC method | Windows | 75% | | | 32-bit | |
470-
| `VM::SIDT` | Check for sidt instruction method | Windows | 25% | | | | |
471-
| `VM::SGDT` | Check for sgdt instruction method | Windows | 30% | | | 32-bit | |
472-
| `VM::SLDT` | Check for sldt instruction method | Windows | 15% | | | 32-bit | |
473-
| `VM::OFFSEC_SIDT` | Check for Offensive Security SIDT method | Windows | 60% | | | 32-bit | |
474-
| `VM::OFFSEC_SGDT` | Check for Offensive Security SGDT method | Windows | 60% | | | 32-bit | |
475-
| `VM::OFFSEC_SLDT` | Check for Offensive Security SLDT method | Windows | 20% | | | 32-bit | |
476-
| `VM::VPC_SIDT` | Check for sidt method with VPC's 0xE8XXXXXX range | Windows | 15% | | | 32-bit | |
468+
| `VM::SIDT` | Check for uncommon IDT virtual addresses | Linux and Windows | 25% | | | | |
469+
| `VM::SGDT` | Check for uncommon GDT virtual addresses | Windows | 30% | | | | |
470+
| `VM::SLDT` | Check for uncommon LDT virtual addresses | Windows | 15% | | | 32-bit | |
477471
| `VM::VMWARE_IOMEM` | Check for VMware string in /proc/iomem | Linux | 65% | | | | |
478472
| `VM::VMWARE_IOPORTS` | Check for VMware string in /proc/ioports | Linux | 70% | | | | |
479473
| `VM::VMWARE_SCSI` | Check for VMware string in /proc/scsi/scsi | Linux | 40% | | | | |
@@ -489,8 +483,8 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
489483
| `VM::NETTITUDE_VM_MEMORY` | Check for memory regions to detect VM-specific brands | Windows | 100% | | | | |
490484
| `VM::CUCKOO_DIR` | Check for cuckoo directory using crt and WIN API directory functions | Windows | 30% | | | | |
491485
| `VM::CUCKOO_PIPE` | Check for Cuckoo specific piping mechanism | Windows | 30% | | | | |
492-
| `VM::HYPERV_HOSTNAME` | Check for default Azure hostname format regex (Azure uses Hyper-V as their base VM brand) | Windows, Linux | 30% | | | | |
493-
| `VM::GENERAL_HOSTNAME` | Check for commonly set hostnames by certain VM brands | Windows, Linux | 10% | | | | |
486+
| `VM::HYPERV_HOSTNAME` | Check for default Azure hostname format regex (Azure uses Hyper-V as their base VM brand) | Linux and Windows | 30% | | | | |
487+
| `VM::GENERAL_HOSTNAME` | Check for commonly set hostnames by certain VM brands | Linux and Windows | 10% | | | | |
494488
| `VM::SCREEN_RESOLUTION` | Check for pre-set screen resolutions commonly found in VMs | Windows | 20% | | | | |
495489
| `VM::DEVICE_STRING` | Check if bogus device string would be accepted | Windows | 25% | | | | |
496490
| `VM::BLUESTACKS_FOLDERS` | Check for the presence of BlueStacks-specific folders | Linux | 5% | | | | |
@@ -513,8 +507,7 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
513507
| `VM::ANYRUN_DRIVER` | Check for any.run driver presence | Windows | 65% | | | | | Removed from the lib, only available in the CLI |
514508
| `VM::ANYRUN_DIRECTORY` | Check for any.run directory and handle the status code | Windows | 35% | | | | | Removed from the lib, only available in the CLI |
515509
| `VM::DRIVER_NAMES` | Check for VM-specific names for drivers | Windows | 100% | | | | |
516-
| `VM::VM_SIDT` | Check for unknown IDT base address | Windows | 100% | | | | |
517-
| `VM::HDD_SERIAL` | Check for serial numbers of virtual disks | Windows | 100% | | | | |
510+
| `VM::DISK_SERIAL` | Check for serial numbers of virtual disks | Windows | 100% | | | | |
518511
| `VM::PORT_CONNECTORS` | Check for physical connection ports | Windows | 25% | | | | This technique is known to false flag on devices like Surface Pro |
519512
| `VM::GPU_CAPABILITIES` | Check for GPU capabilities related to VMs | Windows | 100% | Admin | | | Admin only needed for some heuristics |
520513
| `VM::GPU_VM_STRINGS` | Check for specific GPU string signatures related to VMs | Windows | 100% | | | | If GPU_CAPABILITIES also flags, the overall score will be 50 instead of 100 |
@@ -531,7 +524,7 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
531524
| `VM::AMD_THREAD_MISMATCH` | Check for AMD CPU thread count database if it matches the system's thread count | | 95% | | | | |
532525
| `VM::NATIVE_VHD` | Check for OS being booted from a VHD container | Windows | 100% | | | | |
533526
| `VM::VIRTUAL_REGISTRY` | Check for particular object directory which is present in Sandboxie virtual environment but not in usual host systems | Windows | 65% | | | | Admin only needed for Linux |
534-
| `VM::FIRMWARE` | Check for VM signatures and patched strings by hardeners in firmware, while ensuring the BIOS serial is valid | Windows and Linux | 100% | | | | |
527+
| `VM::FIRMWARE` | Check for VM signatures and patched strings by hardeners in firmware, while ensuring the BIOS serial is valid | Linux and Windows | 100% | | | | |
535528
| `VM::FILE_ACCESS_HISTORY` | Check if the number of accessed files are too low for a human-managed environment | Linux | 15% | | | | |
536529
| `VM::AUDIO` | Check if any waveform-audio output devices are present in the system | Windows | 25% | | | | |
537530
| `VM::UNKNOWN_MANUFACTURER` | Check if the CPU manufacturer is not known | | 50% | | | | |

‎src/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
|------|---------|
33
| `cli.cpp` | Entire CLI tool code |
44
| `vmaware.hpp` | Official and original library header in GPL-3.0, most likely what you're looking for. |
5-
| `vmaware_MIT.hpp` | Same as above but in MIT. But this removes 7 techniques out of 116 |
5+
| `vmaware_MIT.hpp` | Same as above but in MIT. But this removes 7 techniques out of 109 |
66

77
<br>
88

‎src/cli.cpp‎

Lines changed: 3 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -350,12 +350,11 @@ bool is_unsupported(VM::enum_flags flag) {
350350
case VM::DMIDECODE:
351351
case VM::DMESG:
352352
case VM::HWMON:
353-
case VM::SIDT5:
354353
case VM::DISK_SIZE:
355354
case VM::VBOX_DEFAULT:
355+
case VM::VM_PROCESSES:
356356
case VM::LINUX_USER_HOST:
357357
case VM::BOCHS_CPU:
358-
case VM::QEMU_GA:
359358
case VM::SIDT:
360359
case VM::VMWARE_IOMEM:
361360
case VM::VMWARE_IOPORTS:
@@ -427,10 +426,6 @@ bool is_unsupported(VM::enum_flags flag) {
427426
case VM::SIDT:
428427
case VM::SGDT:
429428
case VM::SLDT:
430-
case VM::OFFSEC_SIDT:
431-
case VM::OFFSEC_SGDT:
432-
case VM::OFFSEC_SLDT:
433-
case VM::VPC_SIDT:
434429
case VM::VMWARE_STR:
435430
case VM::VMWARE_BACKDOOR:
436431
case VM::VMWARE_PORT_MEM:
@@ -450,8 +445,7 @@ bool is_unsupported(VM::enum_flags flag) {
450445
case VM::KVM_BITMASK:
451446
case VM::KGT_SIGNATURE:
452447
case VM::DRIVER_NAMES:
453-
case VM::VM_SIDT:
454-
case VM::HDD_SERIAL:
448+
case VM::DISK_SERIAL:
455449
case VM::PORT_CONNECTORS:
456450
case VM::GPU_VM_STRINGS:
457451
case VM::GPU_CAPABILITIES:
@@ -874,7 +868,6 @@ void general() {
874868
checker(VM::HYPERVISOR_BIT, "CPUID hypervisor bit");
875869
checker(VM::HYPERVISOR_STR, "hypervisor str");
876870
checker(VM::TIMER, "timing anomalies");
877-
checker(VM::SIDT5, "sidt null byte");
878871
checker(VM::THREADCOUNT, "processor count");
879872
checker(VM::MAC, "MAC address");
880873
checker(VM::TEMPERATURE, "temperature");
@@ -907,16 +900,11 @@ void general() {
907900
checker(VM::KVM_DIRS, "KVM directories");
908901
checker(VM::HKLM_REGISTRIES, "registry values");
909902
checker(VM::AUDIO, "audio device");
910-
checker(VM::QEMU_GA, "qemu-ga process");
911903
checker(VM::QEMU_DIR, "QEMU directories");
912904
checker(VM::VPC_INVALID, "VPC invalid instructions");
913905
checker(VM::SIDT, "SIDT");
914906
checker(VM::SGDT, "SGDT");
915907
checker(VM::SLDT, "SLDT");
916-
checker(VM::OFFSEC_SIDT, "Offensive Security SIDT");
917-
checker(VM::OFFSEC_SGDT, "Offensive Security SGDT");
918-
checker(VM::OFFSEC_SLDT, "Offensive Security SLDT");
919-
checker(VM::VPC_SIDT, "VirtualPC SIDT");
920908
checker(VM::VMWARE_IOMEM, "/proc/iomem file");
921909
checker(VM::VMWARE_IOPORTS, "/proc/ioports file");
922910
checker(VM::VMWARE_SCSI, "/proc/scsi/scsi file");
@@ -956,8 +944,7 @@ void general() {
956944
checker(anyrun_driver, "ANY.RUN driver");
957945
checker(anyrun_directory, "ANY.RUN directory");
958946
checker(VM::DRIVER_NAMES, "driver names");
959-
checker(VM::VM_SIDT, "VM SIDT");
960-
checker(VM::HDD_SERIAL, "HDD serial number");
947+
checker(VM::DISK_SERIAL, "disk serial number");
961948
checker(VM::PORT_CONNECTORS, "physical connection ports");
962949
checker(VM::GPU_CAPABILITIES, "GPU capabilities");
963950
checker(VM::GPU_VM_STRINGS, "GPU strings");

0 commit comments

Comments
 (0)