binary-translation-detector/btd.c at main · kernelwernel/binary-translation-detector · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
#include <stdio.h>
#include <stdint.h>
#include <stdbool.h>
#include <string.h>

#if defined(_WIN32) || defined(_WIN64)
#define WINDOWS 1
#define LINUX 0
#define APPLE 0
#elif (defined(__linux__))
#define WINDOWS 0
#define LINUX 1
#define APPLE 0
#elif (defined(__APPLE__) || defined(__APPLE_CPP__) || defined(__MACH__) || defined(__DARWIN))
#define WINDOWS 0
#define LINUX 0
#define APPLE 1
#else
#define WINDOWS 0
#define LINUX 0
#define APPLE 0
#endif

#define u8 uint8_t
#define u32 uint32_t
#define CPU_MANUFACTURER 0x40000000

#if (LINUX)
#include <cpuid.h>
#elif (WINDOWS)
#include <windows.h>
#include <intrin.h>
#endif

u8 get_windows_version() {
#if (WINDOWS)
    OSVERSIONINFOEX osvi;
    ZeroMemory(&osvi, sizeof(OSVERSIONINFOEX));
    osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);

    if (GetVersionEx((OSVERSIONINFO*)&osvi)) {
        return osvi.dwMajorVersion;
    }
#endif

    return 0;
}

bool get_emulation_status_microsoft() {
#if (WINDOWS)
    USHORT process_machine = 0
    USHORT native_machine = 0;

    if (IsWoW64Process2(GetCurrentProcess(), &process_machine, &native_machine)) {
        bool is_emulated = (
            (native_machine == IMAGE_FILE_MACHINE_ARM64) &&
            (
                (process_machine == IMAGE_FILE_MACHINE_AMD64) || // not to be misread as "ARM64"
                (process_machine == IMAGE_FILE_MACHINE_I386)
            )
        );

        return (is_emulated);
    }
#endif

    return false;
}

bool detect_apple_rosetta() {
    char manufacturer[13];
    manufacturer[12] = '\0';

    u32 cpu_info[4] = {0};

#if (WINDOWS)
    __cpuid((int32_t*)cpu_info, CPU_MANUFACTURER);
#elif (LINUX || APPLE)
    __cpuid_count(CPU_MANUFACTURER, 0, cpu_info[0], cpu_info[1], cpu_info[2], cpu_info[3]);
#endif

    *((u32*)manufacturer) = cpu_info[1];
    *((u32*)(manufacturer + 4)) = cpu_info[3];
    *((u32*)(manufacturer + 8)) = cpu_info[2];

    return (strcmp(manufacturer, "VirtualApple") == 0);
}

bool detect_powervm_lx86() {
    char manufacturer[13];
    manufacturer[12] = '\0';

    u32 cpu_info[4] = {0};

#if (WINDOWS)
    __cpuid((int32_t*)cpu_info, CPU_MANUFACTURER);
#elif (LINUX || APPLE)
    __cpuid_count(CPU_MANUFACTURER, 0, cpu_info[0], cpu_info[1], cpu_info[2], cpu_info[3]);
#endif

    *((u32*)manufacturer) = cpu_info[1];
    *((u32*)(manufacturer + 4)) = cpu_info[3];
    *((u32*)(manufacturer + 8)) = cpu_info[2];

    return (strcmp(manufacturer, "PowerVM Lx86") == 0);
}

bool detect_microsoft_prism() {
#if (!WINDOWS)
    return false;
#else
    if (get_windows_version() == 11) {
        return get_emulation_status_microsoft();
    }

    return false;
#endif
}

bool detect_microsoft_x86_to_arm() {
#if (!WINDOWS)
    return false;
#else
    if (get_windows_version() == 10) {
        return get_emulation_status_microsoft();
    }

    return false;
#endif
}

int main() {
    if (detect_powervm_lx86()) {
        printf("PowerVM Lx86 detected\n");
    } else if (detect_apple_rosetta()) {
        printf("Apple Rosetta translator detected\n");
    } else if (detect_microsoft_prism()) {
        printf("Microsoft Prism translator detected\n");
    } else if (detect_microsoft_x86_to_arm()) {
        printf("Microsoft x86-to-ARM (XTA) translator detected\n");
    } else {
        printf("No tranlator found\n");
    }

    return 0;
}