Skip to content

Commit c661c46

Browse files
kernelwernelkernelwernel
committed
Merge branch 'dev' of https://github.com/kernelwernel/VMAware into dev
2 parents 9ab2259 + 4d5b0f1 commit c661c46

3 files changed

Lines changed: 238 additions & 497 deletions

File tree

‎docs/documentation.md‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -444,9 +444,9 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
444444
| `VM::TIMER` | Check for timing anomalies in the system | 🐧🪟🍏 | 50% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L8169 ) |
445445
| `VM::THREAD_COUNT` | Check if there are only 1 or 2 threads, which is a common pattern in VMs with default settings (nowadays physical CPUs should have at least 4 threads for modern CPUs) | 🐧🍏 | 35% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2649) |
446446
| `VM::MAC` | Check if mac address starts with certain VM designated values | 🐧 | 20% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2671) |
447-
| `VM::TEMPERATURE` | Check for device's temperature | 🐧🪟 | 15% | | | | Disabled by default | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2804) |
448-
| `VM::SYSTEMD` | Check result from systemd-detect-virt tool | 🐧 | 35% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2818) |
449-
| `VM::CVENDOR` | Check if the chassis vendor is a VM vendor | 🐧 | 65% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2671) |
447+
| `VM::TEMPERATURE` | Check for device's temperature | 🐧 | 80% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2804) |
448+
| `VM::SYSTEMD` | Check result from systemd-detect-virt tool | 🐧 | 35% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2818) |
449+
| `VM::CVENDOR` | Check if the chassis vendor is a VM vendor | 🐧 | 65% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2671) |
450450
| `VM::CTYPE` | Check if the chassis type is valid (it's very often invalid in VMs) | 🐧 | 20% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2875) |
451451
| `VM::DOCKERENV` | Check if /.dockerenv or /.dockerinit file is present | 🐧 | 30% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2897) |
452452
| `VM::DMIDECODE` | Check if dmidecode output matches a VM brand | 🐧 | 55% | Admin | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L2915) |
@@ -455,15 +455,14 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
455455
| `VM::DLL` | Check for VM-specific DLLs | 🪟 | 50% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3057) |
456456
| `VM::REGISTRY_KEY` | Check for VM-specific registry keys | 🪟 | 50% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3092) |
457457
| `VM::REGISTRY_VALUES` | Check HKLM registries for specific VM strings | 🪟 | 50% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L4397) |
458-
| `VM::FILES` | Find for VM-specific specific files | 🪟 | 50% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3286) |
459458
| `VM::HWMODEL` | Check if the sysctl for the hwmodel does not contain the "Mac" string | 🍏 | 100% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3429) |
460459
| `VM::DISK_SIZE` | Check if disk size is under or equal to 50GB | 🐧 | 60% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3465) |
461460
| `VM::VBOX_DEFAULT` | Check for default RAM and DISK sizes set by VirtualBox | 🐧🪟 | 25% | Admin | | | Admin only needed for Linux | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3491) |
462461
| `VM::VBOX_NETWORK` | Check for VirtualBox network provider string | 🪟 | 100% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3576) |
463462
| `VM::WINE` | Check if the function "wine_get_unix_file_name" is present and if the OS booted from a VHD container | 🪟 | 100% | | GPL | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3633) |
464463
| `VM::POWER_CAPABILITIES` | Check what power states are enabled | 🪟 | 50% | | GPL | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3738) |
465464
| `VM::SETUPAPI_DISK` | Check for virtual machine signatures in disk drive device identifiers | 🪟 | 100% | | GPL | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3762) |
466-
| `VM::PROCESSES` | Check for any VM processes that are active | 🪟 | 15% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3831) |
465+
| `VM::PROCESSES` | Check for any VM processes that are active | 🐧 | 40% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3831) |
467466
| `VM::LINUX_USER_HOST` | Check for default VM username and hostname for linux | 🐧 | 10% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3884) |
468467
| `VM::GAMARUE` | Check for Gamarue ransomware technique which compares VM-specific Window product IDs | 🪟 | 10% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3911) |
469468
| `VM::BOCHS_CPU` | Check for various Bochs-related emulation oversights through CPU checks | 🐧🪟🍏 | 100% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L3968) |
@@ -511,7 +510,6 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
511510
| `VM::ANYRUN_DIRECTORY` | Check for any.run directory and handle the status code | 🪟 | 35% | | | | Removed from the lib, only available in the CLI | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/cli.cpp#L713) |
512511
| `VM::DRIVERS` | Check for VM-specific names for drivers | 🪟 | 100% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L7426) |
513512
| `VM::DISK_SERIAL` | Check for serial numbers of virtual disks | 🪟 | 100% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L7581) |
514-
| `VM::PORT_CONNECTORS` | Check for physical connection ports | 🪟 | 25% | | | | This technique is known to false flag on devices like Surface Pro, disabled by default | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L7700) |
515513
| `VM::IVSHMEM` | Check for IVSHMEM device absense | 🪟 | 100% | | | | |
516514
| `VM::GPU_CAPABILITIES` | Check for GPU capabilities related to VMs | 🪟 | 100% | Admin | | | Admin only needed for some heuristics | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L7785) |
517515
| `VM::DEVICE_HANDLES` | Check for VM-specific devices | 🪟 | 100% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/8cb2491b1c7d2cb7300d1d698b7c64c953b4ae75/src/vmaware.hpp#L7848) |
@@ -529,6 +527,7 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
529527
| `VM::TPM` | Check if the system has a physical TPM by matching the TPM manufacturer against known physical TPM chip vendors | 🪟 | 50% | | | | | [link](https://github.com/kernelwernel/VMAware/blob/fb66db9fdd7894edebe5eeade4b0148a08bd5514/src/vmaware.hpp#L10011)|
530528
| `VM::PCI_DEVICES` | Check for PCI vendor and device IDs that are VM-specific | 🐧🪟 | 95% | | | | | |
531529
| `VM::QEMU_PASSTHROUGH` | Check for QEMU's hot-plug signature | 🪟 | 100% | | | | | |
530+
| `VM::TRAP` | Check for two traps being raised at the same RIP, a hypervisor interferes with the instruction pointer delivery | 🪟 | 50% | | | | | |
532531

533532
<!-- ADD TECHNIQUE DETAILS HERE -->
534533

‎src/cli.cpp‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -328,8 +328,6 @@ bool is_disabled(const VM::enum_flags flag) {
328328

329329
switch (flag) {
330330
case VM::VMWARE_DMESG:
331-
case VM::PORT_CONNECTORS:
332-
case VM::TEMPERATURE: return true;
333331
default: return false;
334332
}
335333
}
@@ -715,8 +713,8 @@ void general() {
715713
checker(VM::HYPERVISOR_BIT, "CPUID hypervisor bit");
716714
checker(VM::HYPERVISOR_STR, "hypervisor str");
717715
checker(VM::TIMER, "timing anomalies");
718-
checker(VM::THREAD_COUNT, "processor count");
719-
checker(VM::MAC, "MAC address");
716+
checker(VM::THREAD_COUNT, "thread count");
717+
checker(VM::MAC, "MAC addresses");
720718
checker(VM::TEMPERATURE, "temperature");
721719
checker(VM::SYSTEMD, "systemd virtualisation");
722720
checker(VM::CVENDOR, "chassis vendor");
@@ -728,12 +726,11 @@ void general() {
728726
checker(VM::DLL, "DLLs");
729727
checker(VM::REGISTRY_KEYS, "registry keys");
730728
checker(VM::WINE, "Wine");
731-
checker(VM::FILES, "VM files");
732729
checker(VM::HWMODEL, "hw.model");
733730
checker(VM::DISK_SIZE, "disk size");
734731
checker(VM::VBOX_DEFAULT, "VBox default specs");
735732
checker(VM::VBOX_NETWORK, "VBox network provider match");
736-
checker(VM::PROCESSES, "VM processes");
733+
checker(VM::PROCESSES, "processes");
737734
checker(VM::LINUX_USER_HOST, "default Linux user/host");
738735
checker(VM::GAMARUE, "gamarue ransomware technique");
739736
checker(VM::BOCHS_CPU, "BOCHS CPU techniques");
@@ -763,7 +760,7 @@ void general() {
763760
checker(VM::CUCKOO_PIPE, "Cuckoo pipe");
764761
checker(VM::HYPERV_HOSTNAME, "Hyper-V Azure hostname");
765762
checker(VM::GENERAL_HOSTNAME, "general VM hostnames");
766-
checker(VM::DISPLAY, "screen resolution");
763+
checker(VM::DISPLAY, "display");
767764
checker(VM::DEVICE_STRING, "bogus device string");
768765
checker(VM::BLUESTACKS_FOLDERS, "BlueStacks folders");
769766
checker(VM::CPUID_SIGNATURE, "CPUID signatures");
@@ -783,23 +780,23 @@ void general() {
783780
checker(anyrun_directory, "ANY.RUN directory");
784781
checker(VM::DRIVERS, "driver names");
785782
checker(VM::DISK_SERIAL, "disk serial number");
786-
checker(VM::PORT_CONNECTORS, "physical connection ports");
787783
checker(VM::IVSHMEM, "IVSHMEM device");
788784
checker(VM::GPU_CAPABILITIES, "GPU capabilities");
789785
checker(VM::LOGICAL_PROCESSORS, "logical processor count");
790786
checker(VM::PHYSICAL_PROCESSORS, "physical processor count");
791-
checker(VM::POWER_CAPABILITIES, "Power capabilities");
787+
checker(VM::POWER_CAPABILITIES, "power capabilities");
792788
checker(VM::QEMU_FW_CFG, "QEMU fw_cfg device");
793789
checker(VM::VIRTUAL_PROCESSORS, "virtual processors");
794790
checker(VM::HYPERV_QUERY, "hypervisor query");
795791
checker(VM::AMD_SEV, "AMD-SEV MSR");
796792
checker(VM::VIRTUAL_REGISTRY, "registry emulation");
797-
checker(VM::FIRMWARE, "firmware signatures");
793+
checker(VM::FIRMWARE, "firmware");
798794
checker(VM::FILE_ACCESS_HISTORY, "low file access count");
799795
checker(VM::NSJAIL_PID, "nsjail PID");
800796
checker(VM::TPM, "TPM manufacturer");
801797
checker(VM::PCI_DEVICES, "PCI vendor/device ID");
802798
checker(VM::QEMU_PASSTHROUGH, "QEMU passthrough");
799+
checker(VM::TRAP, "trap behavior");
803800

804801
// ADD NEW TECHNIQUE CHECKER HERE
805802

0 commit comments

Comments
 (0)