VMAware/src/vmaware.hpp at main · kernelwernel/VMAware

13147 lines (11329 loc) · 509 KB
 * ██╗   ██╗███╗   ███╗ █████╗ ██╗    ██╗ █████╗ ██████╗ ███████╗
 * ██║   ██║████╗ ████║██╔══██╗██║    ██║██╔══██╗██╔══██╗██╔════╝
 * ██║   ██║██╔████╔██║███████║██║ █╗ ██║███████║██████╔╝█████╗
 * ╚██╗ ██╔╝██║╚██╔╝██║██╔══██║██║███╗██║██╔══██║██╔══██╗██╔══╝
 *  ╚████╔╝ ██║ ╚═╝ ██║██║  ██║╚███╔███╔╝██║  ██║██║  ██║███████╗
 *   ╚═══╝  ╚═╝     ╚═╝╚═╝  ╚═╝ ╚══╝╚══╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝ Experimental post-2.6.0 (March 2026)
 *  C++ VM detection library
 *  - Made by: kernelwernel (https://github.com/kernelwernel)
 *  - Co-developed by: Requiem (https://github.com/NotRequiem)
 *  - Contributed by:
 *      - Alex (https://github.com/greenozon)
 *      - Marek Knápek (https://github.com/MarekKnapek)
 *      - Vladyslav Miachkov (https://github.com/fameowner99)
 *      - Alan Tse (https://github.com/alandtse)
 *      - Georgii Gennadev (https://github.com/D00Movenok)
 *      - utoshu (https://github.com/utoshu)
 *      - Jyd (https://github.com/jyd519)
 *      - dmfrpro (https://github.com/dmfrpro)
 *      - Pierre-Étienne Messier (https://github.com/pemessier)
 *      - Teselka (https://github.com/Teselka)
 *      - Kyun-J (https://github.com/Kyun-J)
 *      - luukjp (https://github.com/luukjp)
 *      - Lorenzo Rizzotti (https://github.com/Dreaming-Codes) 
 *      - virtfunc (https://github.com/virtfunc)
 *  - Repository: https://github.com/kernelwernel/VMAware
 *  - Docs: https://github.com/kernelwernel/VMAware/docs/documentation.md
 *  - Full credits: https://github.com/kernelwernel/VMAware#credits-and-contributors-%EF%B8%8F
 *  - License: MIT
 *                               MIT License
 *  Copyright (c) 2026 kernelwernel
 *  Permission is hereby granted, free of charge, to any person obtaining a copy
 *  of this software and associated documentation files (the "Software"), to deal
 *  in the Software without restriction, including without limitation the rights
 *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 *  copies of the Software, and to permit persons to whom the Software is
 *  furnished to do so, subject to the following conditions:
 *  The above copyright notice and this permission notice shall be included in all
 *  copies or substantial portions of the Software.
 *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 *  SOFTWARE.
 * ============================== SECTIONS ==================================
 * - enums for publicly accessible techniques  => line 556
 * - struct for internal cpu operations        => line 804
 * - struct for internal memoization           => line 3131
 * - struct for internal utility functions     => line 3338
 * - struct for internal core components       => line 11827
 * - start of VM detection technique list      => line 4804
 * - start of public VM detection functions    => line 12192
 * - start of externally defined variables     => line 12979
 * ============================== EXAMPLE ===================================
 * #include "vmaware.hpp"
 * #include <iostream>
 * int main() {
 *     if (VM::detect()) {
 *         std::cout << "Virtual machine detected!" << "\n";
 *     } else {
 *         std::cout << "Running on baremetal" << "\n";
 *     std::cout << "VM name: " << VM::brand() << "\n";
 *     std::cout << "VM type: " << VM::type() << "\n";
 *     std::cout << "VM certainty: " << (int)VM::percentage() << "%" << "\n";
 * ========================== CODE DOCUMENTATION =============================
 * TL;DR: if you have the patience of an ADHD kid, head over here:
 * https://deepwiki.com/kernelwernel/VMAware
 * Welcome! This is just a preliminary text to lay the context of how it works, 
 * how it's structured, and to guide anybody who's trying to understand the whole code. 
 * Reading over 12k+ lines of other people's C++ code is obviously not an easy task, 
 * and that's perfectly understandable. We'd struggle as well if we were in your position
 * while not even knowing where to start. So here's a more human-friendly explanation:
 * Firstly, the lib is completely static, meaning that there's no need for struct 
 * constructors to be initialized (unless you're using the VM::vmaware struct).
 * The main focus of the lib are the tables:
 *  - the TECHNIQUE table stores all the VM detection technique information in a std::array 
 *  - the BRAND table stores every VM brand as a std::array as well, but as a scoreboard. 
 *    This means that if a VM detection technique has detected a VM brand, that brand will have an
 *    incremented score. After every technique is run, the brand with the highest score
 *    is chosen as the officially detected brand. 
 * The techniques are all static functions, which all return a boolean. There are a few 
 * categories of techniques that target vastly different things such as OS queries, CPU
 * values, other hardware values, firmware data, and system files just to name a few. 
 * Secondly, there are multiple modules in the lib that are combined to integrate with
 * the functionalities needed:
 *    - core module:
 *        This contains many important components such as the aforementioned tables, 
 *        the standard structure for how VM techniques are organised, functionalities 
 *        to run all the techniques in the technique table, functionalities to run
 *        custom-made techniques by the user, and an argument handler based on the 
 *        argument input by the user.
 *    - cpu module:
 *        As the name suggests, this contains functionalities for the CPU. There are
 *        many techniques that utilise some kind of low-level CPU interaction, so 
 *        this module was added to further standardise it.
 *    - memo module:
 *        This contains functionalities for memoizing technique results (not to be
 *        confused with "memorization"). More specifically, this allows us to cache 
 *        a technique result in a table where each entry contains a technique and its
 *        result. This allows us to avoid re-running techniques which happens a lot
 *        internally. Some techniques are costlier than others in terms of 
 *        performance, so this is a crucial module that allows us to save a lot of
 *        time. Additionally, it contains other memoization caches for various other
 *        things for convenience. 
 *    - util module:
 *        This contains many utility functionalities to be used by the techniques.
 *        Examples of functionalities include file I/O, registries, permission 
 *        checks, system commands, HDD sizes, RAM sizes, debugs, process checking, 
 *        OS queries, Hyper-X, and so on. (It should be mentioned that this is 
 *        probably the least enjoyable part of the lib to read, since it's really messy)
 * Thirdly, We'll explain in this section how all of these facets of the lib interact with 
 * each other. Let's take an example with VM::detect(), where it returns a boolean true or 
 * false if a VM has been detected or not. The chain of steps it takes goes like this:
 *    1. The function tries to handle the user arguments (if there's 
 *       any), and generates a std::bitset. This bitset has a length of 
 *       every VM detection technique + settings, where each bit 
 *       corresponds to whether this technique will be run or not, 
 *       and which settings were selected. 
 *    2. After the bitset has been generated, this information is then 
 *       passed to the core module of the lib. It analyses the bitset, 
 *       and runs every VM detection technique that has been selected, 
 *       while ignoring the ones that weren't (by default most of them 
 *       are already selected anyway). The function that does this 
 *       mechanism is core::run_all()
 *    3. While the core::run_all() function is being run, it checks if 
 *       each technique has already been memoized or not. If it has, 
 *       retrieve the result from the cache and move to the next technique. 
 *       If it hasn't, run the technique and cache the result in the 
 *       cache table. 
 *    4. After every technique has been executed, this generates a 
 *       uint16_t score. Every technique has a score value between 0 to 
 *       100, and if a VM is detected then this score is accumulated to 
 *       a total. If the total is above 150, that means it's a VM[1]. 
 * There are other functions such as VM::brand(), which returns a std::string of the most 
 * likely brand that your system is running on. It has a bit of a different mechanism:
 *    1. Same as step 1 in VM::detect()
 *    2. Check if the majority of techniques have been run already and stored
 *       in the cache. If not, invoke core::run_all(). The reason why this is
 *       important is because a lot of techniques increment a point for its 
 *       respected brand that was detected. For example, if the VM::QEMU_USB
 *       technique has detected a VM, it'll add a score to the QEMU brand in
 *       the scoreboard. If no technique were run, then there's no way to
 *       populate the scoreboard with any points. After every VM detection 
 *       technique has been invoked/retrieved, the brand scoreboard is now
 *       ready to be analysed.
 *    3. Create a filter for the scoreboard, where every brand that has a score
 *       of 0 are erased for abstraction purposes. Now the scoreboard is only
 *       populated with relevant brands where they all have at least a single
 *       point. These are the contenders for which brand will be outputted.
 *       Think of it as fetching candidates with potential while discarding
 *       those that don't.
 *    4. Merge certain brand combinations together. For example, Azure's cloud 
 *       is based on Hyper-V, but Hyper-V may have a higher score due to the 
 *       prevalence of it in a practical setting, which will put Azure to the 
 *       side. In reality, there should be an indication that Azure is involved
 *       since it's a better idea to let the user know that the brand is "Azure 
 *       Hyper-V" instead of just "Hyper-V". So what this step does is "merge" 
 *       the brands together to form a more accurate idea of the brand(s) involved.
 *    5. After all of this, the scoreboard is sorted in descending order, where
 *       the brands with the highest points are now selected as the official 
 *       output of the VM::brand() function.
 *    6. The result is then cached in the memo module, so if another function
 *       invokes VM::brand() again, the result is retrieved from the cache 
 *       without needing to run all of the previous steps again.
 * (NOTE: it's a bit more complicated than this, but that's the gist of how this function works)
 * Most of the functions provided usually depend on the 2 techniques covered. 
 * And they serve as a functionality base for other components of the lib.
 *  [1]: If the user has provided a setting argument called VM::HIGH_THRESHOLD, 
 *       the threshold becomes 300 instead of 150.
#ifndef VMAWARE_HEADER
#define VMAWARE_HEADER
#ifndef __VMAWARE_DEBUG__
    #if defined(_DEBUG)    /* MSVC Debug */       \
    || defined(DEBUG)     /* user or build-system */
        #define __VMAWARE_DEBUG__
#if defined(_WIN32) || defined(_WIN64)
    #ifndef WIN32_LEAN_AND_MEAN
        #define WIN32_LEAN_AND_MEAN
    #define WINDOWS 1
    #define LINUX 0
    #define APPLE 0
#elif (defined(__linux__))
    #define WINDOWS 0
    #define LINUX 1
    #define APPLE 0
#elif (defined(__APPLE__) || defined(__APPLE_CPP__) || defined(__MACH__) || defined(__DARWIN))
    #define WINDOWS 0
    #define LINUX 0
    #define APPLE 1
    #define WINDOWS 0
    #define LINUX 0
    #define APPLE 0
#ifdef _MSC_VER
    #define MSVC 1
#if defined(_MSVC_LANG)
    #define VMA_CPLUSPLUS _MSVC_LANG
    #define VMA_CPLUSPLUS __cplusplus
#if VMA_CPLUSPLUS >= 202302L
    #define VMA_CPP 23
#elif VMA_CPLUSPLUS >= 202002L
    #define VMA_CPP 20
#elif VMA_CPLUSPLUS >= 201703L
    #define VMA_CPP 17
#elif VMA_CPLUSPLUS >= 201402L
    #define VMA_CPP 14
#elif VMA_CPLUSPLUS >= 201103L
    #define VMA_CPP 11
#elif VMA_CPLUSPLUS >= 199711L
    #define VMA_CPP 98 /* C++98 or C++03 */
    #error "Unsupported C++ standard (pre-C++98 or unknown)."
#if (VMA_CPP < 11 && !WINDOWS)
    #error "VMAware only supports C++11 or above, set your compiler flag to '-std=c++20' for gcc/clang, or '/std:c++20' for MSVC"
#if defined(__x86_64__) || defined(_M_X64)
    #define x86_64 1
    #define x86_64 0

E4E
#endif
#if defined(__i386__) || defined(_M_IX86)
    #define x86_32 1
    #define x86_32 0
#if x86_32 || x86_64
    #define x86 1
    #define x86 0
#if defined(__aarch64__) || defined(_M_ARM64) || defined(__ARM_LINUX_COMPILER__)
    #define ARM64 1
    #define ARM64 0
#if (defined(__arm__) || defined(_M_ARM)) && !ARM64
    #define ARM32 1
    #define ARM32 0
#if ARM32 || ARM64
    #define ARM 1
    #define ARM 0
#if (!APPLE && (VMA_CPP >= 20) && (!CLANG || __clang_major__ >= 16))
    #define SOURCE_LOCATION_SUPPORTED 1
    #define SOURCE_LOCATION_SUPPORTED 0
#if defined(__clang__)
    #define GCC 0
    #define CLANG 1
#elif defined(__GNUC__)
    #define GCC 1
    #define CLANG 0
    #define GCC 0
    #define CLANG 0
#if !(defined(WINDOWS) || defined(LINUX) || defined(APPLE))
    #warning "Unknown OS detected, tests will be severely limited"
#if (VMA_CPP >= 23)
    #include <limits>
#if (VMA_CPP >= 20)
    #include <bit>
    #include <ranges>
    #if (SOURCE_LOCATION_SUPPORTED)
        #include <source_location>
#if (VMA_CPP >= 17)
    #include <filesystem>
    #include <system_error>
#ifdef __VMAWARE_DEBUG__
    #include <iomanip>
    #include <ios>
    #include <locale>
    #include <codecvt>
#include <cstdio>
#include <functional>
#include <cstring>
#include <string>
#include <fstream>
#include <thread>
#include <cstdint>
#include <unordered_set>
#include <unordered_map>
#include <array>
#include <algorithm>
#include <iostream>
#include <cassert>
#include <cmath>
#include <sstream>
#include <bitset>
#include <type_traits>
#include <stdexcept>
#include <numeric>
#include <atomic>
#if (WINDOWS)
    #include <windows.h>
    #include <intrin.h>
    #include <winioctl.h>
    #include <winternl.h>
    #include <powerbase.h>
    #include <setupapi.h>
    #include <initguid.h>
    #include <devpkey.h>
    #include <devguid.h>
    #include <winevt.h>
    #pragma comment(lib, "setupapi.lib")
    #pragma comment(lib, "powrprof.lib")
    #pragma comment(lib, "wevtapi.lib")
#elif (LINUX)
    #if (x86)
        #include <cpuid.h>
        #include <x86intrin.h>
        #include <immintrin.h>
    #include <sys/stat.h>
    #include <sys/statvfs.h>
    #include <sys/ioctl.h>
    #include <sys/syscall.h>
    #include <sys/sysinfo.h>
    #include <net/if.h> 
    #include <netinet/in.h>
    #include <unistd.h>
    #include <string.h>
    #include <dirent.h>
    #include <memory>
    #include <cctype>
    #include <fcntl.h>
    #include <limits.h>
    #include <csignal>      
    #include <csetjmp>      
    #include <pthread.h>     
    #include <sched.h>      
    #include <cerrno>   
#elif (APPLE)
    #if (x86)
        #include <cpuid.h>
        #include <x86intrin.h>
        #include <immintrin.h>
    #include <sys/types.h>
    #include <sys/sysctl.h>
    #include <sys/user.h>
    #include <unistd.h>
    #include <time.h>
    #include <errno.h>
    #include <chrono>
#ifdef __VMAWARE_DEBUG__
    #define debug(...) VM::util::debug_msg(__VA_ARGS__)
    #define debug(...)
 * Official aliases for VM brands. This is added to avoid accidental typos
 * which could really mess up the result. Also, no errors/warnings are
 * issued if the string is invalid in case of a typo. For example:
 * scoreboard[VBOX]++;
 * is much better and safer against typos than:
 * scoreboard["VirtualBox"]++;
 * Hopefully this makes sense.
namespace brands { // TODO, remove this in the 2.8.0 or any release after the 2.7.0
    #define LEGACY(name, full_name) \
        [[deprecated("Use VM::brands::" #name " instead")]] \
        static constexpr const char* name = full_name
    LEGACY(NULL_BRAND, "Unknown");
    LEGACY(VBOX, "VirtualBox");
    LEGACY(VMWARE, "VMware");
    LEGACY(VMWARE_EXPRESS, "VMware Express");
    LEGACY(VMWARE_ESX, "VMware ESX");
    LEGACY(VMWARE_GSX, "VMware GSX");
    LEGACY(VMWARE_WORKSTATION, "VMware Workstation");
    LEGACY(VMWARE_FUSION, "VMware Fusion");
    LEGACY(VMWARE_HARD, "VMware (with VmwareHardenedLoader)");
    LEGACY(BHYVE, "bhyve");
    LEGACY(KVM, "KVM");
    LEGACY(QEMU, "QEMU");
    LEGACY(QEMU_KVM, "QEMU+KVM");
    LEGACY(KVM_HYPERV, "KVM Hyper-V Enlightenment");
    LEGACY(QEMU_KVM_HYPERV, "QEMU+KVM Hyper-V Enlightenment");
    LEGACY(HYPERV, "Microsoft Hyper-V");
    LEGACY(HYPERV_VPC, "Microsoft Virtual PC/Hyper-V");
    LEGACY(PARALLELS, "Parallels");
    LEGACY(XEN, "Xen HVM");
    LEGACY(ACRN, "ACRN");
    LEGACY(QNX, "QNX hypervisor");
    LEGACY(HYBRID, "Hybrid Analysis");
    LEGACY(SANDBOXIE, "Sandboxie");
    LEGACY(DOCKER, "Docker");
    LEGACY(WINE, "Wine");
    LEGACY(VPC, "Virtual PC");
    LEGACY(ANUBIS, "Anubis");
    LEGACY(JOEBOX, "JoeBox");
    LEGACY(THREATEXPERT, "ThreatExpert");
    LEGACY(CWSANDBOX, "CWSandbox");
    LEGACY(COMODO, "Comodo");
    LEGACY(BOCHS, "Bochs");
    LEGACY(NVMM, "NetBSD NVMM");
    LEGACY(BSD_VMM, "OpenBSD VMM");
    LEGACY(INTEL_HAXM, "Intel HAXM");
    LEGACY(UNISYS, "Unisys s-Par");
    LEGACY(LMHS, "Lockheed Martin LMHS");
    LEGACY(CUCKOO, "Cuckoo");
    LEGACY(BLUESTACKS, "BlueStacks");
    LEGACY(JAILHOUSE, "Jailhouse");
    LEGACY(APPLE_VZ, "Apple VZ");
    LEGACY(INTEL_KGT, "Intel KGT (Trusty)");
    LEGACY(AZURE_HYPERV, "Microsoft Azure Hyper-V");
    LEGACY(SIMPLEVISOR, "SimpleVisor");
    // not in macro due to mismatch with VM::brands and brands:: renaming this to HYPERV_ROOT
    [[deprecated("Use VM::brands::HYPERV_ROOT instead")]] static constexpr const char* HYPERV_ARTIFACT = "Hyper-V root partition (host system, not an actual VM)";
    LEGACY(UML, "User-mode Linux");
    LEGACY(POWERVM, "IBM PowerVM");
    LEGACY(GCE, "Google Compute Engine (KVM)");
    LEGACY(OPENSTACK, "OpenStack (KVM)");
    LEGACY(KUBEVIRT, "KubeVirt (KVM)");
    LEGACY(AWS_NITRO, "AWS Nitro System EC2 (KVM-based)");
    LEGACY(PODMAN, "Podman");
    LEGACY(WSL, "WSL");
    LEGACY(OPENVZ, "OpenVZ");
    LEGACY(BAREVISOR, "Barevisor");
    LEGACY(HYPERPLATFORM, "HyperPlatform");
    LEGACY(MINIVISOR, "MiniVisor");
    LEGACY(INTEL_TDX, "Intel TDX");
    LEGACY(LKVM, "LKVM");
    LEGACY(AMD_SEV, "AMD SEV");
    LEGACY(AMD_SEV_ES, "AMD SEV-ES");
    LEGACY(AMD_SEV_SNP, "AMD SEV-SNP");
    LEGACY(NEKO_PROJECT, "Neko Project II");
    LEGACY(NOIRVISOR, "NoirVisor");
    LEGACY(QIHOO, "Qihoo 360 Sandbox");
    LEGACY(NSJAIL, "nsjail");
    LEGACY(DBVM, "DBVM");
    LEGACY(UTM, "UTM");
    LEGACY(COMPAQ, "Compaq FX!32");
    LEGACY(INSIGNIA, "Insignia RealPC");
    LEGACY(CONNECTIX, "Connectix Virtual PC");
#if (VMA_CPP >= 17)
    #define VMAWARE_CONSTEXPR constexpr
    #define VMAWARE_CONSTEXPR
#if (VMA_CPP >= 14)
    #define VMAWARE_CONSTEXPR_14 constexpr
    #define VMAWARE_CONSTEXPR_14
struct VM {
    using u8  = std::uint8_t;
    using u16 = std::uint16_t;
    using u32 = std::uint32_t;
    using u64 = std::uint64_t;
    using i8  = std::int8_t;
    using i16 = std::int16_t;
    using i32 = std::int32_t;
    using i64 = std::int64_t;
    enum enum_flags : u8 {
        // Windows
        GPU_CAPABILITIES = 0,
        ACPI_SIGNATURE,
        POWER_CAPABILITIES,
        DISK_SERIAL,
        IVSHMEM,
        DRIVERS,
        HANDLES,
        VIRTUAL_PROCESSORS,
        HYPERVISOR_QUERY,
        AUDIO,
        DISPLAY,
        DLL,
        VMWARE_BACKDOOR,
        WINE_FUNC,
        VIRTUAL_REGISTRY,
        MUTEX,
        DEVICE_STRING,
        VPC_INVALID,
        VMWARE_STR,
        GAMARUE,
        CUCKOO_DIR,
        CUCKOO_PIPE,
        BOOT_LOGO,
        TRAP,
        UD,
        BLOCKSTEP,
        DBVM_HYPERCALL,
        KERNEL_OBJECTS,
        NVRAM,
        EDID,
        CPU_HEURISTIC,
        CLOCK,
        MSR,
        // Linux and Windows
        SYSTEM_REGISTERS,
        FIRMWARE,
        DEVICES,
        AZURE,
        // Linux
        SMBIOS_VM_BIT,
        KMSG,
        CVENDOR,
        QEMU_FW_CFG,
        SYSTEMD,
        CTYPE,
        DOCKERENV,
        DMIDECODE,
        DMESG,
        HWMON,
        LINUX_USER_HOST,
        VMWARE_IOMEM,
        VMWARE_IOPORTS,
        VMWARE_SCSI,
        VMWARE_DMESG,
        QEMU_VIRTUAL_DMI,
        QEMU_USB,
        HYPERVISOR_DIR,
        UML_CPU,
        VBOX_MODULE,
        SYSINFO_PROC,
        DMI_SCAN,
        PODMAN_FILE,
        WSL_PROC,
        FILE_ACCESS_HISTORY,
        MAC,
        NSJAIL_PID,
        BLUESTACKS_FOLDERS,
        AMD_SEV_MSR,
        TEMPERATURE,
        PROCESSES,
        // Linux and MacOS
        THREAD_COUNT,
        // MacOS
        MAC_MEMSIZE,
        MAC_IOKIT,
        MAC_SIP,
        IOREG_GREP,
        HWMODEL,
        MAC_SYS,
        // cross-platform
        HYPERVISOR_BIT,
        VMID,
        THREAD_MISMATCH,
        TIMER,
        CPU_BRAND,
        HYPERVISOR_STR,
        CPUID_SIGNATURE,
        BOCHS_CPU,
        KGT_SIGNATURE,
        // ADD NEW TECHNIQUE ENUM NAME HERE
        // special flags, different to settings
        DEFAULT,
        ALL,
        NULL_ARG, // does nothing, just a placeholder flag mainly for the CLI
        // start of settings technique flags (THE ORDERING IS VERY SPECIFIC HERE AND MIGHT BREAK SOMETHING IF RE-ORDERED)
        HIGH_THRESHOLD,
        DYNAMIC,
        MULTIPLE
    enum class brand_enum : u8 {
        INVALID,
        VBOX,
        VMWARE,
        VMWARE_EXPRESS,
        VMWARE_ESX,
        VMWARE_GSX,
        VMWARE_WORKSTATION,
        VMWARE_FUSION,
        VMWARE_HARD,
        BHYVE,
        KVM,
        QEMU,
        QEMU_KVM,
        KVM_HYPERV,
        QEMU_KVM_HYPERV,
        HYPERV,
        HYPERV_VPC,
        PARALLELS,
        XEN,
        ACRN,
        QNX,
        HYBRID,
        SANDBOXIE,
        DOCKER,
        WINE,
        VPC,
        ANUBIS,
        JOEBOX,
        THREATEXPERT,
        CWSANDBOX,
        COMODO,
        BOCHS,
        NVMM,
        BSD_VMM,
        INTEL_HAXM,
        UNISYS,
        LMHS,
        CUCKOO,
        BLUESTACKS,
        JAILHOUSE,
        APPLE_VZ,
        INTEL_KGT,
        AZURE_HYPERV,
        SIMPLEVISOR,
        HYPERV_ROOT,
        UML,
        POWERVM,
        GCE,
        OPENSTACK,
        KUBEVIRT,
        AWS_NITRO,
        PODMAN,
        WSL,
        OPENVZ,
        BAREVISOR,
        HYPERPLATFORM,
        MINIVISOR,
        INTEL_TDX,
        LKVM,
        AMD_SEV,
        AMD_SEV_ES,
        AMD_SEV_SNP,
        NEKO_PROJECT,
        NOIRVISOR,
        QIHOO,
        NSJAIL,
        DBVM,
        UTM,
        COMPAQ,
        INSIGNIA,
        CONNECTIX,
        NULL_BRAND // do not modify the placement for this, as it's used to count the number of brands here
    static constexpr u8 enum_size = MULTIPLE; // get enum size through value of last element
    static constexpr u8 settings_count = MULTIPLE - HIGH_THRESHOLD + 1; // get number of settings technique flags
    static constexpr u8 INVALID = 255; // explicit invalid technique macro
    static constexpr u16 base_technique_count = HIGH_THRESHOLD; // original technique count, constant on purpose (can also be used as a base count value if custom techniques are added)
    static constexpr u16 threshold_score = 150; // standard threshold score
    static constexpr u16 high_threshold_score = 
E4E
300; // new threshold score from 150 to 300 if VM::HIGH_THRESHOLD flag is enabled
    static constexpr bool SHORTCUT = true; // macro for whether VM::core::run_all() should take a shortcut by skipping the rest of the techniques if the threshold score is already met
    static constexpr size_t MAX_CUSTOM_TECHNIQUES = 256; // specific to VM::add_custom(), where custom techniques will be stored here
    static constexpr size_t MAX_BRANDS = static_cast<size_t>(brand_enum::NULL_BRAND) + 1; // VM scoreboard table specifically for VM::brand()
    // intended for loop indexes
    static constexpr u8 enum_begin = 0;
    static constexpr u8 enum_end = enum_size + 1;
    static constexpr u8 technique_begin = enum_begin;
    static constexpr u8 technique_end = DEFAULT;
    static constexpr u8 settings_begin = DEFAULT;
    static constexpr u8 settings_end = enum_end;
    // for platform compatibility ranges
    static constexpr u8 WINDOWS_START = VM::GPU_CAPABILITIES;
    static constexpr u8 WINDOWS_END = VM::AZURE;
    static constexpr u8 LINUX_START = VM::SYSTEM_REGISTERS;
    static constexpr u8 LINUX_END = VM::THREAD_COUNT;
    static constexpr u8 MACOS_START = VM::THREAD_COUNT;
    static constexpr u8 MACOS_END = VM::MAC_SYS;
    // this is specifically meant for VM::detected_count() to 
    // get the total number of techniques that detected a VM
    static u8 detected_count_num; 
    static u16 technique_count; // get total number of techniques
    static std::vector<enum_flags> disabled_techniques;
#if (WINDOWS)
    using brand_score_t = i32;
    using brand_score_t = u8;
    // for the flag bitset structure
    using flagset = std::bitset<enum_size + 1>;
    // specific to brands
    using brand_element_t = std::pair<brand_enum, brand_score_t>;
    using brand_list_t = std::vector<brand_element_t>;
    using brand_array_t = std::array<brand_element_t, MAX_BRANDS>;
    // constructor stuff
    VM() = delete;
    VM(const VM&) = delete;
    VM(VM&&) = delete;
    // macro for bypassing unused parameter/variable warnings
    #define VMAWARE_UNUSED(x) ((void)(x))
    // specifically for util::hyper_x() and memo::hyperv
    enum hyperx_state : u8 {
        HYPERV_UNKNOWN = 0,
        HYPERV_REAL_VM,
        HYPERV_ARTIFACT_VM,
        HYPERV_ENLIGHTENMENT
    // various cpu operation stuff
    struct cpu {
        // cpuid leaf values
        struct leaf {
            static constexpr u32
                func_ext = 0x80000000,
                proc_ext = 0x80000001,
                brand1 = 0x80000002,
                brand2 = 0x80000003,
                brand3 = 0x80000004,
                hypervisor = 0x40000000,
                amd_easter_egg = 0x8fffffff;
        #if (MSVC)
            #define CPUID_COUNT(leaf, subleaf, a_ptr, b_ptr, c_ptr, d_ptr) \
                        int __cpuid_regs[4]; \
                        __cpuidex(__cpuid_regs, static_cast<int>(leaf), static_cast<int>(subleaf)); \
                        *(a_ptr) = static_cast<unsigned int>(__cpuid_regs[0]); \
                        *(b_ptr) = static_cast<unsigned int>(__cpuid_regs[1]); \
                        *(c_ptr) = static_cast<unsigned int>(__cpuid_regs[2]); \
                        *(d_ptr) = static_cast<unsigned int>(__cpuid_regs[3]); \
                    } while (0)
        #else
            #define CPUID_COUNT(leaf, subleaf, a_ptr, b_ptr, c_ptr, d_ptr) \
                        __get_cpuid_count((unsigned)(leaf), (unsigned)(subleaf), (a_ptr), (b_ptr), (c_ptr), (d_ptr)); \
                    } while (0)
        #endif
        // cross-platform wrapper for linux and MSVC cpuid
        static void cpuid
            u32& a, u32& b, u32& c, u32& d,
            const u32 a_leaf,
            const u32 c_leaf = 0xFF  // dummy value if not set manually
        #if (x86)
            // may be unmodified for older 32-bit processors, clearing just in case
            unsigned int aa = 0u, bb = 0u, cc = 0u, dd = 0u;
            CPUID_COUNT(a_leaf, c_leaf, &aa, &bb, &cc, &dd);
            a = static_cast<u32>(aa);
            b = static_cast<u32>(bb);
            c = static_cast<u32>(cc);
            d = static_cast<u32>(dd);
        #endif
            return;
        // same as above but for array type parameters (MSVC specific)
        static void cpuid
            i32 x[4],
            const u32 a_leaf,
            const u32 c_leaf = 0xFF
        #if (x86)
            // may be unmodified for older 32-bit processors, clearing just in case
            x[0] = 0;
            x[1] = 0;
            x[2] = 0;
            x[3] = 0;
            unsigned int aa = 0u, bb = 0u, cc = 0u, dd = 0u;
            CPUID_COUNT(a_leaf, c_leaf, &aa, &bb, &cc, &dd);
            x[0] = static_cast<i32>(aa);
            x[1] = static_cast<i32>(bb);
            x[2] = static_cast<i32>(cc);
            x[3] = static_cast<i32>(dd);
        #endif
            return;
        static bool is_leaf_supported(const u32 p_leaf) {
        #if (APPLE) 
            return false;
        #endif
            bool cached;
            if (memo::leaf_cache::fetch(p_leaf, cached)) {
                return cached;
            u32 eax = 0, unused = 0;
            bool supported = false;
            if (p_leaf < 0x40000000) {
                // Standard range: 0x00000000 - 0x3FFFFFFF
                cpu::cpuid(eax, unused, unused, unused, 0x00000000);
                debug("CPUID: max standard leaf = ", eax);
                supported = (p_leaf <= eax);
            else if (p_leaf < 0x80000000) {
                // Hypervisor range: 0x40000000 - 0x7FFFFFFF
                cpu::cpuid(eax, unused, unused, unused, cpu::leaf::hypervisor);
                debug("CPUID: max hypervisor leaf = ", eax);
                supported = (p_leaf <= eax);
            else if (p_leaf < 0xC0000000) {
                // Extended range: 0x80000000 - 0xBFFFFFFF
                cpu::cpuid(eax, unused, unused, unused, cpu::leaf::func_ext);
                debug("CPUID: max extended leaf = ", eax);
                supported = (p_leaf <= eax);
            else {
                supported = false;
            memo::leaf_cache::store(p_leaf, supported);
            return supported;
        [[nodiscard]] static bool is_amd() {
            constexpr u32 amd_ecx = 0x444d4163; // "cAMD"
            u32 unused, ecx = 0;
            cpuid(unused, unused, ecx, unused, 0);
            return (ecx == amd_ecx);
        [[nodiscard]] static bool is_intel() {
            constexpr u32 intel_ecx1 = 0x6c65746e; // "ntel"
            constexpr u32 intel_ecx2 = 0x6c65746f; // "otel", this is because some Intel CPUs have a rare manufacturer string of "GenuineIotel"
            u32 unused, ecx = 0;
            cpuid(unused, unused, ecx, unused, 0);
            return ((ecx == intel_ecx1) || (ecx == intel_ecx2));
        [[nodiscard]] static const char* get_brand() {
            if (memo::cpu_brand::is_cached()) {
                return memo::cpu_brand::fetch();
        #if (!x86 || APPLE)
            return "Unknown";
        #else
            if (!cpu::is_leaf_supported(cpu::leaf::brand3)) {
                return "Unknown";
            alignas(16) char buffer[49]{};
            u32* regs = reinterpret_cast<u32*>(buffer);
            // unrolled calls to fill buffer directly
            cpu::cpuid(regs[0], regs[1], regs[2], regs[3], cpu::leaf::brand1);
            cpu::cpuid(regs[4], regs[5], regs[6], regs[7], cpu::leaf::brand2);
            cpu::cpuid(regs[8], regs[9], regs[10], regs[11], cpu::leaf::brand3);
            buffer[48] = '\0';
            // do NOT touch trailing spaces for the AMD_THREAD_MISMATCH technique
            // left-trim only to handle stupid whitespaces before the brand string in ARM CPUs (Virtual CPUs)
            const char* start_ptr = buffer;
            while (*start_ptr && std::isspace(static_cast<u8>(*start_ptr))) {
                ++start_ptr;
            memo::cpu_brand::store(start_ptr);
            debug("CPU: ", start_ptr);
            // Return pointer to the static cache, not the local stack buffer
            return memo::cpu_brand::fetch();
        #endif
      
43AD
  [[nodiscard]] static std::string cpu_manufacturer(const u32 leaf_id) {
            alignas(16) char buffer[13]{};
            u32* regs = reinterpret_cast<u32*>(buffer);
            u32 eax, ebx, ecx, edx;
            cpu::cpuid(eax, ebx, ecx, edx, leaf_id);
            if (ebx == 0 && ecx == 0 && edx == 0) {
                return "";
            if (leaf_id >= 0x40000000) {
                regs[0] = ebx;
                regs[1] = ecx;
                regs[2] = edx;
            else {
                regs[0] = ebx;
                regs[1] = edx;
View remainder of file in raw view
Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FilesExpand file tree

vmaware.hpp

Latest commit

History

vmaware.hpp

File metadata and controls
