-
Notifications
You must be signed in to change notification settings - Fork 111
Expand file tree
/
Copy pathcli.cpp
More file actions
executable file
·1466 lines (1262 loc) · 67.5 KB
/
cli.cpp
File metadata and controls
executable file
·1466 lines (1262 loc) · 67.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/**
* ██╗ ██╗███╗ ███╗ █████╗ ██╗ ██╗ █████╗ ██████╗ ███████╗
* ██║ ██║████╗ ████║██╔══██╗██║ ██║██╔══██╗██╔══██╗██╔════╝
* ██║ ██║██╔████╔██║███████║██║ █╗ ██║███████║██████╔╝█████╗
* ╚██╗ ██╔╝██║╚██╔╝██║██╔══██║██║███╗██║██╔══██║██╔══██╗██╔══╝
* ╚████╔╝ ██║ ╚═╝ ██║██║ ██║╚███╔███╔╝██║ ██║██║ ██║███████╗
* ╚═══╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝
*
* C++ VM detection library
*
* ===============================================================
*
* This is the main CLI code, which demonstrates the majority
* of the library's capabilities while also providing as a
* practical and general VM detection tool for everybody to use
*
* ===============================================================
*
* - Made by: @kernelwernel (https://github.com/kernelwernel)
* - Co-developed by: Requiem (https://github.com/NotRequiem)
* - Repository: https://github.com/kernelwernel/VMAware
* - License: MIT
*/
#include <vector>
#include <chrono>
#if (defined(__GNUC__) || defined(__linux__))
#define CLI_LINUX 1
#else
#define CLI_LINUX 0
#endif
#if (defined(__APPLE__) || defined(__APPLE_CPP__) || defined(__MACH__) || defined(__DARWIN))
#define CLI_APPLE 1
#include <mach-o/dyld.h>
#else
#define CLI_APPLE 0
#endif
#if (defined(_MSC_VER) || defined(_WIN32) || defined(_WIN64) || defined(__MINGW32__))
#define CLI_WINDOWS 1
#define WIN32_LEAN_AND_MEAN
#define NOMINMAX
#else
#define CLI_WINDOWS 0
#endif
#include "vmaware.hpp"
constexpr const char* ver = "2.6.0";
constexpr const char* date = "January 2026";
std::string bold = "\033[1m";
std::string underline = "\033[4m";
std::string ansi_exit = "\x1B[0m";
std::string red = "\x1B[38;2;239;75;75m";
std::string orange = "\x1B[38;2;255;180;5m";
std::string green = "\x1B[38;2;94;214;114m";
std::string red_orange = "\x1B[38;2;247;127;40m";
std::string green_orange = "\x1B[38;2;174;197;59m";
std::string grey = "\x1B[38;2;108;108;108m";
using u8 = std::uint8_t;
using u16 = std::uint16_t;
using u32 = std::uint32_t;
using u64 = std::uint64_t;
using i32 = std::int32_t;
enum arg_enum : u8 {
HELP,
VERSION,
ALL,
DETECT,
STDOUT,
BRAND,
BRAND_LIST,
PERCENT,
CONCLUSION,
NUMBER,
TYPE,
OUTPUT,
NOTES,
HIGH_THRESHOLD,
NO_ANSI,
DYNAMIC,
VERBOSE,
ENUMS,
DETECTED_ONLY,
JSON,
NULL_ARG
};
constexpr u8 arg_bits = static_cast<u8>(NULL_ARG) + 1;
std::bitset<arg_bits> arg_bitset;
u8 unsupported_count = 0;
u8 supported_count = 0;
u8 no_perms_count = 0;
u8 disabled_count = 0;
std::string detected = ("[ " + green + "DETECTED" + ansi_exit + " ]");
std::string not_detected = ("[" + red + "NOT DETECTED" + ansi_exit + "]");
std::string no_support = ("[ " + grey + "NO SUPPORT" + ansi_exit + " ]");
std::string no_perms = ("[" + grey + " NO PERMS " + ansi_exit + "]");
std::string note = ("[ NOTE ]");
std::string disabled = ("[" + grey + " DISABLED " + ansi_exit + "]");
#if (CLI_WINDOWS)
class win_ansi_enabler_t
{
public:
win_ansi_enabler_t()
: m_set(FALSE),
m_old(0),
m_out(GetStdHandle(STD_OUTPUT_HANDLE))
{
if (m_out != nullptr && m_out != INVALID_HANDLE_VALUE)
{
if (GetConsoleMode(m_out, &m_old) != FALSE)
{
m_set = SetConsoleMode(m_out, m_old | ENABLE_VIRTUAL_TERMINAL_PROCESSING);
}
}
}
~win_ansi_enabler_t()
{
if (m_set != FALSE)
{
SetConsoleMode(m_out, m_old);
}
}
private:
win_ansi_enabler_t(win_ansi_enabler_t const&) = delete;
private:
bool m_set;
DWORD m_old;
HANDLE m_out;
};
#endif
struct SHA256 {
u8 buf[64] = {}; // message block buffer
u32 len = 0; // bytes currently in buf
u64 bits = 0; // total bits processed
u32 s[8] = {}; // from h0 to h7
// Initialize state to SHA-256 IVs so that compiler doesn't complain
SHA256() {
len = 0;
bits = 0;
s[0] = 0x6a09e667;
s[1] = 0xbb67ae85;
s[2] = 0x3c6ef372;
s[3] = 0xa54ff53a;
s[4] = 0x510e527f;
s[5] = 0x9b05688c;
s[6] = 0x1f83d9ab;
s[7] = 0x5be0cd19;
}
// bitwise helpers
static u32 rotr(u32 x, int n) { return (x >> n) | (x << (32 - n)); }
static u32 ch(u32 x, u32 y, u32 z) { return (x & y) ^ (~x & z); }
static u32 maj(u32 x, u32 y, u32 z) { return (x & y) ^ (x & z) ^ (y & z); }
static u32 ep0(u32 x) { return rotr(x, 2) ^ rotr(x, 13) ^ rotr(x, 22); }
static u32 ep1(u32 x) { return rotr(x, 6) ^ rotr(x, 11) ^ rotr(x, 25); }
static u32 sig0(u32 x) { return rotr(x, 7) ^ rotr(x, 18) ^ (x >> 3); }
static u32 sig1(u32 x) { return rotr(x, 17) ^ rotr(x, 19) ^ (x >> 10); }
// we need to process one 512-bit block from buf
void transform() {
static const u32 k[64] = {
0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
};
u32 m[64]{};
for (u32 i = 0, j = 0; i < 16; ++i, j += 4) {
m[i] = (u32)buf[j] << 24 | (u32)buf[j + 1] << 16 | (u32)buf[j + 2] << 8 | (u32)buf[j + 3];
}
for (u32 i = 16; i < 64; ++i) {
m[i] = sig1(m[i - 2]) + m[i - 7] + sig0(m[i - 15]) + m[i - 16];
}
u32 a = s[0];
u32 b = s[1];
u32 c = s[2];
u32 d = s[3];
u32 e = s[4];
u32 f = s[5];
u32 g = s[6];
u32 h = s[7];
for (u32 i = 0; i < 64; ++i) {
u32 t1 = h + ep1(e) + ch(e, f, g) + k[i] + m[i];
u32 t2 = ep0(a) + maj(a, b, c);
h = g;
g = f;
f = e;
e = d + t1;
d = c;
c = b;
b = a;
a = t1 + t2;
}
s[0] += a;
s[1] += b;
s[2] += c;
s[3] += d;
s[4] += e;
s[5] += f;
s[6] += g;
s[7] += h;
}
// arbitrary bytes into the digest
void update(const u8* data, size_t n) {
for (size_t i = 0; i < n; ++i) {
buf[len++] = data[i];
if (len == 64) {
transform();
bits += 512;
len = 0;
}
}
}
// 32-byte digest IN big-endian
void final(u8 out[32]) {
size_t i = len;
if (len < 56) {
buf[i++] = 0x80;
while (i < 56) buf[i++] = 0;
}
else {
buf[i++] = 0x80;
while (i < 64) buf[i++] = 0;
transform();
for (size_t j = 0; j < 56; ++j) buf[j] = 0;
}
bits += (u64)len * 8;
for (int j = 0; j < 8; ++j) {
buf[63 - j] = (u8)((bits >> (8 * j)) & 0xFF);
}
transform();
for (i = 0; i < 4; ++i) {
for (size_t j = 0; j < 8; ++j) {
out[i + j * 4] = (u8)((s[j] >> (24 - i * 8)) & 0xFF);
}
}
}
};
static std::string exe_path() {
#if (CLI_WINDOWS)
std::vector<char> buf(32768);
DWORD r = GetModuleFileNameA(NULL, buf.data(), (DWORD)buf.size());
if (r == 0 || r >= buf.size()) return {};
return std::string(buf.data(), r);
#elif (CLI_APPLE)
uint32_t sz = 0;
_NSGetExecutablePath(nullptr, &sz);
std::vector<char> b(sz);
if (_NSGetExecutablePath(b.data(), &sz) != 0) return {};
std::vector<char> resolved(PATH_MAX);
if (realpath(b.data(), resolved.data())) {
return std::string(resolved.data());
}
return std::string(b.data());
#else
std::vector<char> b(PATH_MAX);
ssize_t l = ::readlink("/proc/self/exe", b.data(), b.size() - 1);
if (l <= 0) return {};
b[(size_t)l] = '\0';
std::vector<char> resolved(PATH_MAX);
if (realpath(b.data(), resolved.data())) {
return std::string(resolved.data());
}
return std::string(b.data());
#endif
}
static std::string compute_self_sha256() {
std::string path = exe_path();
if (path.empty()) return {};
std::ifstream ifs(path, std::ios::binary);
if (!ifs) return {};
SHA256 sha;
std::vector<char> chunk(64 * 1024);
while (ifs) {
ifs.read(chunk.data(), static_cast<std::streamsize>(chunk.size()));
std::streamsize r = ifs.gcount();
if (r > 0) {
sha.update(reinterpret_cast<const u8*>(chunk.data()), static_cast<size_t>(r));
}
}
u8 digest[32];
sha.final(digest);
std::string out;
out.reserve(64);
static constexpr char hex[] = "0123456789abcdef";
for (int i = 0; i < 32; ++i) {
out.push_back(hex[(digest[i] >> 4) & 0xF]);
out.push_back(hex[digest[i] & 0xF]);
}
return out;
}
[[noreturn]] static void help(void) {
std::cout <<
R"(Usage:
vmaware [option] [extra]
(do not run with any options if you want the full summary)
Options:
-h | --help prints this help menu
-v | --version print CLI version and other details
-a | --all run the result with ALL the techniques enabled (might contain false positives)
-d | --detect returns the result as a boolean (1 = VM, 0 = baremetal)
-s | --stdout returns either 0 or 1 to STDOUT without any text output (0 = VM, 1 = baremetal)
-b | --brand returns the VM brand string
-l | --brand-list returns all the possible VM brand string values
-p | --percent returns the VM percentage between 0 and 100
-c | --conclusion returns the conclusion message string
-n | --number returns the number of VM detection techniques it performs
-t | --type returns the VM type (if a VM was found)
-o | --output set the output path for files, specifically with the --json command
Extra:
--disable-notes no notes will be provided
--high-threshold a higher threshold bar for a VM detection will be applied
--no-ansi removes color and ansi escape codes from the output
--dynamic allow the conclusion message to be dynamic (8 possibilities instead of only 2)
--verbose add more information to the output
--enums display the technique enum name used by the lib
--detected-only only display the techniques that were detected
--json output a json-formatted file of the results
)";
std::exit(0);
}
[[noreturn]] static void version(void) {
std::cout << "vmaware " << "v" << ver << " (" << date << ")\n\n" <<
"Derived project of VMAware library at https://github.com/kernelwernel/VMAware\n"
"License MIT:<https://opensource.org/license/mit>.\n" <<
"This is free software: you are free to change and redistribute it.\n" <<
"There is NO WARRANTY, to the extent permitted by law.\n" <<
"Developed and maintained by kernelwernel and Requiem,\n" <<
"see https://github.com/kernelwernel and https://github.com/NotRequiem\n" <<
"For any inquiries, contact us on Discord at shenzken or kr.nl, or email us at jeanruyv@gmail.com\n";
std::exit(0);
}
static const char* color(const u8 score, const bool is_hardened) {
if (arg_bitset.test(NO_ANSI)) {
return "";
}
if (is_hardened) {
return green.c_str();
}
if (arg_bitset.test(DYNAMIC)) {
if (score == 0) { return red.c_str(); }
else if (score <= 12) { return red.c_str(); }
else if (score <= 25) { return red_orange.c_str(); }
else if (score < 50) { return red_orange.c_str(); }
else if (score <= 62) { return orange.c_str(); }
else if (score <= 75) { return green_orange.c_str(); }
else if (score < 100) { return green.c_str(); }
else if (score == 100) { return green.c_str(); }
} else {
if (score == 100) {
return green.c_str();
} else {
return red.c_str();
}
}
return "";
}
[[noreturn]] static void brand_list() {
std::cout <<
R"(VirtualBox
VMware
VMware Express
VMware ESX
VMware GSX
VMware Workstation
VMware Fusion
bhyve
QEMU
KVM
KVM Hyper-V Enlightenment
QEMU+KVM Hyper-V Enlightenment
QEMU+KVM
Virtual PC
Microsoft Hyper-V
Microsoft Virtual PC/Hyper-V
Parallels
Xen HVM
ACRN
QNX hypervisor
Hybrid Analysis
Sandboxie
Docker
Wine
Anubis
JoeBox
ThreatExpert
CWSandbox
Comodo
Bochs
Lockheed Martin LMHS
NVMM
OpenBSD VMM
Intel HAXM
Unisys s-Par
Cuckoo
BlueStacks
Jailhouse
Apple VZ
Intel KGT (Trusty)
Microsoft Azure Hyper-V
Xbox NanoVisor (Hyper-V)
SimpleVisor
Hyper-V artifact (host with Hyper-V enabled)
User-mode Linux
IBM PowerVM
Google Compute Engine (KVM)
OpenStack (KVM)
KubeVirt (KVM)
AWS Nitro System (KVM-based)
Podman
WSL
OpenVZ
ANY.RUN
Barevisor
HyperPlatform
MiniVisor
Intel TDX
LKVM
AMD SEV
AMD SEV-ES
AMD SEV-SNP
Neko Project II
NoirVisor
Qihoo 360 Sandbox
nsjail
DBVM
UTM
Compaq FX!32
Insignia RealPC
Connectix Virtual PC
)";
std::exit(0);
}
static bool is_admin() {
#if (CLI_LINUX)
const uid_t uid = getuid();
const uid_t euid = geteuid();
const bool is_root = (
(uid != euid) ||
(euid == 0)
);
return is_root;
#elif (WINDOWS)
bool is_admin = false;
HANDLE hToken = nullptr;
if (OpenProcessToken(reinterpret_cast<HANDLE>(-1LL), TOKEN_QUERY, &hToken)) {
TOKEN_ELEVATION elevation{};
DWORD dwSize;
if (GetTokenInformation(hToken, TokenElevation, &elevation, sizeof(elevation), &dwSize)) {
if (elevation.TokenIsElevated)
is_admin = true;
}
CloseHandle(hToken);
}
return is_admin;
#endif
}
#if (CLI_LINUX)
static bool are_perms_required(const VM::enum_flags flag) {
if (is_admin()) {
return false;
}
switch (flag) {
case VM::VMWARE_DMESG:
case VM::DMIDECODE:
case VM::DMESG:
case VM::QEMU_USB:
case VM::KMSG:
case VM::SMBIOS_VM_BIT:
case VM::NVRAM: return true;
default: return false;
}
}
#endif
static bool is_disabled(const VM::enum_flags flag) {
if (arg_bitset.test(ALL)) {
return false;
}
return flag == VM::VMWARE_DMESG;
}
static bool is_unsupported(VM::enum_flags flag) {
// is cross-platform?
if (
(flag >= VM::HYPERVISOR_BIT) &&
(flag <= VM::KGT_SIGNATURE)
) {
return false;
}
#if (CLI_LINUX)
return (
(flag >= VM::LINUX_START) &&
(flag <= VM::LINUX_END)
);
#elif (CLI_WINDOWS)
return (
(flag >= VM::WINDOWS_START) &&
(flag <= VM::WINDOWS_END)
);
#elif (APPLE)
return (
(flag >= VM::MACOS_START) &&
(flag <= VM::MACOS_END)
);
#else
return true;
#endif
}
// just a simple string replacer
static void replace(std::string &text, const std::string &original, const std::string &new_brand) {
size_t start_pos = 0;
while ((start_pos = text.find(original, start_pos)) != std::string::npos) {
text.replace(start_pos, original.length(), new_brand);
start_pos += new_brand.length();
}
}
static bool is_vm_brand_multiple(const std::string& vm_brand) {
return (vm_brand.find(" or ") != std::string::npos);
}
static const char* get_vm_description(const std::string& vm_brand) {
// if there's multiple brands, return null
if (is_vm_brand_multiple(vm_brand)) {
return "";
}
struct BrandEntry {
const char* brand;
const char* description;
};
static const BrandEntry table[] = {
{ VM::brands::VBOX, "Oracle VirtualBox (formerly Sun VirtualBox, Sun xVM VirtualBox and InnoTek VirtualBox) is a free and commercial hosted hypervisor for x86 and Apple ARM64 virtualization developed by Oracle Corporation initially released in 2007. It supports Intel's VT-x and AMD's AMD-V hardware-assisted virtualization, while providing an extensive feature set as a staple of its flexibility and wide use cases." },
{ VM::brands::VMWARE, "VMware is a free and commercial type 2 hypervisor initially released in 1999 and acquired by EMC, then Dell, and finally Broadcom Inc in 2023. It was the first commercially successful company to virtualize the x86 architecture, and has since produced many sub-versions of the hypervisor since its inception. It uses binary translation to re-write the code dynamically for a faster performance." },
{ VM::brands::VMWARE_EXPRESS, "VMware Express (formerly VMware GSX Server Express) was a free entry-level version of VMware's hosted hypervisor for small-scale virtualization. Released in 2003, it offered basic VM management capabilities but lacked advanced features like VMotion. Discontinued in 2006 as VMware shifted focus to enterprise solutions like ESX and vSphere." },
{ VM::brands::VMWARE_ESX, "VMware ESX (Elastic Sky X) was a type 1 bare-metal hypervisor released in 2001 for enterprise environments. It introduced VMFS clustered filesystems and direct hardware access through its service console. Deprecated in 2010 in favor of the lighter ESXi architecture, which removed the Linux-based service console for improved security." },
{ VM::brands::VMWARE_GSX, "VMware GSX Server (Ground Storm X) was a commercial type 2 hypervisor (2001-2006) for Windows/Linux hosts, targeting departmental server consolidation. Supported features like VM snapshots and remote management through VI Web Access. Discontinued as VMware transitioned to ESX's bare-metal architecture for better performance in enterprise environments." },
{ VM::brands::VMWARE_WORKSTATION, "VMware Workstation is a commercial type 2 hypervisor for Windows/Linux hosts, first released in 1999. Enables nested virtualization, 4K display support, and DirectX 11/OpenGL 4.1 acceleration. Popular with developers for testing multi-tier configurations and legacy OS compatibility through its Unity view mode." },
{ VM::brands::VMWARE_FUSION, "VMware Fusion was a macOS-hosted hypervisor (2007-2024) that allowed Intel-based Macs to run Windows/Linux VMs with Metal graphics acceleration and Retina display support. Discontinued due to Apple's transition to ARM64 architecture with Apple Silicon chips, which required significant architectural changes incompatible with x86 virtualization." },
{ VM::brands::VMWARE_HARD, "VMWare Hardener Loader is an open-source detection mitigation loader to harden vmware virtual machines against VM detection for Windows (vista~win10) x64 guests." },
{ VM::brands::BHYVE, "bhyve (pronounced \"bee hive\", formerly written as BHyVe for \"BSD hypervisor\") is a free type 2 hosted hypervisor initially written for FreeBSD. It can also be used on a number of illumos based distributions including SmartOS, OpenIndiana, and OmniOS. bhyve has a modern codebase and uses fewer resources compared to its competitors. In the case of FreeBSD, the resource management is more efficient." },
{ VM::brands::KVM, "KVM is a free and open source module of the Linux kernel released in 2007. It uses hardware virtualization extensions, and has had support for hot swappable vCPUs, dynamic memory management, and Live Migration. It also reduces the impact that memory write-intensive workloads have on the migration process. KVM emulates very little hardware components, and it defers to a higher-level client application such as QEMU." },
{ VM::brands::QEMU, "The Quick Emulator (QEMU) is a free and open-source emulator that uses dynamic binary translation to emulate a computer's processor. It translates the emulated binary codes to an equivalent binary format which is executed by the machine. It provides a variety of hardware and device models for the VM, while often being combined with KVM. However, no concrete evidence of KVM was found for this system." },
{ VM::brands::QEMU_KVM, "QEMU (a free and open-source emulator that uses dynamic binary translation to emulate a computer's processor) is being used with Kernel-based Virtual Machine (KVM, a free and open source module of the Linux kernel) to virtualize hardware at near-native speeds." },
{ VM::brands::KVM_HYPERV, "KVM-HyperV integration allows Linux KVM hosts to expose Hyper-V-compatible paravirtualization interfaces to Windows guests. Enables performance optimizations like enlightened VMCS (Virtual Machine Control Structure) and TSC (Time Stamp Counter) synchronization, reducing overhead for Windows VMs running on Linux hypervisors." },
{ VM::brands::QEMU_KVM_HYPERV, "A QEMU/KVM virtual machine with Hyper-V enlightenments. These features make Windows and Hyper-V guests think they’re running on top of a Hyper-V compatible hypervisor and use Hyper-V specific features." },
{ VM::brands::HYPERV, "Hyper-V is Microsoft's proprietary native hypervisor that can create x86 VMs on Windows. Released in 2008, it supercedes previous virtualization solutions such as Microsoft Virtual Server and Windows VirtualPC. Hyper-V uses partitioning to isolate the guest OSs, and has \"enlightenment\" features for bypassing device emulation layers, allowing for faster execution including when Windows is virtualized on Linux." },
{ VM::brands::HYPERV_VPC, "Either Hyper-V or VirtualPC were detected. Hyper-V is Microsoft's proprietary native hypervisor that can create x86 VMs on Windows. Virtual PC is a discontinued x86 emulator software for Microsoft Windows hosts and PowerPC-based Mac hosts." },
{ VM::brands::PARALLELS, "Parallels is a hypervisor providing hardware virtualization for Mac computers. It was released in 2006 and is developed by Parallels, a subsidiary of Corel. It is a hardware emulation virtualization software, using hypervisor technology that works by mapping the host computer's hardware resources directly to the VM's resources. Each VM thus operates with virtually all the resources of a physical computer." },
{ VM::brands::XEN, "Xen is a free and open-source type 1 hypervisor. Originally developed by the University of Cambridge Computer Laboratory and is now being developed by the Linux Foundation with support from Intel, Arm Ltd, Huawei, AWS, Alibaba Cloud, AMD, and more. It runs in a more privileged CPU state than any other software on the machine, except for firmware. It uses GNU GRUB as its bootloader, and then loads a paravirtualized host OS into the host domain (dom0)." },
{ VM::brands::ACRN, "ACRN is an open source reference type 1 hypervisor stack made by the Linux Foundation Project targeting the IoT, Embedded, Edge segments. Its objective is to cater to the needs of those who require to run Virtual Machines with Real-Time characteristics, or where Functional Safety workloads need to be isolated from other workloads running on the same hardware platform." },
{ VM::brands::QNX, "QNX Hypervisor is a real-time virtualization platform for embedded systems, enabling concurrent execution of QNX Neutrino RTOS and Linux/Android on ARM/x86. Provides time partitioning with <1 microsecond interrupt latency for automotive systems, certified to ISO 26262 ASIL D safety standards. Used in Audi MIB3 and BMW iDrive systems." },
{ VM::brands::HYBRID, "Hybrid Analysis is a sandbox that combines basic and dynamic analysis techniques to detect malicious code that is trying to hide. It extracts indicators of compromise (IOCs) from both runtime data and memory dump analysis, providing a comprehensive approach to malware analysis." },
{ VM::brands::SANDBOXIE, "Sandboxie is an open-source OS-level virtualization solution for Microsoft Windows, an application sandbox for Windows that redirects file/registry writes to virtualized storage. Acquired by Sophos in 2019 and open-sourced in 2020, it uses kernel-mode drivers (SbieDrv.sys) to isolate processes without full VM overhead. Commonly used for testing untrusted software or browsing securely." },
{ VM::brands::DOCKER, "Docker is a set of platform as a service (PaaS) products that use OS-level virtualization to deliver software in packages called containers. The service has both free and premium tiers. The software that hosts the containers is called Docker Engine. It's used to automate the deployment of applications in lightweight containers so that applications can work efficiently in different environments in isolation." },
{ VM::brands::WINE, "Wine is a free and open-source compatibility layer to allow application software and computer games developed for Microsoft Windows to run on Unix-like operating systems. Developers can compile Windows applications against WineLib to help port them to Unix-like systems. Wine is predominantly written using black-box testing reverse-engineering, to avoid copyright issues. No code emulation or virtualization occurs." },
{ VM::brands::VPC, "Microsoft Virtual PC (2004-2011) was a consumer-focused type 2 hypervisor for running Windows XP/Vista guests. Featured \"Undo Disks\" for rollback capability and host-guest integration components. Discontinued after Windows 7's XP Mode due to Hyper-V's emergence, lacking hardware-assisted virtualization support." },
{ VM::brands::ANUBIS, "Anubis is a tool for analyzing the behavior of Windows PE-executables with special focus on the analysis of malware. Execution of Anubis results in the generation of a report file that contains enough information to give a human user a very good impression about the purpose and the actions of the analyzed binary. The generated report includes detailed data about modifications made to the Windows registry or the file system, about interactions with the Windows Service Manager or other processes and of course it logs all generated network traffic." },
{ VM::brands::JOEBOX, "Joe Sandbox (formerly JoeBox) is a cloud-based malware analysis solution with Deep Learning classification. Features multi-OS analysis (Windows/Linux/Android), memory forensics, and MITRE ATT&CK mapping. Offers hybrid analysis combining static/dynamic techniques with 400+ behavioral indicators for enterprise threat hunting." },
{ VM::brands::THREATEXPERT, "ThreatExpert was an automated malware analysis service (2007-2013) that provided behavioral reports via web API. Pioneered mass-scale analysis with heuristic detection of packers/rootkits. Discontinued as competing services like VirusTotal and Hybrid Analysis adopted similar cloud-based approaches with richer feature sets." },
{ VM::brands::CWSANDBOX, "CWSandbox is a tool for malware analysis, developed by Carsten Willems as part of his thesis and Ph.D. studies." },
{ VM::brands::COMODO, "Comodo is a proprietary sandbox running an isolated operating environment. Comodo have integrated sandboxing technology directly into the security architecture of Comodo Internet Security to complement and strengthen the Firewall, Defense+ and Antivirus modules of their product line. It features a hybrid of user mode hooks along with a kernel mode driver, preventing any modification to files or registry on the host machine." },
{ VM::brands::BOCHS, "Bochs (pronounced \"box\") is a free and open-source portable IA-32 and x86-64 IBM PC compatible emulator and debugger mostly written in C++. Bochs is mostly used for OS development and to run other guest OSs inside already running host OSs, while emulating the hardware needed such as hard drives, CD drives, and floppy drives. It doesn't utilize any host CPU virtualization features, therefore is slower than most virtualization software." },
{ VM::brands::NVMM, "NVMM (NetBSD Virtual Machine Monitor) is NetBSD's native hypervisor for NetBSD 9.0. It provides a virtualization API, libnvmm, that can be leveraged by emulators such as QEMU. A unique property of NVMM is that the kernel never accesses guest VM memory, only creating it. Intel's Hardware Accelerated Execution Manager (HAXM) provides an alternative solution for acceleration in QEMU for Intel CPUs only, similar to Linux's KVM." },
{ VM::brands::BSD_VMM, "BSD VMM is FreeBSD's kernel subsystem powering the bhyve hypervisor. Implements Intel VT-x/AMD-V virtualization with direct device assignment (PCI passthrough). Supports UEFI boot and VirtIO paravirtualized devices, optimized for FreeBSD guests with FreeBSD-specific virtio_net(4) and virtio_blk(4) drivers." },
{ VM::brands::INTEL_HAXM, "HAXM was created to bring Intel Virtualization Technology to Windows and macOS users. Today both Microsoft Hyper-V and macOS HVF have added support for Intel Virtual Machine Extensions. The project is discontinued." },
{ VM::brands::UNISYS, "Unisys Secure Partitioning (s-Par®) is firmware made by ClearPath Forward that provides the capability to run multiple operating environments concurrently on the same computer hardware: for example, Linux and Windows operating environments. Unlike virtualization technologies and virtual machines, each s-Par operating environment has dedicated hardware resources—instruction processor cores, memory, and input/output components. Each s-Par operating environment is referred to as a secure partition (or just “partition,” for short). A secure partition is sometimes referred to as a hard partition." },
{ VM::brands::LMHS, "LMHS is Lockheed Martin's native hypervisor. I assume you got this result because you're an employee in the company and you're doing security testing. But if you're not, how the hell did you get this result? Did you steal a US military fighter jet or something? I'm genuinely curious. I really don't expect anybody to have this result frankly but I'll assume it's just a false positive (please create an issue in the repo if it is)." },
{ VM::brands::CUCKOO, "Cuckoo Sandbox is an open-source automated malware analysis system. Executes files in isolated environments (VirtualBox/QEMU) while monitoring API calls, network traffic, and memory changes. Features YARA rule matching and CAPE (Customized Automated Processing Engine) extensions for advanced threat hunting and IOC extraction." },
{ VM::brands::BLUESTACKS, "BlueStacks is a chain of cloud-based cross-platform products developed by the San Francisco-based company of the same name. The BlueStacks App Player enables the execution of Android applications on computers running Microsoft Windows or macOS. It functions through an Android emulator referred to as App Player. The basic features of the software are available for free, while advanced features require a paid monthly subscription." },
{ VM::brands::JAILHOUSE, "Jailhouse is a free and open source partitioning Hypervisor based on Linux, made by Siemens. It is able to run bare-metal applications or (adapted) operating systems besides Linux. For this purpose, it configures CPU and device virtualization features of the hardware platform in a way that none of these domains, called \"cells\", can interfere with each other in an unacceptable way." },
{ VM::brands::APPLE_VZ, "Apple Virtualization Framework (VZ) is a macOS 12+ API for creating ARM64 VMs on Apple Silicon. Provides para-virtualized devices via VirtIO and Rosetta 2 binary translation for x86_64 Linux guests. Used by Lima and UTM to run Linux distributions natively on M1/M2 Macs without traditional hypervisor overhead." },
{ VM::brands::INTEL_KGT, "Intel Kernel Guard Technology (KGT) is a policy specification and enforcement framework for ensuring runtime integrity of kernel and platform assets. Demonstrated secure enclaves for critical OS components using VT-x/EPT before being superseded by CET (Control-flow Enforcement Technology) and HyperGuard in Windows 10." },
{ VM::brands::AZURE_HYPERV, "Azure Hyper-V is Microsoft's cloud-optimized hypervisor variant powering Azure VMs. Implements Azure-specific virtual devices like NVMe Accelerated Networking and vTPMs. Supports nested virtualization for running Hyper-V/containers within Azure VMs, enabling cloud-based CI/CD pipelines and dev/test environments." },
{ VM::brands::SIMPLEVISOR, "SimpleVisor is a minimalist Intel VT-x hypervisor by Alex Ionescu for Windows/Linux research. Demonstrates EPT-based memory isolation and hypercall handling. Used to study VM escapes and hypervisor rootkits, with hooks for intercepting CR3 changes and MSR accesses." },
{ VM::brands::HYPERV_ROOT, "VMAware detected Hyper-V operating as a type 1 hypervisor, not as a guest virtual machine. Although your hardware/firmware signatures match Microsoft's Hyper-V architecture, we determined that you're running on baremetal. This prevents false positives, as Windows sometimes runs under Hyper-V (type 1) hypervisor." },
{ VM::brands::UML, "User-Mode Linux (UML) allows running Linux kernels as user-space processes using ptrace-based virtualization. Primarily used for kernel debugging and network namespace testing. Offers lightweight isolation without hardware acceleration, but requires host/guest kernel version matching for stable operation." },
{ VM::brands::POWERVM, "IBM PowerVM is a type 1 hypervisor for POWER9/10 systems, supporting Live Partition Mobility and Shared Processor Pools. Implements VIOS (Virtual I/O Server) for storage/networking virtualization, enabling concurrent AIX, IBM i, and Linux workloads with RAS features like predictive failure analysis." },
{ VM::brands::GCE, "Google Compute Engine (GCE) utilizes KVM-based virtualization with custom Titanium security chips for hardware root of trust. Features live migration during host maintenance and shielded VMs with UEFI secure boot. Underpins Google Cloud's Confidential Computing offering using AMD SEV-SNP memory encryption." },
{ VM::brands::OPENSTACK, "OpenStack is an open-source cloud OS managing compute (Nova), networking (Neutron), and storage (Cinder) resources. Supports multiple hypervisors (KVM/Xen/Hyper-V) through driver plugins. Widely used in private clouds with features like Heat orchestration and Octavia load balancing." },
{ VM::brands::KUBEVIRT, "KubeVirt is a VM management add-on for Kubernetes. It provides a common ground for virtualization solutions on top of Kubernetes by extending its core by adding additional virtualization resource types where the Kubernetes API can be used to manage these VM resources alongside all other resources Kubernetes provides. Its functionality is to provide a runtime in order to define and manage VMs." },
{ VM::brands::AWS_NITRO, "AWS Nitro is Amazon's hypervisor for EC2, offloading network/storage to dedicated Nitro Cards. Uses Firecracker microVMs for Lambda/Fargate serverless compute. Provides bare-metal instance types (i3en.metal) with 3x better EBS throughput compared to traditional Xen-based instances." },
{ VM::brands::PODMAN, "Podman is a daemonless container engine by Red Hat using Linux namespaces/cgroups. Supports rootless containers and Docker-compatible CLI syntax. Integrates with systemd for service management and Quadlet for declarative container definitions. Part of the Podman Desktop suite for Kubernetes development." },
{ VM::brands::WSL, "Windows Subsystem for Linux (WSL) is a feature of Microsoft Windows that allows for using a Linux environment without the need for a separate VM or dual booting. WSL requires fewer resources (CPU, memory, and storage) than a full virtual machine (a common alternative for using Linux in Windows), while also allowing the use of both Windows and Linux tools on the same set of files." },
{ VM::brands::OPENVZ, "OpenVZ is a container-based virtualization for Linux using kernel-level isolation. Provides checkpointing and live migration through ploop storage. Requires matching host/guest kernel versions, largely superseded by LXC/LXD due to Docker's popularity and kernel namespace flexibility." },
{ VM::brands::BAREVISOR, "BareVisor is a research-focused type 1 hypervisor emphasizing minimal TCB (Trusted Computing Base). Supports x86/ARM with <10K LoC for secure enclave experiments. Used in academia to study TEEs (Trusted Execution Environments) and hypervisor-based intrusion detection systems." },
{ VM::brands::HYPERPLATFORM, "HyperPlatform is an Intel VT-x research hypervisor for Windows kernel introspection. Provides APIs for EPT hooking and MSR filtering. Used to develop anti-cheat systems and kernel exploit detectors by monitoring CR3 switches and exception handling." },
{ VM::brands::MINIVISOR, "MiniVisor is a research hypervisor written as a UEFI and Windows driver for the educational purpose for Intel processors. This MiniVisor, as a UEFI driver, provides the ability to inspect system activities even before the operating system boots, while as a Windows driver, allows developers to debug it with familiar tools like WinDbg." },
{ VM::brands::INTEL_TDX, "Intel TDX (Trust Domain Extensions) enhances VM confidentiality in cloud environments. Encrypts VM memory and registers using MKTME (Multi-Key Total Memory Encryption), isolating \"trust domains\" from hypervisors. Part of Intel's vPro platform for confidential computing on Xeon Scalable processors." },
{ VM::brands::LKVM, "LKVM (Linux Kernel Virtual Machine) is a minimal KVM frontend for Linux kernel testing. Provides CLI tools like `lkvm run` for quick VM creation with built-in 9pfs support. Used alongside QEMU for rapid boot testing and kernel panic debugging." },
{ VM::brands::AMD_SEV, "AMD Secure Encrypted Virtualization (SEV) encrypts VM memory with EPYC processor-based AES keys. Isolates guests from hypervisors using ASIDs (Address Space Identifiers), protecting against physical attacks and malicious cloud providers. Supported in Linux/KVM via libvirt SEV options." },
{ VM::brands::AMD_SEV_ES, "AMD SEV-Encrypted State (SEV-ES) extends SEV by encrypting CPU register states during VM exits. Prevents hypervisors from inspecting guest register contents, mitigating attacks using VMRUN/VMEXIT timing side channels. Requires guest OS modifications for secure interrupt handling." },
{ VM::brands::AMD_SEV_SNP, "AMD SEV-Secure Nested Paging (SEV-SNP) adds memory integrity protection to SEV-ES. Uses reverse map tables (RMP) to prevent hypervisor-mediated replay/spoofing attacks. Enables attested launch for cloud workloads via guest policy certificates and AMD's Key Distribution Service (KDS)." },
{ VM::brands::NEKO_PROJECT, "Neko Project II is an emulator designed for emulating PC-98 computers. They are a lineup of Japanese 16-bit and 32-bit personal computers manufactured by NEC from 1982 to 2003. While based on Intel processors, it uses an in-house architecture making it incompatible with IBM clones." },
{ VM::brands::NOIRVISOR, "NoirVisor is a hardware-accelerated hypervisor with support to complex functions and purposes. It is designed to support processors based on x86 architecture with hardware-accelerated virtualization feature. For example, Intel processors supporting Intel VT-x or AMD processors supporting AMD-V meet the requirement. It was made by Zero-Tang." },
{ VM::brands::QIHOO, "360 sandbox is a part of 360 Total Security. Similar to other sandbox software, it provides a virtualized environment where potentially malicious or untrusted programs can run without affecting the actual system. Qihoo 360 Sandbox is commonly used for testing unknown applications, analyzing malware behavior, and protecting users from zero-day threats." },
{ VM::brands::NSJAIL, "nsjail is a process isolation tool for Linux. It utilizes Linux namespace subsystem, resource limits, and the seccomp-bpf syscall filters of the Linux kernel. It can be used for isolating networking services, CTF challenges, and containing invasive syscall-level OS fuzzers." },
{ VM::brands::DBVM, "DBVM is a ultra-lightweight virtual machine host that makes Windows run in a virtual machine so that Cheat Engine can operate at a higher level than the OS using a device driver. Instead of virtualizing devices it generally passes on interrupts unaltered meaning it has a very small impact on performance." },
{ VM::brands::UTM, "UTM for macOS is a free, open-source virtualization and emulation app that brings full-featured virtual machines to both Intel and Apple Silicon Macs. It employs Apple's Hypervisor virtualization framework to run ARM64 operating systems on Apple Silicon at near native speeds. On other architectures, it employs software emulation through QEMU." },
{ VM::brands::COMPAQ, "Compaq FX!32 is an emulator that is designed to run Win32 programs for the DEC instruction set architecture. Released in 1996, it was developed by developed by Digital Equipment Corporation (DEC) to support their Alpha microprocessors. It analyzed the way programs worked and, after the program ran, used binary translation to produce dynamic-link library (DLL) files of native Alpha code that the application could execute the next time it ran." },
{ VM::brands::INSIGNIA, "RealPC was an emulator for the Macintosh line of PCs. It emulated a Pentium-based PC to run Windows NT, Windows 95, and Windows 98 programs. It was discontinued in 2003." },
{ VM::brands::CONNECTIX, "Connectix VirtualPC was the predecessor to Microsoft's VirtualPC. Originally developed as a Macintosh application for System 7.5 and released by Connectix in June 1997, it supported various OS's such as Linux and old versions of Windows. It was bought by Microsoft in February 2003." },
{ VM::brands::NULL_BRAND, "Indicates no detectable virtualization brand. This result may occur on bare-metal systems, unsupported/obscure hypervisors, or when anti-detection techniques (e.g., VM escaping) are employed by the guest environment." }
};
// Range-based for loop (C++11)
// std::string operator== checks size first, so this is highly optimized.
for (const auto& entry : table) {
if (vm_brand == entry.brand) {
return entry.description;
}
}
return "";
}
/**
* @brief Check for any.run driver presence
* @category Windows
* @author kkent030315
* @link https://github.com/kkent030315/detect-anyrun/blob/main/detect.cc
* @copyright MIT
*/
[[nodiscard]] static bool anyrun_driver() {
#if (!CLI_WINDOWS)
return false;
#else
HANDLE hFile;
hFile = CreateFile(
/*lpFileName*/TEXT("\\\\?\\\\A3E64E55_fl"),
/*dwDesiredAccess*/GENERIC_READ,
/*dwShareMode*/0,
/*lpSecurityAttributes*/nullptr,
/*dwCreationDisposition*/OPEN_EXISTING,
/*dwFlagsAndAttributes*/0,
/*hTemplateFile*/nullptr
);
if (hFile == INVALID_HANDLE_VALUE) {
return false;
}
CloseHandle(hFile);
return true;
#endif
}
[[nodiscard]] static bool anyrun_directory() {
#if (!CLI_WINDOWS)
return false;
#else
NTSTATUS status;
HMODULE ntdll = GetModuleHandleA("ntdll.dll");
if (!ntdll) {
return false;
}
using NtCreateFile_t = NTSTATUS(
__stdcall*)(
PHANDLE,
ACCESS_MASK,
POBJECT_ATTRIBUTES,
PIO_STATUS_BLOCK,
PLARGE_INTEGER,
ULONG,
ULONG,
ULONG,
ULONG,
PVOID,
ULONG
);
using NtClose_t = NTSTATUS(__stdcall*)(HANDLE);
using RtlInitUnicodeString_t = VOID(__stdcall*)(PUNICODE_STRING, PCWSTR);
#pragma warning(push)
#pragma warning(disable:4191)
auto pRtlInitUnicodeString = reinterpret_cast<RtlInitUnicodeString_t>(
GetProcAddress(ntdll, "RtlInitUnicodeString"));
auto pNtCreateFile = reinterpret_cast<NtCreateFile_t>(
GetProcAddress(ntdll, "NtCreateFile"));
auto pNtClose = reinterpret_cast<NtClose_t>(
GetProcAddress(ntdll, "NtClose"));
#pragma warning(pop)
if (!pRtlInitUnicodeString || !pNtCreateFile || !pNtClose) {
return false;
}
UNICODE_STRING name;
pRtlInitUnicodeString(&name, L"\\??\\C:\\Program Files\\KernelLogger");
HANDLE hFile;
IO_STATUS_BLOCK iosb;
OBJECT_ATTRIBUTES attrs{};
InitializeObjectAttributes(&attrs, &name, 0, nullptr, nullptr);
status = pNtCreateFile(
/*FileHandle*/&hFile,
/*DesiredAccess*/GENERIC_READ | SYNCHRONIZE,
/*ObjectAttributes*/&attrs,
/*IoStatusBlock*/&iosb,
/*AllocationSize*/nullptr,
/*FileAttributes*/FILE_ATTRIBUTE_DIRECTORY,
/*ShareAccess*/FILE_SHARE_READ,
/*CreateDisposition*/FILE_OPEN,
/*CreateOptions*/FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
/*EaBuffer*/nullptr,
/*EaLength*/0
);
// ANY.RUN minifilter returns non-standard status code, STATUS_NO_SUCH_FILE
// If this status code is returned, it means that the directory is protected
// by the ANY.RUN minifilter driver.
// To patch this detection, I would recommend returning STATUS_OBJECT_NAME_NOT_FOUND
// that is a standard status code for this situation.
if (static_cast<ULONG>(status) == 0xC000000F) // STATUS_NOT_SUCH_FILE
return true;
// Not actually the case, maybe conflict with other software installation.
if (NT_SUCCESS(status))
pNtClose(hFile);
return false;
#endif
}
static void checker(const VM::enum_flags flag, const char* message) {
std::string enum_name = "";
if (arg_bitset.test(ENUMS)) {
enum_name = grey + " [VM::" + VM::flag_to_string(flag) + "]" + ansi_exit;
}
if (is_disabled(flag)) {
if (!arg_bitset.test(DETECTED_ONLY))
std::cout << disabled << " Skipped " << message << enum_name << "\n";
disabled_count++;
return;
}
if (is_unsupported(flag)) {
unsupported_count++;
} else {
supported_count++;
}
const bool result = VM::check(flag);
if (arg_bitset.test(DETECTED_ONLY) && !result) {
return;
}
#if (CLI_LINUX)
if (are_perms_required(flag)) {
std::cout << no_perms << " Skipped " << message << enum_name << "\n";
no_perms_count++;
// memoize it, it's going to be ran later anyway with stuff like VM::detect()
VM::check(flag);
return;
}
#endif
if (result) {
std::cout << detected << bold << " Checking " << message << "..." << enum_name << ansi_exit << "\n";
} else {
std::cout << not_detected << " Checking " << message << "..." << enum_name << ansi_exit << "\n";
}
}
// overload for std::function, this is specific for any.run techniques
// that are embedded in the CLI because it was removed in the lib as of 2.0
static void checker(const std::function<bool()>& func, const char* message) {
#if (!CLI_WINDOWS)
if (arg_bitset.test(VERBOSE)) {
unsupported_count++;
} else {
supported_count++;
}
#else
supported_count++;
#endif
const bool result = func();
if (arg_bitset.test(DETECTED_ONLY) && !result) {
return;
}
std::cout <<
(result ? detected : not_detected) <<
(result ? bold : "") <<
" Checking " <<
message <<
"..." <<
(result ? ansi_exit : "") <<
"\n";
}
const bool is_anyrun_directory = anyrun_directory();
const bool is_anyrun_driver = anyrun_driver();
const bool is_anyrun = (is_anyrun_directory || is_anyrun_driver);
static void general(
const VM::enum_flags high_threshold,
const VM::enum_flags all,
const VM::enum_flags dynamic
) {
bool notes_enabled = false;
if (arg_bitset.test(NO_ANSI)) {
detected = ("[ DETECTED ]");
not_detected = ("[NOT DETECTED]");
no_support = ("[ NO SUPPORT ]");
no_perms = ("[ NO PERMS ]");
note = ("[ NOTE ]");
disabled = ("[ DISABLED ]");
bold = "";
underline = "";
ansi_exit = "";
red = "";
orange = "";
green = "";
red_orange = "";
green_orange = "";
grey = "";
}
if (arg_bitset.test(NOTES)) {
notes_enabled = false;
} else {
notes_enabled = true;
}
#if (CLI_LINUX)
if (notes_enabled && !is_admin()) {
std::cout << note << " Running under root might give better results\n";
}
#elif (CLI_WINDOWS)
if (!is_admin()) {
std::cout << note << " Not running as admin, some technique may not run\n";
}
#endif
const std::string hash = compute_self_sha256();
if (!hash.empty()) {
std::cout << "SHA256: " << hash << '\n';
}
const auto t1 = std::chrono::high_resolution_clock::now();
checker(VM::VMID, "VMID");
checker(VM::CPU_BRAND, "CPU brand");
checker(VM::HYPERVISOR_BIT, "CPUID hypervisor bit");
checker(VM::HYPERVISOR_STR, "hypervisor str");
checker(VM::TIMER, "timing anomalies");
checker(VM::THREAD_COUNT, "thread count");
checker(VM::MAC, "MAC addresses");
checker(VM::TEMPERATURE, "temperature");
checker(VM::SYSTEMD, "systemd virtualisation");
checker(VM::CVENDOR, "chassis vendor");
checker(VM::CTYPE, "chassis type");
checker(VM::DOCKERENV, "Dockerenv");
checker(VM::DMIDECODE, "dmidecode output");
checker(VM::DMESG, "dmesg output");
checker(VM::HWMON, "hwmon presence");
checker(VM::DLL, "DLLs");
checker(VM::WINE_FUNC, "Wine");
checker(VM::HWMODEL, "hw.model");
checker(VM::PROCESSES, "processes");
checker(VM::LINUX_USER_HOST, "default Linux user/host");
checker(VM::GAMARUE, "gamarue ransomware technique");
checker(VM::BOCHS_CPU, "BOCHS CPU techniques");
checker(VM::MAC_MEMSIZE, "MacOS hw.memsize");
checker(VM::MAC_IOKIT, "MacOS registry IO-kit");
checker(VM::IOREG_GREP, "IO registry grep");
checker(VM::MAC_SIP, "MacOS SIP");
checker(VM::AUDIO, "audio devices");
checker(VM::HANDLES, "device handles");
checker(VM::VPC_INVALID, "VPC invalid instructions");
checker(VM::SYSTEM_REGISTERS, "Task segment and descriptor tables");
checker(VM::VMWARE_IOMEM, "/proc/iomem file");
checker(VM::VMWARE_IOPORTS, "/proc/ioports file");
checker(VM::VMWARE_SCSI, "/proc/scsi/scsi file");
checker(VM::VMWARE_DMESG, "VMware dmesg");
checker(VM::VMWARE_STR, "STR instruction");
checker(VM::VMWARE_BACKDOOR, "VMware IO port backdoor");
checker(VM::MUTEX, "mutex strings");
checker(VM::THREAD_MISMATCH, "thread count mismatch");
checker(VM::CUCKOO_DIR, "Cuckoo directory");
checker(VM::CUCKOO_PIPE, "Cuckoo pipe");
checker(VM::AZURE, "Azure Hyper-V");
checker(VM::DISPLAY, "display");
checker(VM::DEVICE_STRING, "bogus device string");
checker(VM::BLUESTACKS_FOLDERS, "BlueStacks folders");
checker(VM::CPUID_SIGNATURE, "CPUID signatures");
checker(VM::KGT_SIGNATURE, "Intel KGT signature");
checker(VM::QEMU_VIRTUAL_DMI, "QEMU virtual DMI directory");
checker(VM::QEMU_USB, "QEMU USB");
checker(VM::HYPERVISOR_DIR, "hypervisor directory (Linux)");
checker(VM::UML_CPU, "User-mode Linux CPU");
checker(VM::KMSG, "/dev/kmsg hypervisor message");
checker(VM::VBOX_MODULE, "VBox kernel module");
checker(VM::SYSINFO_PROC, "/proc/sysinfo");
checker(VM::DMI_SCAN, "DMI scan");
checker(VM::SMBIOS_VM_BIT, "SMBIOS VM bit");
checker(VM::PODMAN_FILE, "podman file");
checker(VM::WSL_PROC, "WSL string in /proc");
checker(anyrun_driver, "ANY.RUN driver");
checker(anyrun_directory, "ANY.RUN directory");
checker(VM::DRIVERS, "driver names");
checker(VM::DISK_SERIAL, "disk serial number");
checker(VM::IVSHMEM, "IVSHMEM device");
checker(VM::GPU_CAPABILITIES, "GPU capabilities");
checker(VM::POWER_CAPABILITIES, "power capabilities");
checker(VM::QEMU_FW_CFG, "QEMU fw_cfg device");
checker(VM::VIRTUAL_PROCESSORS, "virtual processors");
checker(VM::HYPERVISOR_QUERY, "hypervisor query");
checker(VM::AMD_SEV_MSR, "AMD-SEV MSR");
checker(VM::VIRTUAL_REGISTRY, "registry emulation");
checker(VM::FIRMWARE, "firmware");
checker(VM::FILE_ACCESS_HISTORY, "low file access count");
checker(VM::NSJAIL_PID, "nsjail PID");
checker(VM::DEVICES, "PCI vendor/device ID");
checker(VM::ACPI_SIGNATURE, "ACPI device signatures");
checker(VM::TRAP, "hypervisor interception");
checker(VM::UD, "undefined exceptions");
checker(VM::BLOCKSTEP, "single step with trap flag");
checker(VM::DBVM_HYPERCALL, "Dark Byte's hypervisor");
checker(VM::BOOT_LOGO, "boot logo");
checker(VM::MAC_SYS, "system profiler");
checker(VM::KERNEL_OBJECTS, "kernel objects");
checker(VM::NVRAM, "NVRAM");
checker(VM::EDID, "EDID");