VM detection on my real PC

[egglebm7-stack]

Source info

• This is from the latest commit in the main branch
• This is from the latest release
• Other

Issue type

• False positive
• Compilation warning/error
• Suggestion
• Runtime error/crash
• Other

Environment

• Windows
• Linux
• MacOS
• Other

Description

CLI output (if possible)

[egglebm7-stack]

Just yesterday I tried everything on the previous version, all my virtual machines were detected, and on clean computers everything was ok (it showed that it was not a virtual machine), now it’s not like that

[NotRequiem]

Thanks for reporting the issue. Please run the debug binary, as we have a lot of non volatile ram checks

[NotRequiem]

It was not like that before because, as VMAware warns at the start of the program, some checks might not run without admin privileges. We try to make every check being able to run even without admin, currently the only check on Windows that can't run without administrator permissions is the NVRAM check

[egglebm7-stack]

SHA256: 1b3b3c4689e778d8f5fefc06ee03163b5c7cfdbd478b348932d8b659e134d31a
[NOT DETECTED] Checking VMID...
[DEBUG] CPUID: max extended leaf = 2147483656
[DEBUG] CPU: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz
[NOT DETECTED] Checking CPU brand...
[DEBUG] HYPER-X: Hyper-V is not active
[NOT DETECTED] Checking CPUID hypervisor bit...
[DEBUG] HYPER_X: returned from cache
[DEBUG] HYPERVISOR_STR:
eax: 0
ebx: 0
ecx: 0
edx: 0
[NOT DETECTED] Checking hypervisor str...
[DEBUG] CPUID: max hypervisor leaf = 0
[DEBUG] TIMER: VMM -> 26 | nVMM -> 26 | Ratio -> 1
[NOT DETECTED] Checking timing anomalies...
[NOT DETECTED] Checking thread count...
[NOT DETECTED] Checking MAC addresses...
[NOT DETECTED] Checking temperature...
[NOT DETECTED] Checking systemd virtualisation...
[NOT DETECTED] Checking chassis vendor...
[NOT DETECTED] Checking chassis type...
[NOT DETECTED] Checking Dockerenv...
[NOT DETECTED] Checking dmidecode output...
[NOT DETECTED] Checking dmesg output...
[NOT DETECTED] Checking hwmon presence...
[NOT DETECTED] Checking DLLs...
[NOT DETECTED] Checking Wine...
[NOT DETECTED] Checking hw.model...
[NOT DETECTED] Checking processes...
[NOT DETECTED] Checking default Linux user/host...
[NOT DETECTED] Checking gamarue ransomware technique...
[NOT DETECTED] Checking BOCHS CPU techniques...
[NOT DETECTED] Checking MacOS hw.memsize...
[NOT DETECTED] Checking MacOS registry IO-kit...
[NOT DETECTED] Checking IO registry grep...
[NOT DETECTED] Checking MacOS SIP...
[NOT DETECTED] Checking audio devices...
[NOT DETECTED] Checking device handles...
[NOT DETECTED] Checking VPC invalid instructions...
[NOT DETECTED] Checking Task segment and descriptor tables...
[NOT DETECTED] Checking /proc/iomem file...
[NOT DETECTED] Checking /proc/ioports file...
[NOT DETECTED] Checking /proc/scsi/scsi file...
[ DISABLED ] Skipped VMware dmesg
[NOT DETECTED] Checking STR instruction...
[NOT DETECTED] Checking VMware IO port backdoor...
[NOT DETECTED] Checking mutex strings...
[DEBUG] INTEL_THREAD_MISMATCH: CPU model = Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz
[NOT DETECTED] Checking thread count mismatch...
[NOT DETECTED] Checking Cuckoo directory...
[NOT DETECTED] Checking Cuckoo pipe...
[NOT DETECTED] Checking Azure Hyper-V...
[NOT DETECTED] Checking display...
[NOT DETECTED] Checking bogus device string...
[NOT DETECTED] Checking BlueStacks folders...
[DEBUG] CPUID_SIGNATURE: eax = 0
[DEBUG] CPUID: max standard leaf = 13
[NOT DETECTED] Checking CPUID signatures...
[NOT DETECTED] Checking Intel KGT signature...
[NOT DETECTED] Checking QEMU virtual DMI directory...
[NOT DETECTED] Checking QEMU USB...
[NOT DETECTED] Checking hypervisor directory (Linux)...
[NOT DETECTED] Checking User-mode Linux CPU...
[NOT DETECTED] Checking /dev/kmsg hypervisor message...
[NOT DETECTED] Checking VBox kernel module...
[NOT DETECTED] Checking /proc/sysinfo...
[NOT DETECTED] Checking DMI scan...
[NOT DETECTED] Checking SMBIOS VM bit...
[NOT DETECTED] Checking podman file...
[NOT DETECTED] Checking WSL string in /proc...
[NOT DETECTED] Checking ANY.RUN driver...
[NOT DETECTED] Checking ANY.RUN directory...
[NOT DETECTED] Checking driver names...
[DEBUG] DISK_SERIAL: 50026B7383050EAF
[NOT DETECTED] Checking disk serial number...
[NOT DETECTED] Checking IVSHMEM device...
[NOT DETECTED] Checking GPU capabilities...
[NOT DETECTED] Checking power capabilities...
[NOT DETECTED] Checking QEMU fw_cfg device...
[NOT DETECTED] Checking virtual processors...
[NOT DETECTED] Checking hypervisor query...
[NOT DETECTED] Checking AMD-SEV MSR...
[NOT DETECTED] Checking registry emulation...
[NOT DETECTED] Checking firmware...
[NOT DETECTED] Checking low file access count...
[NOT DETECTED] Checking nsjail PID...
[NOT DETECTED] Checking PCI vendor/device ID...
[DEBUG] ACPI_SIGNATURE: PCIROOT(0)#PCI(0100)#PCI(0000)
[DEBUG] ACPI_SIGNATURE: ACPI(SB)#ACPI(PCI0)#ACPI(PEG0)#PCI(0000)
[DEBUG] ACPI_SIGNATURE: Valid signature -> PCIROOT(0)#PCI(0100)#PCI(0000)
[DEBUG] ACPI_SIGNATURE: Valid signature -> ACPI(SB)#ACPI(PCI0)#ACPI(PEG0)#PCI(0000)
[NOT DETECTED] Checking ACPI device signatures...
[NOT DETECTED] Checking hypervisor interception...
[NOT DETECTED] Checking undefined exceptions...
[NOT DETECTED] Checking single step with trap flag...
[NOT DETECTED] Checking Dark Byte's hypervisor...
[DEBUG] BOOT_LOGO: size=2359358, flags=1, offset=8, crc=0x4485258f
[NOT DETECTED] Checking boot logo...
[NOT DETECTED] Checking system profiler...
[NOT DETECTED] Checking kernel objects...
[DEBUG] NVRAM: SecureBoot variable detected
[DEBUG] NVRAM: SetupMode variable detected
[DEBUG] NVRAM: Secure Boot not confirmed active, disabling MOCRL and raw buffer mismatch checks...
[DEBUG] NVRAM: Missing dbxDefault
[ DETECTED ] Checking NVRAM...
[NOT DETECTED] Checking EDID...
[NOT DETECTED] Checking CPU heuristics...
[NOT DETECTED] Checking system timers...
[NOT DETECTED] Checking model specific registers...
[NOT DETECTED] Checking KVM interception...
[NOT DETECTED] Checking EPT/NPT hooking...

[DEBUG] VM::brand(): cached internal brand list
[DEBUG] VM::brand(): cached multiple brand string
[DEBUG] VM::brand(): returned internal brand list from cache
[DEBUG] is_hardened(): trap/NVRAM and hypervisor bit/str are not detected together
VM brand: Unknown
VM type: Unknown
VM likeliness: 99%
VM confirmation: true
VM detections: 1/91
VM hardening: likely

====== CONCLUSION: Running inside a hardened unknown VM ======

[ NOTE ] If you found a false positive, please make sure to create
an issue at https://github.com/kernelwernel/VMAware/issues

Press Enter to exit...