Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions docs/documentation.md
Original file line number Diff line number Diff line change
Expand Up @@ -480,7 +480,6 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
| `VM::INTEL_THREAD_MISMATCH` | Check for Intel CPU thread count database if it matches the system's thread count | | 95% | | | | |
| `VM::XEON_THREAD_MISMATCH` | Same as above, but for Xeon Intel CPUs | | 95% | | | | |
| `VM::NETTITUDE_VM_MEMORY` | Check for memory regions to detect VM-specific brands | Windows | 100% | | | | |
| `VM::CPUID_BITSET` | Check for CPUID technique by checking whether all the bits equate to more than 4000 | | 25% | | | | |
| `VM::CUCKOO_DIR` | Check for cuckoo directory using crt and WIN API directory functions | Windows | 30% | | | | |
| `VM::CUCKOO_PIPE` | Check for Cuckoo specific piping mechanism | Windows | 30% | | | | |
| `VM::HYPERV_HOSTNAME` | Check for default Azure hostname format regex (Azure uses Hyper-V as their base VM brand) | Windows, Linux | 30% | | | | |
Expand Down Expand Up @@ -513,14 +512,14 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
| `VM::GPU_CAPABILITIES` | Check for GPU capabilities related to VMs | Windows | 100% | Admin | | | Admin only needed for some heuristics |
| `VM::GPU_VM_STRINGS` | Check for specific GPU string signatures related to VMs | Windows | 100% | | | | |
| `VM::VM_DEVICES` | Check for VM-specific devices | Windows | 45% | | | | |
| `VM::IDT_GDT_MISMATCH` | Check if the IDT and GDT base virtual addresses mismatch between different CPU cores when called from usermode under a root partition | Windows | 50% | | | | |
| `VM::IDT_GDT_SCAN` | Check if the IDT and GDT virtual base addresses are equal across different CPU cores when not running under Hyper-V | Windows | 50% | | | | |
| `VM::PROCESSOR_NUMBER` | Check for number of processors | Windows | 50% | | | | |
| `VM::NUMBER_OF_CORES` | Check for number of cores | Windows | 50% | | | | |
| `VM::ACPI_TEMPERATURE` | Check for device's temperature | Windows | 25% | | | | |
| `VM::PROCESSOR_ID` | Check if any processor has an empty Processor ID using SMBIOS data | Windows | 25% | | | | |
| `VM::SYS_QEMU` | Check for existence of "qemu_fw_cfg" directories within /sys/module and /sys/firmware | Linux | 70% | | | | |
| `VM::LSHW_QEMU` | Check for QEMU string instances with lshw command | Linux | 80% | | | | |
| `VM::VIRTUAL_PROCESSORS` | Check if the number of maximum virtual processors matches the maximum number of logical processors | Windows | 50% | | | | |
| `VM::VIRTUAL_PROCESSORS` | Check if the number of virtual and logical processors are reported correctly by the system | Windows | 50% | | | | |
| `VM::HYPERV_QUERY` | Check if a call to NtQuerySystemInformation with the 0x9f leaf fills a _SYSTEM_HYPERVISOR_DETAIL_INFORMATION structure | Windows | 100% | | | | |
| `VM::BAD_POOLS` | Check for system pools allocated by hypervisors | Windows | 80% | | | | |
| `VM::AMD_SEV` | Check for AMD-SEV MSR running on the system | Linux and MacOS | 50% | Admin | | | |
Expand Down
8 changes: 2 additions & 6 deletions src/cli.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -362,7 +362,6 @@ bool is_unsupported(VM::enum_flags flag) {
case VM::ODD_CPU_THREADS:
case VM::INTEL_THREAD_MISMATCH:
case VM::XEON_THREAD_MISMATCH:
case VM::CPUID_BITSET:
case VM::HYPERV_HOSTNAME:
case VM::GENERAL_HOSTNAME:
case VM::BLUESTACKS_FOLDERS:
Expand Down Expand Up @@ -439,7 +438,6 @@ bool is_unsupported(VM::enum_flags flag) {
case VM::INTEL_THREAD_MISMATCH:
case VM::XEON_THREAD_MISMATCH:
case VM::NETTITUDE_VM_MEMORY:
case VM::CPUID_BITSET:
case VM::CUCKOO_DIR:
case VM::CUCKOO_PIPE:
case VM::HYPERV_HOSTNAME:
Expand All @@ -455,7 +453,7 @@ bool is_unsupported(VM::enum_flags flag) {
case VM::PORT_CONNECTORS:
case VM::GPU_VM_STRINGS:
case VM::GPU_CAPABILITIES:
case VM::IDT_GDT_MISMATCH:
case VM::IDT_GDT_SCAN:
case VM::PROCESSOR_NUMBER:
case VM::NUMBER_OF_CORES:
case VM::ACPI_TEMPERATURE:
Expand Down Expand Up @@ -495,7 +493,6 @@ bool is_unsupported(VM::enum_flags flag) {
case VM::ODD_CPU_THREADS:
case VM::INTEL_THREAD_MISMATCH:
case VM::XEON_THREAD_MISMATCH:
case VM::CPUID_BITSET:
case VM::CPUID_SIGNATURE:
case VM::KVM_BITMASK:
case VM::KGT_SIGNATURE:
Expand Down Expand Up @@ -944,7 +941,6 @@ void general() {
checker(VM::INTEL_THREAD_MISMATCH, "Intel thread count mismatch");
checker(VM::XEON_THREAD_MISMATCH, "Intel Xeon thread count mismatch");
checker(VM::NETTITUDE_VM_MEMORY, "VM memory regions");
checker(VM::CPUID_BITSET, "CPUID bitset");
checker(VM::CUCKOO_DIR, "Cuckoo directory");
checker(VM::CUCKOO_PIPE, "Cuckoo pipe");
checker(VM::HYPERV_HOSTNAME, "Hyper-V Azure hostname");
Expand Down Expand Up @@ -976,7 +972,7 @@ void general() {
checker(VM::PORT_CONNECTORS, "physical connection ports");
checker(VM::GPU_CAPABILITIES, "GPU capabilities");
checker(VM::GPU_VM_STRINGS, "GPU strings");
checker(VM::IDT_GDT_MISMATCH, "IDT GDT mismatch");
checker(VM::IDT_GDT_SCAN, "IDT GDT consistency");
checker(VM::PROCESSOR_NUMBER, "processor count");
checker(VM::NUMBER_OF_CORES, "CPU core count");
checker(VM::ACPI_TEMPERATURE, "thermal devices");
Expand Down
Loading