Skip to content

Commit 08cf38d

Browse files
NotRequiemNotRequiem
authored
Merge branch 'main' into dev
2 parents 8771edb + eb15509 commit 08cf38d

2 files changed

Lines changed: 132 additions & 125 deletions

File tree

‎src/vmaware.hpp‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3079,7 +3079,7 @@ struct VM {
30793079
key(brands::WINE, "HKLM\\SOFTWARE\\Wine");
30803080

30813081
// Xen
3082-
key(brands::KVM, "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI\\VEN_5853*");
3082+
key(brands::XEN, "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI\\VEN_5853*");
30833083
key(brands::XEN, "HKLM\\HARDWARE\\ACPI\\DSDT\\xen");
30843084
key(brands::XEN, "HKLM\\HARDWARE\\ACPI\\FADT\\xen");
30853085
key(brands::XEN, "HKLM\\HARDWARE\\ACPI\\RSDT\\xen");
@@ -7546,6 +7546,7 @@ struct VM {
75467546
* @brief Check for specific GPU string signatures related to VMs
75477547
* @category Windows
75487548
* @author Requiem (https://github.com/NotRequiem)
7549+
* @author dmfrpro (https://github.com/dmfrpro) (VDD detection)
75497550
* @note utoshu did this with WMI in a removed technique (VM::GPU_CHIPTYPE)
75507551
* @implements VM::GPU_VM_STRING
75517552
*/
@@ -7559,14 +7560,17 @@ struct VM {
75597560
size_t length;
75607561
};
75617562

7562-
constexpr std::array<VMGpuInfo, 7> vm_gpu_names = { {
7563+
constexpr std::array<VMGpuInfo, 10> vm_gpu_names = { {
75637564
{ L"VMware SVGA 3D", brands::VMWARE, 14 },
75647565
{ L"VirtualBox Graphics Adapter", brands::VBOX, 27 },
75657566
{ L"QXL GPU", brands::KVM, 7 },
75667567
{ L"VirGL 3D", brands::QEMU, 8 },
75677568
{ L"Microsoft Hyper-V Video", brands::HYPERV, 23 },
75687569
{ L"Parallels Display Adapter (WDDM)", brands::PARALLELS, 32 },
7569-
{ L"Bochs Graphics Adapter", brands::BOCHS, 22 }
7570+
{ L"Bochs Graphics Adapter", brands::BOCHS, 22 },
7571+
{ L"Bochs Graphics Adapter", brands::BOCHS, 22 },
7572+
{ L"Virtual Display Driver", brands::NULL_BRAND, 22 },
7573+
{ L"IddSampleDriver Device", brands::NULL_BRAND, 22 }
75707574
} };
75717575

75727576
DISPLAY_DEVICEW dd{};
@@ -7585,8 +7589,11 @@ struct VM {
75857589
const char* brand = entry.brand;
75867590
const size_t len = entry.length;
75877591
#endif
7588-
if (deviceStrLen == len && wcscmp(deviceStr, name) == 0) {
7589-
return core::add(brand);;
7592+
if (deviceStrLen == len && wcscmp(deviceStr, name) == 0) {
7593+
char* castedName = (char*)calloc(len, sizeof(char));
7594+
size_t ret = wcstombs(castedName, name, len);
7595+
castedName[ret] = '\0';
7596+
return core::add(brand);
75907597
}
75917598
}
75927599

‎src/vmaware_MIT.hpp‎

Lines changed: 120 additions & 120 deletions
Original file line numberDiff line numberDiff line change
@@ -384,15 +384,10 @@
384384
#include <psapi.h>
385385
#include <shlwapi.h>
386386
#include <shlobj_core.h>
387-
#include <dshow.h>
388-
#include <io.h>
389387
#include <winspool.h>
390388
#include <powerbase.h>
391389
#include <setupapi.h>
392-
#include <mmdeviceapi.h>
393-
#include <Functiondiscoverykeys_devpkey.h>
394390
#include <mmsystem.h>
395-
#include <queue>
396391
#include <dxgi.h>
397392
#include <d3d9.h>
398393

@@ -3100,7 +3095,7 @@ struct VM {
31003095
key(brands::WINE, "HKLM\\SOFTWARE\\Wine");
31013096

31023097
// Xen
3103-
key(brands::KVM, "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI\\VEN_5853*");
3098+
key(brands::XEN, "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI\\VEN_5853*");
31043099
key(brands::XEN, "HKLM\\HARDWARE\\ACPI\\DSDT\\xen");
31053100
key(brands::XEN, "HKLM\\HARDWARE\\ACPI\\FADT\\xen");
31063101
key(brands::XEN, "HKLM\\HARDWARE\\ACPI\\RSDT\\xen");
@@ -7336,6 +7331,7 @@ struct VM {
73367331
* @brief Check for specific GPU string signatures related to VMs
73377332
* @category Windows
73387333
* @author Requiem (https://github.com/NotRequiem)
7334+
* @author dmfrpro (https://github.com/dmfrpro) (VDD detection)
73397335
* @note utoshu did this with WMI in a removed technique (VM::GPU_CHIPTYPE)
73407336
* @implements VM::GPU_VM_STRING
73417337
*/
@@ -7349,14 +7345,17 @@ struct VM {
73497345
size_t length;
73507346
};
73517347

7352-
constexpr std::array<VMGpuInfo, 7> vm_gpu_names = { {
7348+
constexpr std::array<VMGpuInfo, 10> vm_gpu_names = { {
73537349
{ L"VMware SVGA 3D", brands::VMWARE, 14 },
73547350
{ L"VirtualBox Graphics Adapter", brands::VBOX, 27 },
73557351
{ L"QXL GPU", brands::KVM, 7 },
73567352
{ L"VirGL 3D", brands::QEMU, 8 },
73577353
{ L"Microsoft Hyper-V Video", brands::HYPERV, 23 },
73587354
{ L"Parallels Display Adapter (WDDM)", brands::PARALLELS, 32 },
7359-
{ L"Bochs Graphics Adapter", brands::BOCHS, 22 }
7355+
{ L"Bochs Graphics Adapter", brands::BOCHS, 22 },
7356+
{ L"Bochs Graphics Adapter", brands::BOCHS, 22 },
7357+
{ L"Virtual Display Driver", brands::NULL_BRAND, 22 },
7358+
{ L"IddSampleDriver Device", brands::NULL_BRAND, 22 }
73607359
} };
73617360

73627361
DISPLAY_DEVICEW dd{};
@@ -7375,8 +7374,11 @@ struct VM {
73757374
const char* brand = entry.brand;
73767375
const size_t len = entry.length;
73777376
#endif
7378-
if (deviceStrLen == len && wcscmp(deviceStr, name) == 0) {
7379-
return core::add(brand);;
7377+
if (deviceStrLen == len && wcscmp(deviceStr, name) == 0) {
7378+
char* castedName = (char*)calloc(len, sizeof(char));
7379+
size_t ret = wcstombs(castedName, name, len);
7380+
castedName[ret] = '\0';
7381+
return core::add(brand);
73807382
}
73817383
}
73827384

@@ -7675,7 +7677,7 @@ struct VM {
76757677
newParam.sched_priority = sched_get_priority_max(SCHED_FIFO);
76767678

76777679
if (sched_setscheduler(0, SCHED_FIFO, &newParam) == -1) {
7678-
hasSchedPriority = false;
7680+
hasSchedPriority = false;
76797681
}
76807682
}
76817683
#endif
@@ -7946,7 +7948,7 @@ struct VM {
79467948
? (tscCore2 - tscCore1)
79477949
: (tscCore1 - tscCore2);
79487950

7949-
if (diff < tscSyncDiffThreshold) {
7951+
if (diff < tscSyncDiffThreshold) {
79507952
tscIssueCount++;
79517953
}
79527954
}
@@ -10773,8 +10775,6 @@ struct VM {
1077310775
// brand is "Azure Hyper-V" instead of just "Hyper-V". So what
1077410776
// this section does is "merge" the brands together to form
1077510777
// a more accurate idea of the brand(s) involved.
10776-
10777-
1077810778
merge(TMP_AZURE, TMP_HYPERV, TMP_AZURE);
1077910779
merge(TMP_AZURE, TMP_VPC, TMP_AZURE);
1078010780
merge(TMP_AZURE, TMP_HYPERV_VPC, TMP_AZURE);
@@ -11035,112 +11035,112 @@ struct VM {
1103511035
*/
1103611036
[[nodiscard]] static std::string flag_to_string(const enum_flags flag) {
1103711037
switch (flag) {
11038-
case VMID: return "VMID";
11039-
case CPU_BRAND: return "CPU_BRAND";
11040-
case HYPERVISOR_BIT: return "HYPERVISOR_BIT";
11041-
case HYPERVISOR_STR: return "HYPERVISOR_STR";
11042-
case TIMER: return "TIMER";
11043-
case THREADCOUNT: return "THREADCOUNT";
11044-
case MAC: return "MAC";
11045-
case TEMPERATURE: return "TEMPERATURE";
11046-
case SYSTEMD: return "SYSTEMD";
11047-
case CVENDOR: return "CVENDOR";
11048-
case CTYPE: return "CTYPE";
11049-
case DOCKERENV: return "DOCKERENV";
11050-
case DMIDECODE: return "DMIDECODE";
11051-
case DMESG: return "DMESG";
11052-
case HWMON: return "HWMON";
11053-
case SIDT5: return "SIDT5";
11054-
case DLL: return "DLL";
11055-
case REGISTRY: return "REGISTRY";
11056-
case VM_FILES: return "VM_FILES";
11057-
case HWMODEL: return "HWMODEL";
11058-
case DISK_SIZE: return "DISK_SIZE";
11059-
case VBOX_DEFAULT: return "VBOX_DEFAULT";
11060-
case VBOX_NETWORK: return "VBOX_NETWORK";
11061-
case VM_PROCESSES: return "VM_PROCESSES";
11062-
case LINUX_USER_HOST: return "LINUX_USER_HOST";
11063-
case GAMARUE: return "GAMARUE";
11064-
case BOCHS_CPU: return "BOCHS_CPU";
11065-
case MSSMBIOS: return "MSSMBIOS";
11066-
case MAC_MEMSIZE: return "MAC_MEMSIZE";
11067-
case MAC_IOKIT: return "MAC_IOKIT";
11068-
case IOREG_GREP: return "IOREG_GREP";
11069-
case MAC_SIP: return "MAC_SIP";
11070-
case HKLM_REGISTRIES: return "HKLM_REGISTRIES";
11071-
case QEMU_GA: return "QEMU_GA";
11072-
case VPC_INVALID: return "VPC_INVALID";
11073-
case SIDT: return "SIDT";
11074-
case SGDT: return "SGDT";
11075-
case SLDT: return "SLDT";
11076-
case OFFSEC_SIDT: return "OFFSEC_SIDT";
11077-
case OFFSEC_SGDT: return "OFFSEC_SGDT";
11078-
case OFFSEC_SLDT: return "OFFSEC_SLDT";
11079-
case VPC_SIDT: return "VPC_SIDT";
11080-
case VMWARE_IOMEM: return "VMWARE_IOMEM";
11081-
case VMWARE_IOPORTS: return "VMWARE_IOPORTS";
11082-
case VMWARE_SCSI: return "VMWARE_SCSI";
11083-
case VMWARE_DMESG: return "VMWARE_DMESG";
11084-
case VMWARE_STR: return "VMWARE_STR";
11085-
case VMWARE_BACKDOOR: return "VMWARE_BACKDOOR";
11086-
case VMWARE_PORT_MEM: return "VMWARE_PORT_MEM";
11087-
case SMSW: return "SMSW";
11088-
case MUTEX: return "MUTEX";
11089-
case ODD_CPU_THREADS: return "ODD_CPU_THREADS";
11090-
case INTEL_THREAD_MISMATCH: return "INTEL_THREAD_MISMATCH";
11091-
case XEON_THREAD_MISMATCH: return "XEON_THREAD_MISMATCH";
11092-
case NETTITUDE_VM_MEMORY: return "NETTITUDE_VM_MEMORY";
11093-
case CUCKOO_DIR: return "CUCKOO_DIR";
11094-
case CUCKOO_PIPE: return "CUCKOO_PIPE";
11095-
case HYPERV_HOSTNAME: return "HYPERV_HOSTNAME";
11096-
case GENERAL_HOSTNAME: return "GENERAL_HOSTNAME";
11097-
case SCREEN_RESOLUTION: return "SCREEN_RESOLUTION";
11098-
case DEVICE_STRING: return "DEVICE_STRING";
11099-
case BLUESTACKS_FOLDERS: return "BLUESTACKS_FOLDERS";
11100-
case CPUID_SIGNATURE: return "CPUID_SIGNATURE";
11101-
case KVM_BITMASK: return "KVM_BITMASK";
11102-
case KGT_SIGNATURE: return "KGT_SIGNATURE";
11103-
case QEMU_VIRTUAL_DMI: return "QEMU_VIRTUAL_DMI";
11104-
case QEMU_USB: return "QEMU_USB";
11105-
case HYPERVISOR_DIR: return "HYPERVISOR_DIR";
11106-
case UML_CPU: return "UML_CPU";
11107-
case KMSG: return "KMSG";
11108-
case VM_PROCS: return "VM_PROCS";
11109-
case VBOX_MODULE: return "VBOX_MODULE";
11110-
case SYSINFO_PROC: return "SYSINFO_PROC";
11111-
case DEVICE_TREE: return "DEVICE_TREE";
11112-
case DMI_SCAN: return "DMI_SCAN";
11113-
case SMBIOS_VM_BIT: return "SMBIOS_VM_BIT";
11114-
case PODMAN_FILE: return "PODMAN_FILE";
11115-
case WSL_PROC: return "WSL_PROC";
11116-
case DRIVER_NAMES: return "DRIVER_NAMES";
11117-
case VM_SIDT: return "VM_SIDT";
11118-
case HDD_SERIAL: return "HDD_SERIAL";
11119-
case PORT_CONNECTORS: return "PORT_CONNECTORS";
11120-
case GPU_VM_STRINGS: return "GPU_STRINGS";
11121-
case GPU_CAPABILITIES: return "GPU_CAPABILITIES";
11122-
case VM_DEVICES: return "VM_DEVICES";
11123-
case PROCESSOR_NUMBER: return "PROCESSOR_NUMBER";
11124-
case NUMBER_OF_CORES: return "NUMBER_OF_CORES";
11125-
case ACPI_TEMPERATURE: return "ACPI_TEMPERATURE";
11126-
case SYS_QEMU: return "SYS_QEMU";
11127-
case LSHW_QEMU: return "LSHW_QEMU";
11128-
case VIRTUAL_PROCESSORS: return "VIRTUAL_PROCESSORS";
11129-
case HYPERV_QUERY: return "HYPERV_QUERY";
11130-
case BAD_POOLS: return "BAD_POOLS";
11131-
case AMD_SEV: return "AMD_SEV";
11132-
case AMD_THREAD_MISMATCH: return "AMD_THREAD_MISMATCH";
11133-
case NATIVE_VHD: return "NATIVE_VHD";
11134-
case VIRTUAL_REGISTRY: return "VIRTUAL_REGISTRY";
11135-
case FIRMWARE: return "FIRMWARE";
11136-
case FILE_ACCESS_HISTORY: return "FILE_ACCESS_HISTORY";
11137-
case AUDIO: return "AUDIO";
11138-
case UNKNOWN_MANUFACTURER: return "UNKNOWN_MANUFACTURER";
11139-
case OSXSAVE: return "OSXSAVE";
11140-
case NSJAIL_PID: return "NSJAIL_PID";
11141-
case PCI_VM: return "PCI_VM";
11142-
// ADD NEW CASE HERE FOR NEW TECHNIQUE
11143-
default: return "Unknown flag";
11038+
case VMID: return "VMID";
11039+
case CPU_BRAND: return "CPU_BRAND";
11040+
case HYPERVISOR_BIT: return "HYPERVISOR_BIT";
11041+
case HYPERVISOR_STR: return "HYPERVISOR_STR";
11042+
case TIMER: return "TIMER";
11043+
case THREADCOUNT: return "THREADCOUNT";
11044+
case MAC: return "MAC";
11045+
case TEMPERATURE: return "TEMPERATURE";
11046+
case SYSTEMD: return "SYSTEMD";
11047+
case CVENDOR: return "CVENDOR";
11048+
case CTYPE: return "CTYPE";
11049+
case DOCKERENV: return "DOCKERENV";
11050+
case DMIDECODE: return "DMIDECODE";
11051+
case DMESG: return "DMESG";
11052+
case HWMON: return "HWMON";
11053+
case SIDT5: return "SIDT5";
11054+
case DLL: return "DLL";
11055+
case REGISTRY: return "REGISTRY";
11056+
case VM_FILES: return "VM_FILES";
11057+
case HWMODEL: return "HWMODEL";
11058+
case DISK_SIZE: return "DISK_SIZE";
11059+
case VBOX_DEFAULT: return "VBOX_DEFAULT";
11060+
case VBOX_NETWORK: return "VBOX_NETWORK";
11061+
case VM_PROCESSES: return "VM_PROCESSES";
11062+
case LINUX_USER_HOST: return "LINUX_USER_HOST";
11063+
case GAMARUE: return "GAMARUE";
11064+
case BOCHS_CPU: return "BOCHS_CPU";
11065+
case MSSMBIOS: return "MSSMBIOS";
11066+
case MAC_MEMSIZE: return "MAC_MEMSIZE";
11067+
case MAC_IOKIT: return "MAC_IOKIT";
11068+
case IOREG_GREP: return "IOREG_GREP";
11069+
case MAC_SIP: return "MAC_SIP";
11070+
case HKLM_REGISTRIES: return "HKLM_REGISTRIES";
11071+
case QEMU_GA: return "QEMU_GA";
11072+
case VPC_INVALID: return "VPC_INVALID";
11073+
case SIDT: return "SIDT";
11074+
case SGDT: return "SGDT";
11075+
case SLDT: return "SLDT";
11076+
case OFFSEC_SIDT: return "OFFSEC_SIDT";
11077+
case OFFSEC_SGDT: return "OFFSEC_SGDT";
11078+
case OFFSEC_SLDT: return "OFFSEC_SLDT";
11079+
case VPC_SIDT: return "VPC_SIDT";
11080+
case VMWARE_IOMEM: return "VMWARE_IOMEM";
11081+
case VMWARE_IOPORTS: return "VMWARE_IOPORTS";
11082+
case VMWARE_SCSI: return "VMWARE_SCSI";
11083+
case VMWARE_DMESG: return "VMWARE_DMESG";
11084+
case VMWARE_STR: return "VMWARE_STR";
11085+
case VMWARE_BACKDOOR: return "VMWARE_BACKDOOR";
11086+
case VMWARE_PORT_MEM: return "VMWARE_PORT_MEM";
11087+
case SMSW: return "SMSW";
11088+
case MUTEX: return "MUTEX";
11089+
case ODD_CPU_THREADS: return "ODD_CPU_THREADS";
11090+
case INTEL_THREAD_MISMATCH: return "INTEL_THREAD_MISMATCH";
11091+
case XEON_THREAD_MISMATCH: return "XEON_THREAD_MISMATCH";
11092+
case NETTITUDE_VM_MEMORY: return "NETTITUDE_VM_MEMORY";
11093+
case CUCKOO_DIR: return "CUCKOO_DIR";
11094+
case CUCKOO_PIPE: return "CUCKOO_PIPE";
11095+
case HYPERV_HOSTNAME: return "HYPERV_HOSTNAME";
11096+
case GENERAL_HOSTNAME: return "GENERAL_HOSTNAME";
11097+
case SCREEN_RESOLUTION: return "SCREEN_RESOLUTION";
11098+
case DEVICE_STRING: return "DEVICE_STRING";
11099+
case BLUESTACKS_FOLDERS: return "BLUESTACKS_FOLDERS";
11100+
case CPUID_SIGNATURE: return "CPUID_SIGNATURE";
11101+
case KVM_BITMASK: return "KVM_BITMASK";
11102+
case KGT_SIGNATURE: return "KGT_SIGNATURE";
11103+
case QEMU_VIRTUAL_DMI: return "QEMU_VIRTUAL_DMI";
11104+
case QEMU_USB: return "QEMU_USB";
11105+
case HYPERVISOR_DIR: return "HYPERVISOR_DIR";
11106+
case UML_CPU: return "UML_CPU";
11107+
case KMSG: return "KMSG";
11108+
case VM_PROCS: return "VM_PROCS";
11109+
case VBOX_MODULE: return "VBOX_MODULE";
11110+
case SYSINFO_PROC: return "SYSINFO_PROC";
11111+
case DEVICE_TREE: return "DEVICE_TREE";
11112+
case DMI_SCAN: return "DMI_SCAN";
11113+
case SMBIOS_VM_BIT: return "SMBIOS_VM_BIT";
11114+
case PODMAN_FILE: return "PODMAN_FILE";
11115+
case WSL_PROC: return "WSL_PROC";
11116+
case DRIVER_NAMES: return "DRIVER_NAMES";
11117+
case VM_SIDT: return "VM_SIDT";
11118+
case HDD_SERIAL: return "HDD_SERIAL";
11119+
case PORT_CONNECTORS: return "PORT_CONNECTORS";
11120+
case GPU_VM_STRINGS: return "GPU_STRINGS";
11121+
case GPU_CAPABILITIES: return "GPU_CAPABILITIES";
11122+
case VM_DEVICES: return "VM_DEVICES";
11123+
case PROCESSOR_NUMBER: return "PROCESSOR_NUMBER";
11124+
case NUMBER_OF_CORES: return "NUMBER_OF_CORES";
11125+
case ACPI_TEMPERATURE: return "ACPI_TEMPERATURE";
11126+
case SYS_QEMU: return "SYS_QEMU";
11127+
case LSHW_QEMU: return "LSHW_QEMU";
11128+
case VIRTUAL_PROCESSORS: return "VIRTUAL_PROCESSORS";
11129+
case HYPERV_QUERY: return "HYPERV_QUERY";
11130+
case BAD_POOLS: return "BAD_POOLS";
11131+
case AMD_SEV: return "AMD_SEV";
11132+
case AMD_THREAD_MISMATCH: return "AMD_THREAD_MISMATCH";
11133+
case NATIVE_VHD: return "NATIVE_VHD";
11134+
case VIRTUAL_REGISTRY: return "VIRTUAL_REGISTRY";
11135+
case FIRMWARE: return "FIRMWARE";
11136+
case FILE_ACCESS_HISTORY: return "FILE_ACCESS_HISTORY";
11137+
case AUDIO: return "AUDIO";
11138+
case UNKNOWN_MANUFACTURER: return "UNKNOWN_MANUFACTURER";
11139+
case OSXSAVE: return "OSXSAVE";
11140+
case NSJAIL_PID: return "NSJAIL_PID";
11141+
case PCI_VM: return "PCI_VM";
11142+
// ADD NEW CASE HERE FOR NEW TECHNIQUE
11143+
default: return "Unknown flag";
1114411144
}
1114511145
}
1114611146

0 commit comments

Comments
 (0)