Merge branch 'dev' of https://github.com/kernelwernel/VMAware into dev

Author: kernelwernel

src/vmaware.hpp

@@ -6566,7 +6566,7 @@ struct VM {
         for (int i = 0; i < 3; i++) {
             DWORD count = parse_memory_map(NULL, resource_keys[i], L".Translated");
             if (count == 0) {
-                return false;  // Error or no VM detected
+                return false;
             }
             if (i == 0) phys_count = count;
             if (i == 1) reserved_count = count;
@@ -8446,6 +8446,9 @@ struct VM {
         const bool sleep_variance_detected = average_cycles >= threshold;
         const bool spammer_detected = (measurement / 1000) > 55000;
 
+        debug("Classic check - Average cycles: ", average_cycles, " (threshold: ", threshold, ")");
+        debug("Spammer check - Average cycles: ", (measurement / 1000), " (threshold: 55000)");
+
     #if (WINDOWS)
         // Windows-specific QPC check: Compare trapping vs non-trapping instruction timing
         LARGE_INTEGER startQPC, endQPC;
@@ -8468,6 +8471,7 @@ struct VM {
         LONGLONG dummyTime = endQPC.QuadPart - startQPC.QuadPart;
 
         const bool qpc_check = (dummyTime != 0) && ((cpuIdTime / dummyTime) > 1100);
+        debug("QPC check - CPUID: ", cpuIdTime, "ns, Dummy: ", dummyTime, "ns, Ratio: ", (cpuIdTime / dummyTime));
 
         // TSC sync check across cores. Try reading the invariant TSC on two different cores to attempt to detect vCPU timers being shared
         unsigned aux;
@@ -8476,7 +8480,9 @@ struct VM {
         SetThreadAffinityMask(GetCurrentThread(), 2);
         u64 tsc_core2 = __rdtscp(&aux);  // Core 2 TSC
         SetThreadAffinityMask(GetCurrentThread(), old_mask);
+
         const bool tsc_sync_check = std::llabs(static_cast<long long>(tsc_core2 - tsc_core1)) > 10000000LL;
+        debug("TSC sync check - Core1: ", tsc_core1, " Core2: ", tsc_core2, " Diff: ", tsc_core2 - tsc_core1);
 
         return sleep_variance_detected || spammer_detected || qpc_check || tsc_sync_check;
     #else