From 71bfd0f688962f6873a9244f40f0df5b6147f246 Mon Sep 17 00:00:00 2001 From: Existential-Kernel Date: Thu, 21 Dec 2023 03:32:03 +0000 Subject: [PATCH] fixed (i think) --- docs/documentation.md | 1 + src/cli.cpp | 1 + src/vmaware.hpp | 27 ++++++++++++++++++--------- 3 files changed, 20 insertions(+), 9 deletions(-) diff --git a/docs/documentation.md b/docs/documentation.md index 8a6e5c5..50236ec 100644 --- a/docs/documentation.md +++ b/docs/documentation.md @@ -162,6 +162,7 @@ VMAware provides a convenient way to not only check for VMs, but also have the f | `VM::LOADED_DLLS` | Check for DLLs of multiple VM brands | Windows | 75% | | | `VM::QEMU_BRAND` | Check for QEMU CPU brand with cpuid | Yes | 100% | | | `VM::BOCHS_CPU` | Check for Bochs cpuid emulation oversights | Yes | 95% | | +| `VM::VPC_BOARD` | Check for VPC specific string in motherboard manufacturer | Windows | 20% | |
diff --git a/src/cli.cpp b/src/cli.cpp index 00da588..f534056 100644 --- a/src/cli.cpp +++ b/src/cli.cpp @@ -108,6 +108,7 @@ int main(int argc, char* argv[]) { checker(VM::LOADED_DLLS, "loaded DLLs"); checker(VM::QEMU_BRAND, "QEMU CPU brand"); checker(VM::BOCHS_CPU, "BOCHS CPU techniques"); + checker(VM::VPC_BOARD, "VirtualPC motherboard"); std::printf("\n"); std::cout << "VM brand: " << (std::string(VM::brand()) == "Unknown" ? red : green) << VM::brand() << ansi_exit << "\n\n"; diff --git a/src/vmaware.hpp b/src/vmaware.hpp index 4c4d827..09afe5c 100644 --- a/src/vmaware.hpp +++ b/src/vmaware.hpp @@ -833,6 +833,7 @@ struct VM { LOADED_DLLS = 1ULL << 45, QEMU_BRAND = 1ULL << 46, BOCHS_CPU = 1ULL << 47, + VPC_BOARD = 1ULL << 48, // __UNIQUE_LABEL, ADD YOUR UNIQUE FUNCTION FLAG VALUE ABOVE HERE @@ -1072,7 +1073,10 @@ struct VM { #endif if (match_count > 0) { - if (std::find(brand.begin(), brand.end(), "QEMU") != brand.end()) { + const auto qemu_regex = std::regex("QEMU", std::regex::icase); + const bool qemu_match = std::regex_search(brand, qemu_regex); + + if (qemu_match) { return add(QEMU); } } @@ -3390,7 +3394,7 @@ struct VM { } // technique 3: Check for AMD easter egg for K7 and K8 CPUs - u32 eax = 0; + u32 unused, eax = 0; cpuid(eax, unused, unused, unused, 1); const u32 family = ((eax >> 8) & 0xF); @@ -3417,6 +3421,10 @@ struct VM { } + /** + * @brief Go through the motherboard and match for VPC-specific string + * @category Windows + */ [[nodiscard]] static bool vpc_board() try { if (disabled(VPC_BOARD)) { return false; @@ -3430,7 +3438,7 @@ struct VM { hres = CoInitializeEx(0, COINIT_MULTITHREADED); if (FAILED(hres)) { #ifdef __VMAWARE_DEBUG__ - debug("Failed to initialize COM library. Error code: ", hres); + debug("VPC_BOARD: Failed to initialize COM library. Error code: ", hres); #endif return false; } @@ -3449,7 +3457,7 @@ struct VM { if (FAILED(hres)) { #ifdef __VMAWARE_DEBUG__ - debug("Failed to initialize security. Error code: ", hres); + debug("VPC_BOARD: Failed to initialize security. Error code: ", hres); #endif CoUninitialize(); return false; @@ -3468,7 +3476,7 @@ struct VM { if (FAILED(hres)) { #ifdef __VMAWARE_DEBUG__ - debug("Failed to create IWbemLocator object. Error code: ", hres); + debug("VPC_BOARD: Failed to create IWbemLocator object. Error code: ", hres); #endif CoUninitialize(); return false; @@ -3487,7 +3495,7 @@ struct VM { if (FAILED(hres)) { #ifdef __VMAWARE_DEBUG__ - debug("Failed to connect to WMI. Error code: ", hres); + debug("VPC_BOARD: Failed to connect to WMI. Error code: ", hres); #endif pLoc->Release(); CoUninitialize(); @@ -3507,7 +3515,7 @@ struct VM { if (FAILED(hres)) { #ifdef __VMAWARE_DEBUG__ - debug("Failed to set proxy blanket. Error code: ", hres); + debug("VPC_BOARD: Failed to set proxy blanket. Error code: ", hres); #endif pSvc->Release(); pLoc->Release(); @@ -3526,7 +3534,7 @@ struct VM { if (FAILED(hres)) { #ifdef __VMAWARE_DEBUG__ - debug("Query for Win32_BaseBoard failed. Error code: ", hres); + debug("VPC_BOARD: Query for Win32_BaseBoard failed. Error code: ", hres); #endif pSvc->Release(); pLoc->Release(); @@ -3888,7 +3896,8 @@ const std::map VM::table = { { VM::SPEC_RDTSC, { 80, VM::speculative_rdtsc }}, { VM::LOADED_DLLS, { 75, VM::loaded_dlls }}, { VM::QEMU_BRAND, { 100, VM::cpu_brand_qemu }}, - { VM::BOCHS_CPU, { 95, VM::bochs_cpu }} + { VM::BOCHS_CPU, { 95, VM::bochs_cpu }}, + { VM::VPC_BOARD, { 20, VM::vpc_board }} // __TABLE_LABEL, add your technique above // { VM::YOUR_FUNCTION, { POINTS, FUNCTION POINTER }}