Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

amd_reserved technique / vm_memory technique #2 #227

Closed
wants to merge 3 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions TODO.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@
- [ ] add github metrics for license (looks cool af)
- [ ] organise the registry existence function better and group them together as a single utility function
- [ ] add C++20 concepts for the VM::add_custom() function
- [ ] add c++20 module support
- [ ] upload the lib to dnf
- [ ] upload the lib to apt
- [ ] add c++20 module support
- [ ] make a man file in markdown for the cli tool
- [ ] implement techniques from here https://stackoverflow.com/questions/43026032/detect-running-on-virtual-machine
- [ ] add a .clang_format thingy
Expand All @@ -26,8 +26,7 @@
- [ ] implement techniques from here https://www.cyberciti.biz/faq/linux-determine-virtualization-technology-command/
- [ ] implement techniques from virt-what
- [ ] https://cloud.google.com/compute/docs/instances/detect-compute-engine
- [ ] find for potential things that can be used here https://en.wikipedia.org/wiki/CPUID#EAX=8000'000Ah:_SVM_features
- [ ] make the hyper_x function more intuitive with enum value comparisons
- [ ] make amd_thread_mismatch technique

# Distant plans
- add the library to conan.io when released
Expand Down
3 changes: 2 additions & 1 deletion docs/documentation.md
Original file line number Diff line number Diff line change
Expand Up @@ -437,7 +437,7 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
| `VM::ACPI_DETECT` | Check for VM related strings in ACPI data | Windows | 85% | | | | |
| `VM::GPU_NAME` | Check for VM specific device names in GPUs | Windows | 100% | | | | |
| `VM::VM_DEVICES` | Check for VM-specific devices | Windows | 45% | | | | |
| `VM::VMWARE_MEMORY` | Check for VMware-specific memory traces in certain processes | Windows | 50% | | | | |
| `VM::VMWARE_MEMORY` | Check for specific VM memory traces in certain processes | Windows | 80% | | | | |
| `VM::IDT_GDT_MISMATCH` | Check if the IDT and GDT limit addresses mismatch between different CPU cores | Windows | 25% | | | | |
| `VM::PROCESSOR_NUMBER` | Check for number of processors | Windows | 50% | | | | |
| `VM::NUMBER_OF_CORES` | Check for number of cores | Windows | 50% | | | | |
Expand All @@ -457,6 +457,7 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
| `VM::HYPERV_QUERY` | Checks if a call to NtQuerySystemInformation with the 0x9f leaf fills a _SYSTEM_HYPERVISOR_DETAIL_INFORMATION structure | Windows | 50% | | | | |
| `VM::BAD_POOLS` | Checks for system pools allocated by hypervisors | Windows | 80% | | | | |
| `VM::AMD_SEV` | Check for AMD-SEV MSR running on the system | Linux and MacOS | 50% | Admin | | | |
| `VM::AMD_RESERVED` | Check for bits that should be reserved in leaf 8000000Ah | 50% | | | | |
<!-- ADD DETAILS HERE -->

<br>
Expand Down
18 changes: 12 additions & 6 deletions src/cli.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -467,8 +467,8 @@ bool is_unsupported(VM::enum_flags flag) {
case VM::VM_HDD:
case VM::ACPI_DETECT:
case VM::GPU_NAME:
case VM::VMWARE_DEVICES:
case VM::VMWARE_MEMORY:
case VM::VM_DEVICES:
case VM::VM_MEMORY:
case VM::IDT_GDT_MISMATCH:
case VM::PROCESSOR_NUMBER:
case VM::NUMBER_OF_CORES:
Expand Down Expand Up @@ -899,8 +899,8 @@ void general() {
checker(VM::VM_HDD, "VM keywords in HDD model");
checker(VM::ACPI_DETECT, "ACPI Hyper-V");
checker(VM::GPU_NAME, "GPU name");
checker(VM::VMWARE_DEVICES, "VMware devices");
checker(VM::VMWARE_MEMORY, "VM memory traces");
checker(VM::VM_DEVICES, "VM devices");
checker(VM::VM_MEMORY, "VM memory traces");
checker(VM::IDT_GDT_MISMATCH, "IDT GDT mismatch");
checker(VM::PROCESSOR_NUMBER, "Processor count");
checker(VM::NUMBER_OF_CORES, "CPU core count");
Expand All @@ -913,8 +913,14 @@ void general() {
checker(VM::SETUPAPI_DISK, "SETUPDI diskdrive");
checker(VM::VMWARE_HARDENER, "VMWARE HARDENER");
checker(VM::WMI_QUERIES, "WMI QUERIES");
checker(VM::SYS_QEMU, "QEMU in /sys");
checker(VM::LSHW_QEMU, "QEMU in lshw output");
checker(VM::SYS_QEMU, "QEMU in /sys");
checker(VM::LSHW_QEMU, "QEMU in lshw output");
checker(VM::VIRTUAL_PROCESSORS, "virtual processors");
checker(VM::MOTHERBOARD_PRODUCT, "motherboard product");
checker(VM::HYPERV_QUERY, "hypervisor query");
checker(VM::BAD_POOLS, "bad memory pools");
checker(VM::AMD_SEV, "AMD-SEV MSR");
checker(VM::AMD_RESERVED, "AMD reserved bits");
// ADD NEW TECHNIQUE CHECKER HERE

std::printf("\n");
Expand Down
Loading
Loading