Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added native_vhd, virtual_registry and firmware_scan techniques #231

Merged
merged 1 commit into from
Jan 28, 2025
Merged

added native_vhd, virtual_registry and firmware_scan techniques #231

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/documentation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -459,6 +459,9 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
| `VM::AMD_SEV` | Check for AMD-SEV MSR running on the system | Linux and MacOS | 50% | Admin | | | |
| `VM::AMD_RESERVED` | Check for bits that should be reserved in leaf 8000000Ah | 50% | | | | |
| `VM::AMD_THREAD_MISMATCH` | Check for AMD CPU thread count database if it matches the system's thread count | | 100% | | | | |
| `VM::NATIVE_VHD` | Checks if the OS was booted from a VHD container | | 100% | | | | |
| `VM::VIRTUAL_REGISTRY` | Checks for particular object directory which is present in Sandboxie virtual environment but not in usual host systems | | 65% | | | | |
| `VM::FIRMWARE_SCAN` | Checks for VM signatures in firmware | | 90% | | | | |
<!-- ADD DETAILS HERE -->

<br>
Expand Down
7 changes: 7 additions & 0 deletions src/cli.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -475,6 +475,9 @@ bool is_unsupported(VM::enum_flags flag) {
case VM::HYPERV_QUERY:
case VM::BAD_POOLS:
case VM::AMD_THREAD_MISMATCH:
case VM::NATIVE_VHD:
case VM::VIRTUAL_REGISTRY:
case VM::FIRMWARE_SCAN:
// ADD WINDOWS FLAG
return false;
default: return true;
Expand Down Expand Up @@ -1003,6 +1006,10 @@ void general() {
checker(VM::AMD_SEV, "AMD-SEV MSR");
checker(VM::AMD_RESERVED, "AMD reserved bits");
checker(VM::AMD_THREAD_MISMATCH, "AMD thread count mismatch");
checker(VM::NATIVE_VHD, "VHD containers");
checker(VM::VIRTUAL_REGISTRY, "registry emulation");
checker(VM::FIRMWARE_SCAN, "firmware signatures");

// ADD NEW TECHNIQUE CHECKER HERE

std::printf("\n");
Expand Down
Loading