Skip to content

Commit 250a1f3

Browse files
authored
Merge pull request #445 from NotRequiem/dev
Improved checks for QEMU device signatures
2 parents 0fa1c3c + 0f95280 commit 250a1f3

File tree

3 files changed

+223
-124
lines changed

3 files changed

+223
-124
lines changed

auxiliary/boot_logo_hasher.cpp

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/**
2+
* ██╗ ██╗███╗ ███╗ █████╗ ██╗ ██╗ █████╗ ██████╗ ███████╗
3+
* ██║ ██║████╗ ████║██╔══██╗██║ ██║██╔══██╗██╔══██╗██╔════╝
4+
* ██║ ██║██╔████╔██║███████║██║ █╗ ██║███████║██████╔╝█████╗
5+
* ╚██╗ ██╔╝██║╚██╔╝██║██╔══██║██║███╗██║██╔══██║██╔══██╗██╔══╝
6+
* ╚████╔╝ ██║ ╚═╝ ██║██║ ██║╚███╔███╔╝██║ ██║██║ ██║███████╗
7+
* ╚═══╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝
8+
*
9+
* C++ VM detection library
10+
*
11+
* ===============================================================
12+
*
13+
* This program computes a CRC32 checksum of boot logo images
14+
* via hardware‐accelerated intrinsics in 8-byte chunks.
15+
*
16+
* ===============================================================
17+
*
18+
* - Made by: @Requiem (https://github.com/NotRequiem)
19+
* - Repository: https://github.com/kernelwernel/VMAware
20+
* - License: MIT
21+
*/
22+
23+
#include <immintrin.h>
24+
#include <fstream>
25+
#include <vector>
26+
#include <iostream>
27+
#include <cstdint>
28+
29+
static inline uint32_t crc32c_bmp(const char* filename) {
30+
std::ifstream in{ filename, std::ios::binary | std::ios::ate };
31+
auto size = in.tellg();
32+
in.seekg(0);
33+
std::vector<uint8_t> buf(size);
34+
in.read(reinterpret_cast<char*>(buf.data()), size);
35+
36+
// BMP offset at bytes 10–13
37+
uint32_t offset = *reinterpret_cast<uint32_t*>(buf.data() + 10);
38+
uint8_t* bmp = buf.data() + offset;
39+
size_t len = buf.size() - offset;
40+
41+
uint64_t crcReg = 0xFFFFFFFFull;
42+
size_t qwords = len / 8;
43+
auto ptr = reinterpret_cast<uint64_t*>(bmp);
44+
for (size_t i = 0; i < qwords; ++i)
45+
crcReg = _mm_crc32_u64(crcReg, ptr[i]);
46+
47+
uint32_t crc = static_cast<uint32_t>(crcReg);
48+
auto tail = reinterpret_cast<uint8_t*>(ptr + qwords);
49+
for (size_t i = 0, r = len & 7; i < r; ++i)
50+
crc = _mm_crc32_u8(crc, tail[i]);
51+
52+
return crc ^ 0xFFFFFFFFu;
53+
}
54+
55+
int main(int argc, char** argv) {
56+
for (int i = 1; i < argc; ++i) {
57+
uint32_t h = crc32c_bmp(argv[i]);
58+
std::cout << argv[i] << ": 0x" << std::hex << std::uppercase << h << "\n";
59+
}
60+
}

docs/documentation.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -528,12 +528,12 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
528528
| `VM::NSJAIL_PID` | Check if process status matches with nsjail patterns with PID anomalies | 🐧 | 75% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L5233) |
529529
| `VM::TPM` | Check if the system has a physical TPM by matching the TPM manufacturer against known physical TPM chip vendors | 🪟 | 100% | | | CRB model will succeed, while TIS will fail | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8019) |
530530
| `VM::PCI_DEVICES` | Check for PCI vendor and device IDs that are VM-specific | 🐧🪟 | 95% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L5946) |
531-
| `VM::QEMU_SIGNATURE` | Check for QEMU's DSDT signature | 🪟 | 100% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8100) |
532-
| `VM::TRAP` | Check if after raising two traps at the same RIP, a hypervisor interferes with the instruction pointer delivery | 🪟 | 100% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8204) |
533-
| `VM::UD` | Check if after executing an undefined instruction, a hypervisor misinterpret it as a system call | 🪟 | 100% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8302) |
534-
| `VM::BLOCKSTEP` | Check if a hypervisor does not properly restore the interruptibility state after a VM-exit in compatibility mode | 🪟 | 100% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8328) |
535-
| `VM::DBVM` | Check if Dark Byte's VM is present | 🪟 | 150% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8376) |
536-
| `VM::BOOT_LOGO` | Check boot logo for known images | 🪟 | 100% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8472) |
531+
| `VM::QEMU_SIGNATURE` | Check for QEMU's ACPI device signature | 🪟 | 100% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8100) |
532+
| `VM::TRAP` | Check if after raising two traps at the same RIP, a hypervisor interferes with the instruction pointer delivery | 🪟 | 100% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8245) |
533+
| `VM::UD` | Check if after executing an undefined instruction, a hypervisor misinterpret it as a system call | 🪟 | 100% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8343) |
534+
| `VM::BLOCKSTEP` | Check if a hypervisor does not properly restore the interruptibility state after a VM-exit in compatibility mode | 🪟 | 100% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8369) |
535+
| `VM::DBVM` | Check if Dark Byte's VM is present | 🪟 | 150% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8417) |
536+
| `VM::BOOT_LOGO` | Check boot logo for known VM images | 🪟 | 100% | | | | [link](https://github.com/kernelwernel/VMAware/tree/main/src/vmaware.hpp#L8513) |
537537

538538
<!-- END OF TECHNIQUE DOCUMENTATION -->
539539

0 commit comments

Comments
 (0)