Skip to content

Commit 64088d2

Browse files
NotRequiemNotRequiem
authored
Merge pull request #281 from NotRequiem/dev
updated core database
2 parents 0f377bc + 5c16f92 commit 64088d2

File tree

3 files changed

+213
-166
lines changed

3 files changed

+213
-166
lines changed

‎docs/documentation.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -387,7 +387,7 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
387387
| `VM::VM_FILES` | Find for VM-specific specific files | Windows | 25% | | | | |
388388
| `VM::HWMODEL` | Check if the sysctl for the hwmodel does not contain the "Mac" string | MacOS | 100% | | | | |
389389
| `VM::DISK_SIZE` | Check if disk size is under or equal to 50GB | Linux | 60% | | | | |
390-
| `VM::VBOX_DEFAULT` | Check for default RAM and DISK sizes set by VirtualBox | Linux and Windows | 25% | Admin | | | |
390+
| `VM::VBOX_DEFAULT` | Check for default RAM and DISK sizes set by VirtualBox | Linux and Windows | 25% | Admin | | | Admin only needed for Linux |
391391
| `VM::VBOX_NETWORK` | Check for VirtualBox network provider string | Windows | 100% | | | | |
392392
| `VM::COMPUTER_NAME` | Check if the computer name (not username to be clear) is VM-specific | Windows | 10% | | GPL | | |
393393
| `VM::WINE_CHECK` | Check wine_get_unix_file_name file for Wine | Windows | 100% | | GPL | | |
@@ -458,7 +458,7 @@ VMAware provides a convenient way to not only check for VMs, but also have the f
458458
| `VM::VM_SIDT` | Check for unknown IDT base address | Windows | 100% | | | | |
459459
| `VM::HDD_SERIAL` | Check for serial numbers of virtual disks | Windows | 100% | | | | |
460460
| `VM::PORT_CONNECTORS` | Check for physical connection ports | Windows | 25% | | | | This technique is known to false flag on devices like Surface Pro |
461-
| `VM::GPU` | Check for GPU capabilities and specific GPU PCI vendor ids | Windows | 100% | | | | |
461+
| `VM::GPU` | Check for GPU capabilities and specific GPU signatures related to VMs | Windows | 100% | Admin | | | Admin only needed for some heuristics |
462462
| `VM::VM_DEVICES` | Check for VM-specific devices | Windows | 45% | | | | |
463463
| `VM::VM_MEMORY` | Check for specific VM memory traces in certain processes | Windows | 65% | | | | |
464464
| `VM::IDT_GDT_MISMATCH` | Check if the IDT and GDT base virtual addresses mismatch between different CPU cores when called from usermode under a root partition | Windows | 50% | | | | |

‎src/vmaware.hpp

Lines changed: 72 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,14 @@
2525
*
2626
*
2727
* ============================== SECTIONS ==================================
28-
* - enums for publicly accessible techniques => line 462
29-
* - struct for internal cpu operations => line 736
30-
* - struct for internal memoization => line 1190
31-
* - struct for internal utility functions => line 1315
32-
* - struct for internal core components => line 10135
33-
* - start of VM detection technique list => line 2494
34-
* - start of public VM detection functions => line 10536
35-
* - start of externally defined variables => line 11440
28+
* - enums for publicly accessible techniques => line 466
29+
* - struct for internal cpu operations => line 740
30+
* - struct for internal memoization => line 1194
31+
* - struct for internal utility functions => line 1319
32+
* - struct for internal core components => line 10185
33+
* - start of VM detection technique list => line 2498
34+
* - start of public VM detection functions => line 10586
35+
* - start of externally defined variables => line 11490
3636
*
3737
*
3838
* ============================== EXAMPLE ===================================
@@ -2496,7 +2496,7 @@ struct VM {
24962496

24972497
private: // START OF PRIVATE VM DETECTION TECHNIQUE DEFINITIONS
24982498
/**
2499-
* @brief Check CPUID output of manufacturer ID for known VMs/hypervisors at leaf 0
2499+
* @brief Check CPUID output of manufacturer ID for known VMs/hypervisors at leaf 0 and 0x40000000-0x40000100
25002500
* @category x86
25012501
* @implements VM::VMID
25022502
*/
@@ -5238,10 +5238,10 @@ struct VM {
52385238
{ "i3-12100", 8 },
52395239
{ "i3-12100F", 8 },
52405240
{ "i3-12100T", 8 },
5241-
{ "i3-1210U", 4 },
5242-
{ "i3-1215U", 4 },
5243-
{ "i3-1215UE", 4 },
5244-
{ "i3-1215UL", 4 },
5241+
{ "i3-1210U", 8 },
5242+
{ "i3-1215U", 8 },
5243+
{ "i3-1215UE", 8 },
5244+
{ "i3-1215UL", 8 },
52455245
{ "i3-12300", 8 },
52465246
{ "i3-12300T", 8 },
52475247
{ "i3-13100", 8 },
@@ -5436,13 +5436,13 @@ struct VM {
54365436

54375437
// i5 series
54385438
{ "i5-10200H", 8 },
5439-
{ "i5-10210U", 4 },
5439+
{ "i5-10210U", 8 },
54405440
{ "i5-10210Y", 8 },
54415441
{ "i5-10300H", 8 },
54425442
{ "i5-1030G4", 8 },
54435443
{ "i5-1030G7", 8 },
54445444
{ "i5-1030NG7", 8 },
5445-
{ "i5-10310U", 4 },
5445+
{ "i5-10310U", 8 },
54465446
{ "i5-10310Y", 8 },
54475447
{ "i5-1035G1", 8 },
54485448
{ "i5-1035G4", 8 },
@@ -5487,49 +5487,47 @@ struct VM {
54875487
{ "i5-11600K", 12 },
54885488
{ "i5-11600KF", 12 },
54895489
{ "i5-11600T", 12 },
5490-
{ "i5-1230U", 4 },
5491-
{ "i5-1235U", 4 },
5490+
{ "i5-1230U", 12 },
5491+
{ "i5-1235U", 12 },
54925492
{ "i5-12400", 12 },
54935493
{ "i5-12400F", 12 },
54945494
{ "i5-12400T", 12 },
5495-
{ "i5-1240P", 8 },
5496-
{ "i5-1240U", 4 },
5497-
{ "i5-1245U", 4 },
5495+
{ "i5-1240P", 16 },
5496+
{ "i5-1240U", 12 },
5497+
{ "i5-1245U", 12 },
54985498
{ "i5-12490F", 12 },
54995499
{ "i5-12500", 12 },
5500-
{ "i5-12500H", 8 },
5501-
{ "i5-12500HL", 8 },
5500+
{ "i5-12500H", 16 },
5501+
{ "i5-12500HL", 16 },
55025502
{ "i5-12500T", 12 },
5503-
{ "i5-1250P", 8 },
5504-
{ "i5-1250PE", 8 },
5503+
{ "i5-1250P", 16 },
5504+
{ "i5-1250PE", 16 },
55055505
{ "i5-12600", 12 },
5506-
{ "i5-12600H", 8 },
5507-
{ "i5-12600HE", 8 },
5508-
{ "i5-12600HL", 8 },
5509-
{ "i5-12600HX", 8 },
5510-
{ "i5-12600K", 12 },
5511-
{ "i5-12600KF", 12 },
5506+
{ "i5-12600H", 16 },
5507+
{ "i5-12600HE", 16 },
5508+
{ "i5-12600HL", 16 },
5509+
{ "i5-12600HX", 16 },
5510+
{ "i5-12600K", 16 },
5511+
{ "i5-12600KF", 16 },
55125512
{ "i5-12600T", 12 },
5513-
{ "i5-13400", 12 },
5514-
{ "i5-13400F", 12 },
5515-
{ "i5-13400T", 12 },
5516-
{ "i5-1340P", 8 },
5517-
{ "i5-1340PE", 8 },
5518-
{ "i5-13490F", 12 },
5519-
{ "i5-13500", 12 },
5520-
{ "i5-13500H", 8 },
5521-
{ "i5-13500T", 12 },
5522-
{ "i5-13505H", 8 },
5523-
{ "i5-1350P", 8 },
5524-
{ "i5-1350PE", 8 },
5525-
{ "i5-13600", 12 },
5526-
{ "i5-13600H", 8 },
5527-
{ "i5-13600HE", 8 },
5528-
{ "i5-13600K", 12 },
5513+
{ "i5-13400", 16 },
5514+
{ "i5-13400F", 16 },
5515+
{ "i5-13400T", 16 },
5516+
{ "i5-1340P", 16 },
5517+
{ "i5-1340PE", 16 },
5518+
{ "i5-13490F", 16 },
5519+
{ "i5-13500", 20 },
5520+
{ "i5-13500H", 16 },
5521+
{ "i5-13500T", 20 },
5522+
{ "i5-13505H", 16 },
5523+
{ "i5-1350P", 16 },
5524+
{ "i5-1350PE", 16 },
5525+
{ "i5-13600", 20 },
5526+
{ "i5-13600H", 16 },
5527+
{ "i5-13600HE", 16 },
55295528
{ "i5-13600K", 20 },
5530-
{ "i5-13600KF", 12 },
55315529
{ "i5-13600KF", 20 },
5532-
{ "i5-13600T", 12 },
5530+
{ "i5-13600T", 20 },
55335531
{ "i5-2300", 4 },
55345532
{ "i5-2310", 4 },
55355533
{ "i5-2320", 4 },
@@ -6118,30 +6116,30 @@ struct VM {
61186116
{ "i9-11900T", 16 },
61196117
{ "i9-11950H", 16 },
61206118
{ "i9-11980HK", 16 },
6121-
{ "i9-12900", 16 },
6122-
{ "i9-12900F", 16 },
6123-
{ "i9-12900K", 16 },
6124-
{ "i9-12900KF", 16 },
6125-
{ "i9-12900KS", 16 },
6126-
{ "i9-12900T", 16 },
6127-
{ "i9-13900", 16 },
6128-
{ "i9-13900E", 16 },
6129-
{ "i9-13900F", 16 },
6130-
{ "i9-13900HX", 16 },
6131-
{ "i9-13900K", 16 },
6132-
{ "i9-13900KF", 16 },
6133-
{ "i9-13900KS", 16 },
6134-
{ "i9-13900T", 16 },
6135-
{ "i9-13900TE", 16 },
6136-
{ "i9-13950HX", 16 },
6137-
{ "i9-13980HX", 16 },
6138-
{ "i9-14900", 16 },
6139-
{ "i9-14900F", 16 },
6140-
{ "i9-14900HX", 16 },
6141-
{ "i9-14900K", 16 },
6142-
{ "i9-14900KF", 16 },
6143-
{ "i9-14900KS", 16 },
6144-
{ "i9-14900T", 16 },
6119+
{ "i9-12900", 24 },
6120+
{ "i9-12900F", 24 },
6121+
{ "i9-12900K", 24 },
6122+
{ "i9-12900KF", 24 },
6123+
{ "i9-12900KS", 24 },
6124+
{ "i9-12900T", 24 },
6125+
{ "i9-13900", 32 },
6126+
{ "i9-13900E", 32 },
6127+
{ "i9-13900F", 32 },
6128+
{ "i9-13900HX", 32 },
6129+
{ "i9-13900K", 32 },
6130+
{ "i9-13900KF", 32 },
6131+
{ "i9-13900KS", 32 },
6132+
{ "i9-13900T", 32 },
6133+
{ "i9-13900TE", 32 },
6134+
{ "i9-13950HX", 32 },
6135+
{ "i9-13980HX", 32 },
6136+
{ "i9-14900", 32 },
6137+
{ "i9-14900F", 32 },
6138+
{ "i9-14900HX", 32 },
6139+
{ "i9-14900K", 32 },
6140+
{ "i9-14900KF", 32 },
6141+
{ "i9-14900KS", 32 },
6142+
{ "i9-14900T", 32 },
61456143
{ "i9-7900X", 20 },
61466144
{ "i9-7920X", 24 },
61476145
{ "i9-7940X", 28 },
@@ -7757,7 +7755,7 @@ struct VM {
77577755

77587756

77597757
/**
7760-
* @brief Check for VM specific device names in GPUs
7758+
* @brief Check for GPU capabilities and specific GPU signatures related to VMs
77617759
* @category Windows
77627760
* @author Requiem (https://github.com/NotRequiem)
77637761
* @note utoshu did this with WMI in a removed technique (VM::GPU_CHIPTYPE)
@@ -8471,7 +8469,7 @@ struct VM {
84718469

84728470
const bool qpc_check = (dummyTime != 0) && ((cpuIdTime / dummyTime) > 1100);
84738471

8474-
// TSC sync check across cores. Try reading the invariant TSC on two different cores to attempt to detect VCPU timers being shared
8472+
// TSC sync check across cores. Try reading the invariant TSC on two different cores to attempt to detect vCPU timers being shared
84758473
unsigned aux;
84768474
SetThreadAffinityMask(GetCurrentThread(), 1);
84778475
u64 tsc_core1 = __rdtscp(&aux); // Core 1 TSC

0 commit comments

Comments
 (0)