Functions — github.com/NotRequiem/VMAware

CodeHub MCPcopy Create free account

hub / github.com/NotRequiem/VMAware / functions

Functions328 in github.com/NotRequiem/VMAware

⨍ Functions 328◇ Types & classes 104

MethodVMAWARE_CONSTEXPR

src/vmaware.hpp:13667

src/vmaware.hpp:10576

Function__except

src/vmaware.hpp:9409

Method__getitem__

auxiliary/updater.py:265

(self, enum_name, file_path, function_name, cross_platform, is_linux, is_win, is_mac, score, short_description

auxiliary/add_technique.py:43

(self, enum_name="", line=0, platform_emojis="", score=0, description="", is_admin=False, only_32_bit=False, n

auxiliary/updater.py:252

Functionacpi_signature

* @brief Check for VM-specific ACPI device signatures * @category Windows * @implements VM::ACPI_SIGNATURE */

src/vmaware.hpp:10298

1. one brand, custom score

src/vmaware.hpp:13371

Functionadd_custom

* @brief Add a custom technique to the VM detection technique collection * @param either a function pointer, lambda function, or std::function<bo

src/vmaware.hpp:13944

Methodadd_score

src/vmaware.hpp:13385

Methodall_enum_flags

base handle implementation

src/vmaware.hpp:13631

Functionamd_sev_msr

* @brief Check for AMD-SEV MSR running on the system * @category x86, Linux, MacOS * @author idea from virt-what * @warning Permissions requi

src/vmaware.hpp:6451

Methodare_techniques_empty

src/vmaware.hpp:13418

Methodarg_handler

src/vmaware.hpp:13658

* @brief Check if no waveform-audio output devices are present in the system * @category Windows * @implements VM::AUDIO */

src/vmaware.hpp:10190

* @brief Check for default Azure hostname format (Azure uses Hyper-V as their base VM brand) * @category Windows, Linux * @implements VM::AZ

src/vmaware.hpp:7438

Functionbluestacks

* @brief Check for the presence of BlueStacks-specific folders * @category ARM, Linux * @implements VM::BLUESTACKS_FOLDERS */

src/vmaware.hpp:6428

Functionbochs_cpu

* @brief Check for various Bochs-related emulation oversights through CPU checks * @category x86 * @author Discovered by Peter Ferrie, Senio

src/vmaware.hpp:5367

Methodbrand_enum_to_string

src/vmaware.hpp:5067

Methodbrand_list

src/vmaware.hpp:4918

Methodbrand_multiple

src/vmaware.hpp:5150

Methodbrand_single

src/vmaware.hpp:5174

Methodburn_random_cycles

src/vmaware.hpp:3558

Methodcache_fetch

src/vmaware.hpp:3036

Methodcache_store

src/vmaware.hpp:3023

Methodcalculate_latency

src/vmaware.hpp:3531

* @brief Check for cgroup paths in /proc/self/cgroup * @category Linux * @implements VM::CGROUP */

src/vmaware.hpp:7127

src/cli/sha256.cpp:33

Functionchassis_type

* @brief Check if the chassis type is valid (it's very often invalid in VMs) * @category Linux * @implements VM::CTYPE */

src/vmaware.hpp:6134

Functionchassis_vendor

* @brief Check if the chassis vendor is a VM vendor * @category Linux * @implements VM::CVENDOR */

src/vmaware.hpp:6109

Methodcheck_aes_integrity

src/vmaware.hpp:11560

Methodclear_boxes

src/cli/windows_tui.cpp:42

* @brief Check the presence of system timers * @category x86, Windows * @implements VM::CLOCK */

src/vmaware.hpp:12015

src/vmaware.hpp:8383

Functioncontainer_proc_id

* @brief Check if process status matches with container patterns with PID anomalies * @category Linux * @implements VM::CONTAINER_PID *

src/vmaware.hpp:7061

Functioncpu_brand

* @brief Check if CPU brand model contains any VM-specific string snippets * @category x86 * @implements VM::CPU_BRAND */

src/vmaware.hpp:5223

Methodcpu_entry

src/vmaware.hpp:1125

Functioncpu_heuristic

* @brief Check whether the CPU is genuine and its reported instruction capabilities are not masked * @category Windows, x86 * @implements VM

src/vmaware.hpp:11531

Methodcpu_manufacturer

src/vmaware.hpp:916

cross-platform wrapper for linux and MSVC cpuid

src/vmaware.hpp:773

Methodcpuid_count

src/vmaware.hpp:750

Functioncpuid_signature

* @brief Check for CPUID signatures that reveal the presence of a hypervisor * @category x86 * @implements VM::CPUID_SIGNATURE */

src/vmaware.hpp:5629

src/vmaware.hpp:4193

Methodcrc32_bits

it does 8 rounds of CRC32-C bit reflection recursively

src/vmaware.hpp:1104

Methodcrc32_bits

it does 8 rounds of CRC32-C bit reflection recursively

src/vmaware.hpp:4211

Methodcrc32_str

src/vmaware.hpp:1110

Methodcrc32_str

src/vmaware.hpp:4217

src/vmaware.hpp:1162

src/vmaware.hpp:4244

src/vmaware.hpp:5237

Functioncuckoo_dir

* @brief Check for cuckoo directory using crt and WIN API directory functions * @category Windows * @author 一半人生 * @link https://unprot

src/vmaware.hpp:9520

Functioncuckoo_pipe

* @brief Check for Cuckoo specific piping mechanism * @category Windows * @author Thomas Roccia (fr0gger) * @link https://unprotect.it/

src/vmaware.hpp:9576

* @brief Check if Dark Byte's VM is present * @category Windows * @implements VM::DBVM */

src/vmaware.hpp:10840

Methoddebug_interceptor

src/cli/windows_tui.hpp:172

Functiondebug_msg

src/vmaware.hpp:3818

Functiondevice_handles

* @brief Check for vm-specific devices * @category Windows * @implements VM::HANDLES */

src/vmaware.hpp:9898

Methoddir_closer

src/vmaware.hpp:7812

src/vmaware.hpp:13575

Methoddisable_experimental_techniques

src/vmaware.hpp:13624

Methoddisabled_arg_handler

src/vmaware.hpp:13712

Functiondisk_serial_number

* @brief Check for serial numbers of virtual disks * @category Windows * @implements VM::DISK_SERIAL */

src/vmaware.hpp:8447

Functiondisplay

* @brief Check for display configurations commonly found in VMs * @category Windows * @implements VM::DISPLAY */

src/vmaware.hpp:9630

* @brief Check for VM-specific DLLs * @category Windows * @implements VM::DLL */

src/vmaware.hpp:9071

* @brief Check if dmesg output matches a VM brand * @category Linux * @warning Permissions required * @implements VM::DMESG */

src/vmaware.hpp:6330

Functiondmi_scan

* @brief Check for string matches of VM brands in the linux DMI * @category Linux * @implements VM::DMI_SCAN */

src/vmaware.hpp:6816

Functiondmidecode

* @brief Check if dmidecode output matches a VM brand * @category Linux * @warning Permissions required * @implements VM::DMIDECODE

src/vmaware.hpp:6172

Functiondockerenv

* @brief Check if /.dockerenv or /.dockerinit file is present * @category Linux * @implements VM::DOCKERENV */

src/vmaware.hpp:6157

Methoddraw_box_internal

src/cli/windows_tui.cpp:352

Functiondrivers

* @brief Check for VM-specific names for drivers * @category Windows * @implements VM::DRIVERS */

src/vmaware.hpp:9650

Functioneip_overflow

* @brief Check whether a hypervisor does not correctly emulate instructions in compatibility mode * @category Windows, x86_64 * @implements

src/vmaware.hpp:12727

src/vmaware.hpp:13571

src/cli/sha256.cpp:41

src/cli/sha256.cpp:45

Functionexception_handler_logger

src/cli/windows_tui.cpp:628

Methodfd_closer

src/vmaware.hpp:7840

src/vmaware.hpp:6220

src/vmaware.hpp:3069

src/vmaware.hpp:3089

src/vmaware.hpp:3109

src/vmaware.hpp:3130

src/vmaware.hpp:3141

src/vmaware.hpp:3146

src/vmaware.hpp:3158

src/vmaware.hpp:3178

Methodfetch_brand_name

src/vmaware.hpp:5146

Methodfetch_manufacturer

src/vmaware.hpp:3232

Methodfetch_model

src/vmaware.hpp:3233

Methodfetch_steppings

src/vmaware.hpp:942

Functionfile_access_history

* @brief Check if the number of accessed files are too low for a human-managed environment * @category Linux * @author idea from https://unp

src/vmaware.hpp:7034

Functionfirmware

* @brief Check for VM signatures on all firmware tables * @category Windows, Linux * @authors Requiem, dmfrpro, MegaMax * @warning Perm

src/vmaware.hpp:7498

Functiongamarue

* @brief Check for Gamarue ransomware technique which compares VM-specific Window product IDs * @category Windows * @implements VM::GAMARUE

src/vmaware.hpp:9188

Methodgenerate_all

src/vmaware.hpp:13609

Methodgenerate_default

src/vmaware.hpp:13584

src/vmaware.hpp:1115

src/vmaware.hpp:1172

src/vmaware.hpp:4222

src/vmaware.hpp:6222

Methodget_amd_ryzen_db

src/vmaware.hpp:2488

Methodget_brand

src/vmaware.hpp:878

Methodget_ct_seed

src/vmaware.hpp:3267

← previous next →101–200 of 328, ranked by callers