Functions — github.com/NotRequiem/VMAware

CodeHub MCPcopy Create free account

hub / github.com/NotRequiem/VMAware / functions

Functions328 in github.com/NotRequiem/VMAware

⨍ Functions 328◇ Types & classes 104

Methodget_intel_core_db

src/vmaware.hpp:1303

Methodget_intel_ultra_db

src/vmaware.hpp:2454

Methodget_intel_xeon_db

src/vmaware.hpp:2315

Methodget_model

src/vmaware.hpp:983

Golden Rules (must happen ALWAYS; if they don't happen the check should be aborted): 1. The check needs AT LEAST two different cores, so i

src/vmaware.hpp:3299

Functiongpu_capabilities

* @brief Check for GPU capabilities related to VMs * @category Windows * @implements VM::GPU_CAPABILITIES */

src/vmaware.hpp:9860

Functionhw_memsize

* @brief Check if memory is too low for MacOS system * @category MacOS * @link https://evasions.checkpoint.com/src/MacOS/macos.html * @

src/vmaware.hpp:8825

Functionhwmodel

* @brief Check if the sysctl for the hwmodel does not contain the "Mac" string * @author MacRansom ransomware * @category MacOS * @impl

src/vmaware.hpp:8787

* @brief Check if /sys/class/hwmon/ directory is present. If not, likely a VM * @category Linux * @implements VM::HWMON */

src/vmaware.hpp:6373

Functionhyperv_nested

* @brief Check whether a hypervisor is nested within a Hyper-V partition * @category Windows, x86 * @implements VM::HYPERV_NESTED */

src/vmaware.hpp:13055

Functionhypervisor_bit

* @brief Check if hypervisor feature bit in CPUID ECX bit 31 is enabled (always false for physical CPUs) * @category x86 * @implements VM::H

src/vmaware.hpp:5303

Functionhypervisor_dir

* @brief Check for presence of any files in /sys/hypervisor directory * @category Linux * @implements VM::HYPERVISOR_DIR */

src/vmaware.hpp:6568

Functionhypervisor_hook

* @brief Check whether a hypervisor uses EPT/NPT hooking to intercept hardware breakpoints * @note This hypervisor detection also affects debugge

src/vmaware.hpp:12314

Functionhypervisor_query

* @brief Check if a call to NtQuerySystemInformation with the 0x9f leaf fills a _SYSTEM_HYPERVISOR_DETAIL_INFORMATION structure * @category Windo

src/vmaware.hpp:10030

Functionhypervisor_str

* @brief Check for hypervisor brand string length (would be around 2 characters in a host machine) * @category x86 * @implements VM::HYPERVI

src/vmaware.hpp:5339

Methodinitialise

having this design avoids some niche errors

src/vmaware.hpp:14511

Functionintel_kgt_signature

* @brief Check for Intel KGT (Trusty branch) hypervisor signature in CPUID * @link https://github.com/intel/ikgt-core/blob/7dfd4d1614d788ec43b026

src/vmaware.hpp:5777

Functioninterrupt_shadow

* @brief Check if a hypervisor does not properly restore the interruptibility state after a VM-exit * @category Windows * @implements VM::IN

src/vmaware.hpp:10715

* @brief Check MacOS' IO kit registry for VM-specific strings * @category MacOS * @link https://evasions.checkpoint.com/src/MacOS/macos.html

src/vmaware.hpp:8858

Functionioreg_grep

* @brief Check for VM-strings in ioreg commands for MacOS * @category MacOS * @link https://evasions.checkpoint.com/src/MacOS/macos.html

src/vmaware.hpp:8955

src/vmaware.hpp:856

Methodis_cached

src/vmaware.hpp:3029

Methodis_cached

src/vmaware.hpp:3065

Methodis_cached

src/vmaware.hpp:3085

Methodis_cached

src/vmaware.hpp:3105

Methodis_cached

src/vmaware.hpp:3126

Methodis_cached

src/vmaware.hpp:3140

Methodis_cached

src/vmaware.hpp:3163

Methodis_cached

src/vmaware.hpp:3231

Methodis_celeron

check if the CPU is an intel celeron

src/vmaware.hpp:959

Methodis_disabled

assert if the flag is enabled, far better expression than typing std::bitset member functions

src/vmaware.hpp:13401

src/vmaware.hpp:13652

Methodis_enabled

same as above but for checking enabled flags

src/vmaware.hpp:13410

src/vmaware.hpp:867

Methodis_leaf_supported

src/vmaware.hpp:816

src/vmaware.hpp:13579

Methodis_setting_flag_set

src/vmaware.hpp:13428

Methodis_type_valid

src/vmaware.hpp:13647

Functionivshmem

* @brief Check for IVSHMEM device presence * @category Windows * @author dmfrpro (https://github.com/dmfrpro) * @implements VM::IVSHMEM

src/vmaware.hpp:9754

Functionkernel_objects

* @brief Check for any signs of VMs in Windows kernel object entities * @category Windows * @implements VM::KERNEL_OBJECTS */

src/vmaware.hpp:11029

* @brief Check for any indications of hypervisors in the kernel message logs * @author idea from https://github.com/ShellCode33/VM-Detection/blob

src/vmaware.hpp:6654

Functionkvm_interception

* @brief Check whether KVM attempts to patch a mismatched hypercall instruction * @link https://lists.nongnu.org/archive/html/qemu-devel/2025-07/

src/vmaware.hpp:12211

Functionlinux_user_host

* @brief Check for default VM username and hostname for linux * @category Linux * @implements VM::LINUX_USER_HOST */

src/vmaware.hpp:6383

Functionmac_address_check

* @brief Check if mac address starts with certain VM designated values * @category Linux * @implements VM::MAC */

src/vmaware.hpp:6217

Functionmac_sip

* @brief Check for the status of System Integrity Protection and hv_mm_present * @category MacOS * @link https://evasions.checkpoint.com/src

src/vmaware.hpp:8995

Functionmac_sys

* @brief Check for VM-strings in system profiler commands for MacOS * @category MacOS * @implements VM::MAC_SYS */

src/vmaware.hpp:9039

auxiliary/memoize_test.cpp:44

src/cli/main.cpp:195

src/cli/sha256.cpp:37

Functionmake_unique

src/vmaware.hpp:3694

* @brief Check whether the hypervisor correctly handles MSR behavior * @category Windows, x86 * @implements VM::MSR */

src/vmaware.hpp:12146

* @brief Check for mutex strings of VM brands * @category Windows * @author from VMDE project * @author hfiref0x * @implements VM:

src/vmaware.hpp:9434

* @brief Check for known NVRAM signatures that are present on virtual firmware * @category Windows * @warning Permissions required * @i

src/vmaware.hpp:11219

Methodoperator()

src/vmaware.hpp:3858

Methodoperator()

src/vmaware.hpp:6570

src/cli/windows_tui.cpp:562

Functionpci_devices

* @brief Check for PCI vendor and device IDs that are VM-specific * @link https://www.pcilookup.com/?ven=&dev=&action=submit * @category Lin

src/vmaware.hpp:7907

Functionpodman_file

* @brief Check for podman file in /run/ * @author idea from https://github.com/systemd/systemd/blob/main/src/basic/virt.c * @category Linux

src/vmaware.hpp:6929

Functionpower_capabilities

* @brief Check what power states are enabled * @category Windows * @implements VM::POWER_CAPABILITIES */

src/vmaware.hpp:9128

Methodprint_header

src/cli/windows_tui.cpp:141

Functionprocesses

* @brief Check for any VM processes that are active * @category Linux * @implements VM::PROCESSES */

src/vmaware.hpp:7195

Functionqemu_USB

* @brief Check for presence of QEMU in the /sys/kernel/debug/usb/devices directory * @category Linux * @warning Permissions required *

src/vmaware.hpp:6540

Functionqemu_fw_cfg

* @brief Detect QEMU fw_cfg interface. This first checks the Device Tree for a fw-cfg node or hypervisor tag, then verifies the presence of the qemu_f

src/vmaware.hpp:7004

Functionqemu_virtual_dmi

* @brief Check for presence of QEMU in the /sys/devices/virtual/dmi/id directory * @category Linux * @implements VM::QEMU_VIRTUAL_DMI *

src/vmaware.hpp:6511

Methodredraw_all_boxes

src/cli/windows_tui.cpp:271

src/vmaware.hpp:6223

Methodreset_disabled_flagset

src/vmaware.hpp:13617

src/cli/sha256.cpp:29

run every VM detection mechanism in the technique table

src/vmaware.hpp:13439

src/cli/sha256.cpp:18

src/cli/sha256.cpp:49

src/cli/sha256.cpp:53

Functionsingle_step

* @brief Check whether a hypervisor delays trap flags over exiting instructions * @category Windows, x86 * @implements VM::SINGLE_STEP

src/vmaware.hpp:12628

src/vmaware.hpp:3059

src/vmaware.hpp:3079

src/vmaware.hpp:3099

src/vmaware.hpp:3120

src/vmaware.hpp:3136

src/vmaware.hpp:3188

Methodstore_manufacturer

src/vmaware.hpp:3212

Methodstore_model

src/vmaware.hpp:3221

Functionsvm_exceptions

* @brief Check whether a hypervisor leaks EFER.SVME into guest context via SVM instruction fault type * @category Windows, x86 * @implements

src/vmaware.hpp:12913

Functionsysinfo_proc

* @brief Check for potential VM info in /proc/sysinfo * @author idea from https://github.com/ShellCode33/VM-Detection/blob/master/vmdetect/linux.

src/vmaware.hpp:6794

Functionsystem_registers

* @brief Check for Task Segment and Descriptor Table instructions (SGDT, SLDT, SMSW, SIDT) * @category Windows, Linux, x86, x86_32 * @implem

src/vmaware.hpp:7241

Functionsystemd_virt

* @brief Check result from systemd-detect-virt tool * @category Linux * @implements VM::SYSTEMD */

src/vmaware.hpp:6085

Methodtechnique

src/vmaware.hpp:13334

Functiontemperature

* @brief Check for device's temperature * @category Linux * @implements VM::TEMPERATURE */

src/vmaware.hpp:7114

Methodtest_confidence_returns_integer_in_range

gem/test/unit/api.rb:22

Methodtest_responds_to_check

gem/test/unit/api.rb:9

Methodtest_responds_to_confidence

gem/test/unit/api.rb:13

Methodtest_vm_check_returns_boolean

gem/test/unit/api.rb:17

Functionthread_count

* @brief Check if there are only 1 or 2 threads, which is a common pattern in VMs with default settings, nowadays physical CPUs should have at least 4

src/vmaware.hpp:8758

Methodthread_entry

src/vmaware.hpp:4231

Functionthread_mismatch

* @brief Check if the system's thread count matches the expected thread count for the detected CPU model * @category x86 * @implements VM::T

src/vmaware.hpp:5448

* @brief Check for hypervisor overhead by measuring instruction execution latency * @category Windows, x86 * @implements VM::TIMER */

src/vmaware.hpp:5803

* @brief Check measured boot logs exported by the TPM * @category Windows * @implements VM::TPM */

src/vmaware.hpp:13065

Methodtransform

src/cli/sha256.cpp:57

* @brief Check if after raising two traps at the same RIP, a hypervisor interferes with the instruction pointer delivery * @category Windows, x86

src/vmaware.hpp:10438

* @brief Check if after executing an undefined instruction, a hypervisor misinterpret it as a system call * @category Windows * @implements

src/vmaware.hpp:10642

Functionuml_cpu

* @brief Check for the "UML" string in the CPU brand * @author idea from https://github.com/ShellCode33/VM-Detection/blob/master/vmdetect/linux.g

src/vmaware.hpp:6624

← previous next →201–300 of 328, ranked by callers