hfiref0x / vmde Goto Github PK

Original comment by HonoraryBoT https://habrahabr.ru/post/322486/#comment_10093238

There is integrated VM detection routines available in Windows kernel. These routines available at least since Windows 7 and the check result can be retrieved using undocumendted service NtQueryLicenseValue with the parameter "Kernel-VMDetection-Private" unicode string.

Why this isn't included in VMDE and is this method really good for VM detect?

1. Nothing from Microsoft implemented code is anyhow better than already available detects;
2. The routine (which is the source for NtQueryLicenseValue) ExpIsVirtualMachinePrivate doesn't consider guest machine with Microsoft Hyper-V (also known as Viridian) as private VM. Judging on it name ExpIsVirtualMachinePrivate it make some sense and makes no sense in case if you want to detect Microsoft Hyper-V;
3. The ECX hypervisor bit check implemented in ExpDetectHypervisorCpuId already present in VMDE, this detection won't work on configurable hypervisors like for example VirtualBox - set paravirtualization interface to "Legacy" and you will bypass this check;
4. ExpDetectHyperVisorCr3Heuristic live classic from MS with comparing time of two instructions execution. This won't work if your HV support EPT, IIRC Intel CPU supports it from Nehalem. Of course if you have out-dated hardware or castrated CPU this will be a problem. In VirtualBox this check will be bypassed by setting paravirtualization interface to "Legacy", in VMWare there exist setting "Virtualize Intel VT-x/EPT or AMD-V/RVI";
5. ExpDetectHypervisorVarianceHeuristic - this is variation of timing detections based on different sources and statistics. Again this won't work in VirtualBox (paravirtualization interface set to Legacy) or VMWare with setting "Virtualize CPU performance counters".

As a conclusion: modern hardware and configured VM will bypass any of the above checks without any problems, so the above method doesn't give any advantage compared to already existing and implemented. And since this tool implements methods from paper dated back to 2013 there is no sense in adding anything beyond that, especially when this anything is merely useless.