#include "vmaware.hpp" int main() { /**  * The basic way to detect a VM where the default checks will   * be performed. This is the recommended usage of the lib.  */ bool is_vm = VM::detect(); /**  * This does the exact same as above, but as an explicit alternative.  */ bool is_vm2 = VM::detect(VM::DEFAULT); /**  * All checks are performed including spoofable techniques  * and a few other techniques that are disabled by default,  * one of which is VM::CURSOR which waits 5 seconds for any   * human mouse interaction to detect automated virtual environments.  * If you're fine with having a 5 second delay, add VM::ALL   */ bool is_vm3 = VM::detect(VM::ALL); /**  * If you don't want the value to be memoized for whatever reason,   * you can set the VM::NO_MEMO flag and the result will not be cached.   * It's recommended to use this flag if you're only using one function  * from the public interface a single time in total, so no unneccessary   * caching will be operated when you're not going to re-use the previously   * stored result at the end.   */ bool is_vm4 = VM::detect(VM::NO_MEMO); /**  * This will set the threshold bar to detect a VM higher than the default threshold.  * Use this if you want to be extremely sure if it's a VM, but this can risk the result  * to be a false negative. Use VM::percentage() for a more precise result if you want.  */ bool is_vm5 = VM::detect(VM::HIGH_THRESHOLD); /**  * Essentially means only the CPU brand, MAC, and hypervisor bit techniques   * should be performed. Note that the less flags you provide, the more   * likely the result will not be accurate. If you just want to check for   * a single technique, use VM::check() instead. Also, read the flag table  * at the end of this doc file for a full list of technique flags.  */ bool is_vm6 = VM::detect(VM::CPU_BRAND, VM::MAC, VM::HYPERVISOR_BIT); /**  * If you want to disable any technique for whatever reason, use VM::DISABLE(...).  * This code snippet essentially means "perform all the default flags, but only   * disable the VM::RDTSC technique".   */ bool is_vm7 = VM::detect(VM::DISABLE(VM::RDTSC)); /**  * Same as above, but you can disable multiple techniques at the same time.  */ bool is_vm8 = VM::detect(VM::DISABLE(VM::VMID, VM::RDTSC, VM::HYPERVISOR_BIT)); /**  * This is just an example to show that you can use a combination of   * different flags and non-technique flags with the above examples.   */ bool is_vm9 = VM::detect(VM::DEFAULT, VM::NO_MEMO, VM::HIGH_THRESHOLD, VM::DISABLE(VM::RDTSC, VM::VMID)); }

#include "vmaware.hpp" #include <iostream> #include <cstdint> int main() { // uint8_t and unsigned char works too const std::uint8_t percent = VM::percentage(); if (percent == 100) { std::cout << "Definitely a VM!\n"; } else if (percent == 0) { std::cout << "Definitely NOT a VM\n"; } else { std::cout << "Unsure if it's a VM\n"; } // converted to std::uint32_t for console character encoding reasons std::cout << "percentage: " << static_cast<std::uint32_t>(percent) << "%\n"; }

#include "vmaware.hpp" #include <string> int main() { const std::string result = VM::brand(); if (result == "KVM") { // do KVM specific stuff } else if (result == "VirtualBox") { // do vbox specific stuff } else { // you get the idea } }

#include "vmaware.hpp" #include <string> int main() { // format: "vmbrand1 or vmbrand2 [or vmbrandx...]" const std::string result = VM::brand(VM::MULTIPLE); // example output: "VMware or Bochs" std::cout << result << "\n"; // Keep in mind that there's no limit to how many conflicts there can be. // And if there's no conflict, it'll revert back to giving the brand string // normally as if the VM::MULTIPLE wasn't there }

#include "vmaware.hpp" #include <iostream> int main() { if (VM::check(VM::VMID)) { std::cout << "VMID technique detected a VM!\n"; } if (VM::check(VM::HYPERVISOR_BIT)) { std::cout << "Hypervisor bit is set, most definitely a VM!\n"; } }

// Example 1 with function pointers bool new_technique() { // add your VM detection code here return true; } VM::add_custom(50, new_technique);

// Example 2 with lambdas VM::add_custom(50, []() -> bool { // add your VM detection code here return true; }); auto new_technique = []() -> bool { // add your VM detection code here return true; } VM::add_custom(50, new_technique);

// Example 3 with std::function std::function<bool()> new_technique = []() -> bool { // add your VM detection code here return true; }; VM::add_custom(50, new_technique);

#include "vmaware.hpp" #include <iostream> int main() { // example output: VirtualBox is a Hypervisor (type 2) VM std::cout << VM::brand() " is a " << VM::type() << " VM\n"; }

struct vmaware { std::string brand; std::string type; std::string conclusion; bool is_vm; std::uint8_t percentage; std::uint8_t detected_count; std::uint8_t technique_count; }; 

#include "vmaware.hpp" #include <iostream> int main() { VM::vmaware vm; std::cout << "Is this a VM? = " << vm.is_vm << "\n"; std::cout << "How many techniques detected a VM? = " << vm.detected_count << "%\n"; std::cout << "What's the VM's type? = " << vm.type << "%\n"; std::cout << "What's the overview in a human-readable message?" << vm.conclusion << "\n"; }