1.9 Release

• renamed Virtual Apple to Apple Rosetta 2
• fixed oversight for AMD CPU detection
• fixed bug for VM::BOCHS_CPU
• fixed VM::ALL thanks to @D00Movenok
• fixed MSVC compiler warnings thanks to @NotRequiem
• disabled VM::CURSOR, VM::RDTSC, and VM::RDTSC_EXIT by default
• added --all to the CLI, which will enable all techniques including the above ones
• added ANY.RUN VM brand
• added VM::ANYRUN_DRIVER and VM::ANYRUN_DIRECTORY techniques

NOTE: It's been exactly a year since I've started and continuously maintained this project since September 2023, and I'm taking a break for a while. Not sure when the next release will be, but I'll try to come back to this project after I've recharged my energy while I'm focusing on some side projects I've been working on occasionally :)

For any inquiries, contact me on discord at kr.nl or email me at [email protected]

1.8 Release

• Fixed false positives due to Hyper-V artifacts with new "Hyper-X" mechanism designed by @NotRequiem

• added 10 new VM brands:

  • Hyper-V artifact (not an actual VM)
  • User-mode Linux
  • IBM PowerVM
  • Google Compute Engine (KVM)
  • OpenStack (KVM)
  • KubeVirt (KVM)
  • AWS Nitro System EC2 (KVM-based)
  • Podman
  • WSL
  • OpenVZ

• added 14 new techniques:

  • VM::EVENT_LOGS
  • VM::QEMU_VIRTUAL_DMI
  • VM::QEMU_USB
  • VM::HYPERVISOR_DIR
  • VM::UML_CPU
  • VM::KMSG
  • VM::VM_PROCS
  • VM::VBOX_MODULE
  • VM::SYSINFO_PROC
  • VM::DEVICE_TREE
  • VM::DMI_SCAN
  • VM::SMBIOS_VM_BIT
  • VM::PODMAN_FILE
  • VM::WSL_PROC

1.7.1 Release

• added VM::SPOOFABLE flag to enable easily spoofable techniques
• added VM types as summary output
• added CLI options for VM type details (-t or --type)
• added QEMU+KVM Hyper-V Enlightenment VM brand
• added better CLI indications such as techniques that require permissions
• changed so that spoofable techniques are no longer run by default, unless VM::SPOOFABLE is inputted.

1.7 Release

• added better heuristic checks for Hyper-V host virtualisation

• added argument handler improvements to the CLI

• added VM type information to the CLI

• added 4 new techniques:

  • VM::CPUID_SIGNATURE
  • VM::HYPERV_BITMASK
  • VM::KVM_BITMASK
  • VM::KGT_SIGNATURE

• added 7 new VM brands:

  • Jailhouse
  • Apple VZ
  • Intel KGT (Trusty)
  • VMware Fusion
  • Microsoft Azure Hyper-V
  • Xbox NanoVisor (Hyper-V)
  • SimpleVisor

• renamed VM brand "Thread Expert" to "ThreatExpert" (i fucked up)

• renamed VM::HYPERV_CPUID technique to VM::CPUID_BITSET

• removed VM::EXTREME settings flag

• removed 2 techniques (both due to potential false positives):

  • VM::CPUID_SPACING
  • VM::CPUID_0X4

1.6 Release

• added 2 new variables:
  • VM::technique_count
  • VM::technique_vector variables
• added 9 new techniques:
  • VM::NETTITUDE_VM_REGIONS
  • VM::HYPERV_CPUID
  • VM::CUCKOO_DIR
  • VM::CUCKOO_PIPE
  • VM::USB_DRIVE
  • VM::HYPERV_HOSTNAME
  • VM::GENERAL_HOSTNAME
  • VM::SCREEN_RESOLUTION
  • VM::DEVICE_STRING
• added VM::HIGH_THRESHOLD non-technique flag to set a higher threshold score
• added optimisations to VM::detect() and VM::percentage()
• added Cuckoo and BlueStacks VM brands
• added heuristic checks for Hyper-V host virtualisation (thanks to @NotRequiem for the suggestion)
• improved memoization system
• renamed VM::BRAND technique to VM::CPU_BRAND to avoid confusion with VM::brand()
• fixed wcstomb() deprecation warning

1.5 Release

• added 6 different brands:
  • KVM Hyper-V Enlightenment
  • NVMM
  • OpenBSD VMM
  • Intel HAXM
  • Unisys s-Par
  • Lockheed Martin LMHS
• added better checks for flag handling
• added C++23 support
• added VM::DISABLE() function for manually disabling flags
• major CLI changes
  • added --brand-list option which outputs the list of possible VM brands
  • added --disable-hyperv-host options which will disregard the possibility of Hyper-V default virtualisation
  • added number of techniques and number of detected techniques as output
• improved and renewed flag system
• improved discarding mechanism if Hyper-V is detected in case of default virtualisation
• removed VM::WMIC technique
• deprecated VM::WIN_HYPERV_DEFAULT, use VM::ENABLE_HYPERV_HOST instead

Full Changelog: v1.4...v1.5

1.4 Release

• Added 3 new techniques:
  VM::ODD_CPU_THREADS
VM::INTEL_THREAD_MISMATCH
VM::XEON_THREAD_MISMATCH
• Added better x86 compatibility for description table techniques (idt)
• Added better caching that's much more efficient now
• Fixed warnings, thanks Requiem :)
• Removed Hyper-V virtualisation (by default unless specified with VM::WIN_HYPERV_DEFAULT due to false positives associated with default virtualisation for every program when Hyper-V is enabled)

Full Changelog: v1.3...v1.4

1.3 Release

• added specific VMware products (ESX, GSX, etc...) as potential brands
• added --conclusion flag to cli to return just the conclusion message
• added 12 new techniques
• added "Microsoft Virtual PC/Hyper-V" as possible brand string
• added 32-bit support
• added VM::MULTIPLE flag for multiple brand outputs
• fixed VM::ALL and VM::DEFAULT flags being private
• improved cpuid hypervisor leaf detections

1.2 Release

• added 11 new techniques
• added VM::WIN_HYPERV_DEFAULT flag to tackle Hyper-V default virtualisation on windows
• added ARM support
• fixed false positives for VM::VM_FILES, VM::CPUID_0X4, and other techniques
• fixed memory leaks
• merged the "Sunbelt" and "CWSandbox" VMs as just "CWSandbox"

1.1 Release

• restructured and organised the code better
• added new function VM::add_custom()
• memoization fixes
• CLI bug fixes for MSVC and --detect flag added
• added auxiliary dev tools for the library
• added 2 new MSVC techniques
• added MIT and GPL 3.0 separate code libraries