anti-vm [source]

iskaprox · 17.07.2025

Intel и AMD
Проверено на vmware,virtualbox,qemu.

Thermal and Power Management Leaf (Initial EAX Value = 06H)
ECX.Bit 00: Hardware Coordination Feedback Capability (Presence of IA32_MPERF and IA32_APERF).

C:

// Проверка поддержки APERF/MPERF
// Отсутствует на виртуалках
#include <intrin.h>


int main(void) {
    int cpuInfo[4] = {0};


    __cpuid(cpuInfo, 0x6);


    if (cpuInfo[2] & 0x1) {
        // ok
    } else {
        // virtual machine detected.
    }
}

Проверка поддержки инструкций RDTSCP, MONITOR.
Если хотя бы одного нет, то скорее всего вм.

C++:

// InstructionSet.cpp
// Compile by using: cl /EHsc /W4 InstructionSet.cpp
// processor: x86, x64
// Uses the __cpuid intrinsic to get information about
// CPU extended instruction set support.


#include <iostream>
#include <vector>
#include <bitset>
#include <array>
#include <string>
#include <intrin.h>
#include <conio.h>


class InstructionSet
{
    // forward declarations
    class InstructionSet_Internal;


public:
    // getters
    static std::string Vendor(void) { return CPU_Rep.vendor_; }
    static std::string Brand(void) { return CPU_Rep.brand_; }


    static bool SSE3(void) { return CPU_Rep.f_1_ECX_[0]; }
    static bool PCLMULQDQ(void) { return CPU_Rep.f_1_ECX_[1]; }
    static bool MONITOR(void) { return CPU_Rep.f_1_ECX_[3]; }
    static bool SSSE3(void) { return CPU_Rep.f_1_ECX_[9]; }
    static bool FMA(void) { return CPU_Rep.f_1_ECX_[12]; }
    static bool CMPXCHG16B(void) { return CPU_Rep.f_1_ECX_[13]; }
    static bool SSE41(void) { return CPU_Rep.f_1_ECX_[19]; }
    static bool SSE42(void) { return CPU_Rep.f_1_ECX_[20]; }
    static bool MOVBE(void) { return CPU_Rep.f_1_ECX_[22]; }
    static bool POPCNT(void) { return CPU_Rep.f_1_ECX_[23]; }
    static bool AES(void) { return CPU_Rep.f_1_ECX_[25]; }
    static bool XSAVE(void) { return CPU_Rep.f_1_ECX_[26]; }
    static bool OSXSAVE(void) { return CPU_Rep.f_1_ECX_[27]; }
    static bool AVX(void) { return CPU_Rep.f_1_ECX_[28]; }
    static bool F16C(void) { return CPU_Rep.f_1_ECX_[29]; }
    static bool RDRAND(void) { return CPU_Rep.f_1_ECX_[30]; }


    static bool MSR(void) { return CPU_Rep.f_1_EDX_[5]; }
    static bool CX8(void) { return CPU_Rep.f_1_EDX_[8]; }
    static bool SEP(void) { return CPU_Rep.f_1_EDX_[11]; }
    static bool CMOV(void) { return CPU_Rep.f_1_EDX_[15]; }
    static bool CLFSH(void) { return CPU_Rep.f_1_EDX_[19]; }
    static bool MMX(void) { return CPU_Rep.f_1_EDX_[23]; }
    static bool FXSR(void) { return CPU_Rep.f_1_EDX_[24]; }
    static bool SSE(void) { return CPU_Rep.f_1_EDX_[25]; }
    static bool SSE2(void) { return CPU_Rep.f_1_EDX_[26]; }


    static bool FSGSBASE(void) { return CPU_Rep.f_7_EBX_[0]; }
    static bool BMI1(void) { return CPU_Rep.f_7_EBX_[3]; }
    static bool HLE(void) { return CPU_Rep.isIntel_ && CPU_Rep.f_7_EBX_[4]; }
    static bool AVX2(void) { return CPU_Rep.f_7_EBX_[5]; }
    static bool BMI2(void) { return CPU_Rep.f_7_EBX_[8]; }
    static bool ERMS(void) { return CPU_Rep.f_7_EBX_[9]; }
    static bool INVPCID(void) { return CPU_Rep.f_7_EBX_[10]; }
    static bool RTM(void) { return CPU_Rep.isIntel_ && CPU_Rep.f_7_EBX_[11]; }
    static bool AVX512F(void) { return CPU_Rep.f_7_EBX_[16]; }
    static bool RDSEED(void) { return CPU_Rep.f_7_EBX_[18]; }
    static bool ADX(void) { return CPU_Rep.f_7_EBX_[19]; }
    static bool AVX512PF(void) { return CPU_Rep.f_7_EBX_[26]; }
    static bool AVX512ER(void) { return CPU_Rep.f_7_EBX_[27]; }
    static bool AVX512CD(void) { return CPU_Rep.f_7_EBX_[28]; }
    static bool SHA(void) { return CPU_Rep.f_7_EBX_[29]; }


    static bool PREFETCHWT1(void) { return CPU_Rep.f_7_ECX_[0]; }


    static bool LAHF(void) { return CPU_Rep.f_81_ECX_[0]; }
    static bool LZCNT(void) { return CPU_Rep.isIntel_ && CPU_Rep.f_81_ECX_[5]; }
    static bool ABM(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_ECX_[5]; }
    static bool SSE4a(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_ECX_[6]; }
    static bool XOP(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_ECX_[11]; }
    static bool TBM(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_ECX_[21]; }


    static bool SYSCALL(void) { return CPU_Rep.isIntel_ && CPU_Rep.f_81_EDX_[11]; }
    static bool MMXEXT(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_EDX_[22]; }
    static bool RDTSCP(void) { return (CPU_Rep.isIntel_ || CPU_Rep.isAMD_) && CPU_Rep.f_81_EDX_[27];  }
    static bool _3DNOWEXT(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_EDX_[30]; }
    static bool _3DNOW(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_EDX_[31]; }


private:
    static const InstructionSet_Internal CPU_Rep;


    class InstructionSet_Internal
    {
    public:
        InstructionSet_Internal()
            : nIds_{ 0 },
            nExIds_{ 0 },
            isIntel_{ false },
            isAMD_{ false },
            f_1_ECX_{ 0 },
            f_1_EDX_{ 0 },
            f_7_EBX_{ 0 },
            f_7_ECX_{ 0 },
            f_81_ECX_{ 0 },
            f_81_EDX_{ 0 },
            data_{},
            extdata_{}
        {
            //int cpuInfo[4] = {-1};
            std::array<int, 4> cpui;


            // Calling __cpuid with 0x0 as the function_id argument
            // gets the number of the highest valid function ID.
            __cpuid(cpui.data(), 0);
            nIds_ = cpui[0];


            for (int i = 0; i <= nIds_; ++i)
            {
                __cpuidex(cpui.data(), i, 0);
                data_.push_back(cpui);
            }


            // Capture vendor string
            char vendor[0x20];
            memset(vendor, 0, sizeof(vendor));
            *reinterpret_cast<int*>(vendor) = data_[0][1];
            *reinterpret_cast<int*>(vendor + 4) = data_[0][3];
            *reinterpret_cast<int*>(vendor + 8) = data_[0][2];
            vendor_ = vendor;
            if (vendor_ == "GenuineIntel")
            {
                isIntel_ = true;
            }
            else if (vendor_ == "AuthenticAMD")
            {
                isAMD_ = true;
            }


            // load bitset with flags for function 0x00000001
            if (nIds_ >= 1)
            {
                f_1_ECX_ = data_[1][2];
                f_1_EDX_ = data_[1][3];
            }


            // load bitset with flags for function 0x00000007
            if (nIds_ >= 7)
            {
                f_7_EBX_ = data_[7][1];
                f_7_ECX_ = data_[7][2];
            }


            // Calling __cpuid with 0x80000000 as the function_id argument
            // gets the number of the highest valid extended ID.
            __cpuid(cpui.data(), 0x80000000);
            nExIds_ = cpui[0];


            char brand[0x40];
            memset(brand, 0, sizeof(brand));


            for (int i = 0x80000000; i <= nExIds_; ++i)
            {
                __cpuidex(cpui.data(), i, 0);
                extdata_.push_back(cpui);
            }


            // load bitset with flags for function 0x80000001
            if (nExIds_ >= 0x80000001)
            {
                f_81_ECX_ = extdata_[1][2];
                f_81_EDX_ = extdata_[1][3];
            }


            // Interpret CPU brand string if reported
            if (nExIds_ >= 0x80000004)
            {
                memcpy(brand, extdata_[2].data(), sizeof(cpui));
                memcpy(brand + 16, extdata_[3].data(), sizeof(cpui));
                memcpy(brand + 32, extdata_[4].data(), sizeof(cpui));
                brand_ = brand;
            }
        };


        int nIds_;
        int nExIds_;
        std::string vendor_;
        std::string brand_;
        bool isIntel_;
        bool isAMD_;
        std::bitset<32> f_1_ECX_;
        std::bitset<32> f_1_EDX_;
        std::bitset<32> f_7_EBX_;
        std::bitset<32> f_7_ECX_;
        std::bitset<32> f_81_ECX_;
        std::bitset<32> f_81_EDX_;
        std::vector<std::array<int, 4>> data_;
        std::vector<std::array<int, 4>> extdata_;
    };
};


// Initialize static member data
const InstructionSet::InstructionSet_Internal InstructionSet::CPU_Rep;


// Print out supported instruction set extensions
int main()
{
    auto& outstream = std::cout;


    auto support_message = [&outstream](std::string isa_feature, bool is_supported) {
        outstream << isa_feature << (is_supported ? " supported" : " not supported") << std::endl;
    };


    std::cout << InstructionSet::Vendor() << std::endl;
    std::cout << InstructionSet::Brand() << std::endl;


    support_message("3DNOW",       InstructionSet::_3DNOW());
    support_message("3DNOWEXT",    InstructionSet::_3DNOWEXT());
    support_message("ABM",         InstructionSet::ABM());
    support_message("ADX",         InstructionSet::ADX());
    support_message("AES",         InstructionSet::AES());
    support_message("AVX",         InstructionSet::AVX());
    support_message("AVX2",        InstructionSet::AVX2());
    support_message("AVX512CD",    InstructionSet::AVX512CD());
    support_message("AVX512ER",    InstructionSet::AVX512ER());
    support_message("AVX512F",     InstructionSet::AVX512F());
    support_message("AVX512PF",    InstructionSet::AVX512PF());
    support_message("BMI1",        InstructionSet::BMI1());
    support_message("BMI2",        InstructionSet::BMI2());
    support_message("CLFSH",       InstructionSet::CLFSH());
    support_message("CMPXCHG16B",  InstructionSet::CMPXCHG16B());
    support_message("CX8",         InstructionSet::CX8());
    support_message("ERMS",        InstructionSet::ERMS());
    support_message("F16C",        InstructionSet::F16C());
    support_message("FMA",         InstructionSet::FMA());
    support_message("FSGSBASE",    InstructionSet::FSGSBASE());
    support_message("FXSR",        InstructionSet::FXSR());
    support_message("HLE",         InstructionSet::HLE());
    support_message("INVPCID",     InstructionSet::INVPCID());
    support_message("LAHF",        InstructionSet::LAHF());
    support_message("LZCNT",       InstructionSet::LZCNT());
    support_message("MMX",         InstructionSet::MMX());
    support_message("MMXEXT",      InstructionSet::MMXEXT());
    support_message("MONITOR",     InstructionSet::MONITOR());
    support_message("MOVBE",       InstructionSet::MOVBE());
    support_message("MSR",         InstructionSet::MSR());
    support_message("OSXSAVE",     InstructionSet::OSXSAVE());
    support_message("PCLMULQDQ",   InstructionSet::PCLMULQDQ());
    support_message("POPCNT",      InstructionSet::POPCNT());
    support_message("PREFETCHWT1", InstructionSet::PREFETCHWT1());
    support_message("RDRAND",      InstructionSet::RDRAND());
    support_message("RDSEED",      InstructionSet::RDSEED());
    support_message("RDTSCP",      InstructionSet::RDTSCP());
    support_message("RTM",         InstructionSet::RTM());
    support_message("SEP",         InstructionSet::SEP());
    support_message("SHA",         InstructionSet::SHA());
    support_message("SSE",         InstructionSet::SSE());
    support_message("SSE2",        InstructionSet::SSE2());
    support_message("SSE3",        InstructionSet::SSE3());
    support_message("SSE4.1",      InstructionSet::SSE41());
    support_message("SSE4.2",      InstructionSet::SSE42());
    support_message("SSE4a",       InstructionSet::SSE4a());
    support_message("SSSE3",       InstructionSet::SSSE3());
    support_message("SYSCALL",     InstructionSet::SYSCALL());
    support_message("TBM",         InstructionSet::TBM());
    support_message("XOP",         InstructionSet::XOP());
    support_message("XSAVE",       InstructionSet::XSAVE());
    
    bool monitor = InstructionSet::MONITOR();
    bool rdtscp = InstructionSet::RDTSCP();


    // Некоторые отключают флаг rdtscp в аргументах
    // monitor отсутствует в виртуалках.
    if (!monitor || !rdtscp) {
        outstream << "\n>> Virtual machine detected" << std::endl;
    } else {
        outstream << "\n>> Not virtual machine" << std::endl;
    }
    
    printf("\nPress any key to exit...");
    _getch();
}

Пример с smbios type 0 (BIOS characteristics)

В qemu по дефолту стоит только "BIOS Characteristics are not supported."
Также в Characteristics Extension Byte 2 бит 4 "SMBIOS table describes a virtual machine." (В коде не добавлена проверка на неё).
В другой вм установлено меньше 10 флагов характеристик биоса.

Проверяйте, пользуйтесь.

C:

// bios_characteristics.c
#include <windows.h>
#include <stdio.h>
#include <tchar.h>
#include <conio.h>


#pragma pack(push, 1)
typedef struct {
    BYTE type;
    BYTE length;
    WORD handle;
    BYTE vendorIdx;
    BYTE versionIdx;
    WORD startingAddrSeg;
    BYTE releaseDateIdx;
    BYTE biosRomSize;
    ULONGLONG characteristics;
    BYTE extBytes[1];
} SMBIOS_BIOS_INFO;
#pragma pack(pop)


const TCHAR* biosCharDesc[32] = {
    _T("Reserved"), _T("Reserved"), _T("Unknown"), _T("BIOS Characteristics Not Supported"),
    _T("ISA supported"), _T("MCA supported"), _T("EISA supported"), _T("PCI supported"),
    _T("PC Card (PCMCIA) supported"), _T("Plug and Play supported"), _T("APM supported"),
    _T("BIOS Upgradable (Flash)"), _T("BIOS shadowing allowed"), _T("VL-VESA supported"),
    _T("ESCD support available"), _T("Boot from CD supported"), _T("Selectable Boot supported"),
    _T("BIOS ROM socketed"), _T("Boot From PC Card (PCMCIA) supported"),
    _T("EDD (Enhanced Disk Drive) supported"),
    _T("Int 13h - Japanese Floppy (NEC 9800 1.2mb) supported"),
    _T("Int 13h - Japanese Floppy (Toshiba 1.2mb) supported"),
    _T("Int 13h - 5.25\"/360 KB Floppy Services supported"),
    _T("Int 13h - 5.25\"/1.2MB Floppy Services supported"),
    _T("Int 13h - 3.5\"/720 KB Floppy Services supported"),
    _T("Int 13h - 3.5\"/2.88 MB Floppy Services supported"),
    _T("Int 5h, Print Screen Service supported"),
    _T("Int 9h, 8042 Keyboard services supported"),
    _T("Int 14h, Serial Services supported"), _T("Int 17h, printer services supported"),
    _T("Int 10h, CGA/Mono Video Services supported"), _T("NEC PC-98")
};


const TCHAR* extByte1Desc[8] = {
    _T("ACPI supported"),
    _T("USB Legacy supported"),
    _T("AGP supported"),
    _T("I2O boot supported"),
    _T("LS-120 SuperDisk boot supported"),
    _T("ATAPI ZIP drive boot supported"),
    _T("1394 boot supported"),
    _T("Smart Battery supported")
};


const TCHAR* extByte2Desc[8] = {
    _T("BIOS Boot Specification supported"),
    _T("Function key-initiated network service boot supported"),
    _T("Enable targeted content distribution"),
    _T("UEFI Specification supported"),
    _T("SMBIOS describes virtual machine"),
    _T("Manufacturing mode supported"),
    _T("Manufacturing mode enabled"),
    _T("Reserved for future assignment")
};


static int popcount64(ULONGLONG x) {
    int cnt = 0;
    while (x) {
        cnt += (int)(x & 1);
        x >>= 1;
    }
    return cnt;
}


const TCHAR* getString(const BYTE* strTable, BYTE index) {
    if (index == 0) return _T("Not Specified");
    
    const TCHAR* p = (const TCHAR*)strTable;
    BYTE count = 1;
    
    while (count < index) {
        while (*p != 0) p++;
        p++;
        if (*p == 0) return _T("Bad Index");
        count++;
    }
    return p;
}


void printBiosCharacteristics(ULONGLONG chars, BYTE ext1, BYTE ext2) {
    int charCount = popcount64(chars);
    _tprintf(_T("\nBIOS Characteristics (%d features):\n"), charCount);
    _tprintf(_T("--------------------------------\n"));
    
    for (int i = 0; i < 32; i++) {
        if (chars & (1ULL << i)) {
            _tprintf(_T("  [%02d] %s\n"), i, biosCharDesc[i]);
        }
    }
    
    if (ext1) {
        _tprintf(_T("\nExtension Byte 1:\n"));
        for (int i = 0; i < 8; i++) {
            if (ext1 & (1 << i)) {
                _tprintf(_T("  [%02d] %s\n"), i + 32, extByte1Desc[i]);
            }
        }
    }
    
    if (ext2) {
        _tprintf(_T("\nExtension Byte 2:\n"));
        for (int i = 0; i < 8; i++) {
            if (ext2 & (1 << i)) {
                _tprintf(_T("  [%02d] %s\n"), i + 40, extByte2Desc[i]);
            }
        }
    }
}


void parseBiosInfo(SMBIOS_BIOS_INFO* bios) {
    const BYTE* strTable = (const BYTE*)bios + bios->length;
    
    _tprintf(_T("\nSMBIOS BIOS Information (Type 0)\n"));
    _tprintf(_T("================================\n"));
    _tprintf(_T("Vendor: %s\n"), getString(strTable, bios->vendorIdx));
    _tprintf(_T("Version: %s\n"), getString(strTable, bios->versionIdx));
    _tprintf(_T("Release Date: %s\n"), getString(strTable, bios->releaseDateIdx));
    
    BYTE extByte1 = 0, extByte2 = 0;
    if (bios->length > 0x12) extByte1 = bios->extBytes[0];
    if (bios->length > 0x13) extByte2 = bios->extBytes[1];
    
    ULONGLONG chars = bios->characteristics;
    int totalBits = popcount64(chars);
    BOOL notSupported = (chars == (1ULL << 3));
    BOOL vm = (totalBits < 10);
    
    printBiosCharacteristics(chars, extByte1, extByte2);
    
    if (notSupported) {
        _tprintf(_T("\n>> BIOS Characteristics Not Supported flag is set\n"));
        _tprintf(_T(">> Virtual machine detected\n"));
    }
    // Не уверен, но на протестированных ПК было всегда больше 10. В виртуалках 4-7.
    if (vm) {
        _tprintf(_T("\n>> Only %d BIOS characteristics supported (minimum 10+ expected)\n"), totalBits);
        _tprintf(_T(">> Virtual machine detected\n"));
    }
    if (!notSupported && !vm) {
        _tprintf(_T("\n>> Not virtual machine\n"));
    }
 
}


int _tmain() {
    DWORD bufferSize = 0;
    DWORD ret = GetSystemFirmwareTable('RSMB', 0, NULL, 0);
    
    if (ret == 0) {
        _tprintf(_T("Error getting SMBIOS table size: %d\n"), GetLastError());
        _tprintf(_T("Press any key to exit..."));
        _getch();
        return 1;
    }
    
    bufferSize = ret;
    BYTE* buffer = (BYTE*)malloc(bufferSize);
    if (!buffer) {
        _tprintf(_T("Memory allocation failed\n"));
        _tprintf(_T("Press any key to exit..."));
        _getch();
        return 1;
    }
    
    ret = GetSystemFirmwareTable('RSMB', 0, buffer, bufferSize);
    if (ret == 0) {
        _tprintf(_T("Error getting SMBIOS table: %d\n"), GetLastError());
        free(buffer);
        _tprintf(_T("Press any key to exit..."));
        _getch();
        return 1;
    }
    
    // Skip entry point structure (8 bytes for SMBIOS 2.1+)
    BYTE* table = buffer + 8;
    BYTE* end = buffer + bufferSize;
    BOOL biosFound = FALSE;
    
    while (table < end) {
        BYTE type = *table;
        BYTE length = *(table + 1);
        
        if (type == 127) break; // End of table
        if (type == 0) { // BIOS Information
            parseBiosInfo((SMBIOS_BIOS_INFO*)table);
            biosFound = TRUE;
            break;
        }
        
        table += length;
        while (table < end - 1) {
            if (table[0] == 0 && table[1] == 0) {
                table += 2;
                break;
            }
            table++;
        }
    }
    
    if (!biosFound) {
        _tprintf(_T("\nBIOS Information structure not found\n"));
    }
    
    free(buffer);
    _tprintf(_T("\nPress any key to exit..."));
    _getch();
}

xiao · 28.09.2025

iskaprox сказал(а):

Intel и AMD
Проверено на vmware,virtualbox,qemu.

C:

// Проверка поддержки APERF/MPERF
// Отсутствует на виртуалках
#include <intrin.h>


int main(void) {
    int cpuInfo[4] = {0};


    __cpuid(cpuInfo, 0x6);


    if (cpuInfo[2] & 0x1) {
        // ok
    } else {
        // virtual machine detected.
    }
}

Проверка поддержки инструкций RDTSCP, MONITOR.
Если хотя бы одного нет, то скорее всего вм.

C++:

// InstructionSet.cpp
// Compile by using: cl /EHsc /W4 InstructionSet.cpp
// processor: x86, x64
// Uses the __cpuid intrinsic to get information about
// CPU extended instruction set support.


#include <iostream>
#include <vector>
#include <bitset>
#include <array>
#include <string>
#include <intrin.h>
#include <conio.h>


class InstructionSet
{
    // forward declarations
    class InstructionSet_Internal;


public:
    // getters
    static std::string Vendor(void) { return CPU_Rep.vendor_; }
    static std::string Brand(void) { return CPU_Rep.brand_; }


    static bool SSE3(void) { return CPU_Rep.f_1_ECX_[0]; }
    static bool PCLMULQDQ(void) { return CPU_Rep.f_1_ECX_[1]; }
    static bool MONITOR(void) { return CPU_Rep.f_1_ECX_[3]; }
    static bool SSSE3(void) { return CPU_Rep.f_1_ECX_[9]; }
    static bool FMA(void) { return CPU_Rep.f_1_ECX_[12]; }
    static bool CMPXCHG16B(void) { return CPU_Rep.f_1_ECX_[13]; }
    static bool SSE41(void) { return CPU_Rep.f_1_ECX_[19]; }
    static bool SSE42(void) { return CPU_Rep.f_1_ECX_[20]; }
    static bool MOVBE(void) { return CPU_Rep.f_1_ECX_[22]; }
    static bool POPCNT(void) { return CPU_Rep.f_1_ECX_[23]; }
    static bool AES(void) { return CPU_Rep.f_1_ECX_[25]; }
    static bool XSAVE(void) { return CPU_Rep.f_1_ECX_[26]; }
    static bool OSXSAVE(void) { return CPU_Rep.f_1_ECX_[27]; }
    static bool AVX(void) { return CPU_Rep.f_1_ECX_[28]; }
    static bool F16C(void) { return CPU_Rep.f_1_ECX_[29]; }
    static bool RDRAND(void) { return CPU_Rep.f_1_ECX_[30]; }


    static bool MSR(void) { return CPU_Rep.f_1_EDX_[5]; }
    static bool CX8(void) { return CPU_Rep.f_1_EDX_[8]; }
    static bool SEP(void) { return CPU_Rep.f_1_EDX_[11]; }
    static bool CMOV(void) { return CPU_Rep.f_1_EDX_[15]; }
    static bool CLFSH(void) { return CPU_Rep.f_1_EDX_[19]; }
    static bool MMX(void) { return CPU_Rep.f_1_EDX_[23]; }
    static bool FXSR(void) { return CPU_Rep.f_1_EDX_[24]; }
    static bool SSE(void) { return CPU_Rep.f_1_EDX_[25]; }
    static bool SSE2(void) { return CPU_Rep.f_1_EDX_[26]; }


    static bool FSGSBASE(void) { return CPU_Rep.f_7_EBX_[0]; }
    static bool BMI1(void) { return CPU_Rep.f_7_EBX_[3]; }
    static bool HLE(void) { return CPU_Rep.isIntel_ && CPU_Rep.f_7_EBX_[4]; }
    static bool AVX2(void) { return CPU_Rep.f_7_EBX_[5]; }
    static bool BMI2(void) { return CPU_Rep.f_7_EBX_[8]; }
    static bool ERMS(void) { return CPU_Rep.f_7_EBX_[9]; }
    static bool INVPCID(void) { return CPU_Rep.f_7_EBX_[10]; }
    static bool RTM(void) { return CPU_Rep.isIntel_ && CPU_Rep.f_7_EBX_[11]; }
    static bool AVX512F(void) { return CPU_Rep.f_7_EBX_[16]; }
    static bool RDSEED(void) { return CPU_Rep.f_7_EBX_[18]; }
    static bool ADX(void) { return CPU_Rep.f_7_EBX_[19]; }
    static bool AVX512PF(void) { return CPU_Rep.f_7_EBX_[26]; }
    static bool AVX512ER(void) { return CPU_Rep.f_7_EBX_[27]; }
    static bool AVX512CD(void) { return CPU_Rep.f_7_EBX_[28]; }
    static bool SHA(void) { return CPU_Rep.f_7_EBX_[29]; }


    static bool PREFETCHWT1(void) { return CPU_Rep.f_7_ECX_[0]; }


    static bool LAHF(void) { return CPU_Rep.f_81_ECX_[0]; }
    static bool LZCNT(void) { return CPU_Rep.isIntel_ && CPU_Rep.f_81_ECX_[5]; }
    static bool ABM(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_ECX_[5]; }
    static bool SSE4a(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_ECX_[6]; }
    static bool XOP(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_ECX_[11]; }
    static bool TBM(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_ECX_[21]; }


    static bool SYSCALL(void) { return CPU_Rep.isIntel_ && CPU_Rep.f_81_EDX_[11]; }
    static bool MMXEXT(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_EDX_[22]; }
    static bool RDTSCP(void) { return (CPU_Rep.isIntel_ || CPU_Rep.isAMD_) && CPU_Rep.f_81_EDX_[27];  }
    static bool _3DNOWEXT(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_EDX_[30]; }
    static bool _3DNOW(void) { return CPU_Rep.isAMD_ && CPU_Rep.f_81_EDX_[31]; }


private:
    static const InstructionSet_Internal CPU_Rep;


    class InstructionSet_Internal
    {
    public:
        InstructionSet_Internal()
            : nIds_{ 0 },
            nExIds_{ 0 },
            isIntel_{ false },
            isAMD_{ false },
            f_1_ECX_{ 0 },
            f_1_EDX_{ 0 },
            f_7_EBX_{ 0 },
            f_7_ECX_{ 0 },
            f_81_ECX_{ 0 },
            f_81_EDX_{ 0 },
            data_{},
            extdata_{}
        {
            //int cpuInfo[4] = {-1};
            std::array<int, 4> cpui;


            // Calling __cpuid with 0x0 as the function_id argument
            // gets the number of the highest valid function ID.
            __cpuid(cpui.data(), 0);
            nIds_ = cpui[0];


            for (int i = 0; i <= nIds_; ++i)
            {
                __cpuidex(cpui.data(), i, 0);
                data_.push_back(cpui);
            }


            // Capture vendor string
            char vendor[0x20];
            memset(vendor, 0, sizeof(vendor));
            *reinterpret_cast<int*>(vendor) = data_[0][1];
            *reinterpret_cast<int*>(vendor + 4) = data_[0][3];
            *reinterpret_cast<int*>(vendor + 8) = data_[0][2];
            vendor_ = vendor;
            if (vendor_ == "GenuineIntel")
            {
                isIntel_ = true;
            }
            else if (vendor_ == "AuthenticAMD")
            {
                isAMD_ = true;
            }


            // load bitset with flags for function 0x00000001
            if (nIds_ >= 1)
            {
                f_1_ECX_ = data_[1][2];
                f_1_EDX_ = data_[1][3];
            }


            // load bitset with flags for function 0x00000007
            if (nIds_ >= 7)
            {
                f_7_EBX_ = data_[7][1];
                f_7_ECX_ = data_[7][2];
            }


            // Calling __cpuid with 0x80000000 as the function_id argument
            // gets the number of the highest valid extended ID.
            __cpuid(cpui.data(), 0x80000000);
            nExIds_ = cpui[0];


            char brand[0x40];
            memset(brand, 0, sizeof(brand));


            for (int i = 0x80000000; i <= nExIds_; ++i)
            {
                __cpuidex(cpui.data(), i, 0);
                extdata_.push_back(cpui);
            }


            // load bitset with flags for function 0x80000001
            if (nExIds_ >= 0x80000001)
            {
                f_81_ECX_ = extdata_[1][2];
                f_81_EDX_ = extdata_[1][3];
            }


            // Interpret CPU brand string if reported
            if (nExIds_ >= 0x80000004)
            {
                memcpy(brand, extdata_[2].data(), sizeof(cpui));
                memcpy(brand + 16, extdata_[3].data(), sizeof(cpui));
                memcpy(brand + 32, extdata_[4].data(), sizeof(cpui));
                brand_ = brand;
            }
        };


        int nIds_;
        int nExIds_;
        std::string vendor_;
        std::string brand_;
        bool isIntel_;
        bool isAMD_;
        std::bitset<32> f_1_ECX_;
        std::bitset<32> f_1_EDX_;
        std::bitset<32> f_7_EBX_;
        std::bitset<32> f_7_ECX_;
        std::bitset<32> f_81_ECX_;
        std::bitset<32> f_81_EDX_;
        std::vector<std::array<int, 4>> data_;
        std::vector<std::array<int, 4>> extdata_;
    };
};


// Initialize static member data
const InstructionSet::InstructionSet_Internal InstructionSet::CPU_Rep;


// Print out supported instruction set extensions
int main()
{
    auto& outstream = std::cout;


    auto support_message = [&outstream](std::string isa_feature, bool is_supported) {
        outstream << isa_feature << (is_supported ? " supported" : " not supported") << std::endl;
    };


    std::cout << InstructionSet::Vendor() << std::endl;
    std::cout << InstructionSet::Brand() << std::endl;


    support_message("3DNOW",       InstructionSet::_3DNOW());
    support_message("3DNOWEXT",    InstructionSet::_3DNOWEXT());
    support_message("ABM",         InstructionSet::ABM());
    support_message("ADX",         InstructionSet::ADX());
    support_message("AES",         InstructionSet::AES());
    support_message("AVX",         InstructionSet::AVX());
    support_message("AVX2",        InstructionSet::AVX2());
    support_message("AVX512CD",    InstructionSet::AVX512CD());
    support_message("AVX512ER",    InstructionSet::AVX512ER());
    support_message("AVX512F",     InstructionSet::AVX512F());
    support_message("AVX512PF",    InstructionSet::AVX512PF());
    support_message("BMI1",        InstructionSet::BMI1());
    support_message("BMI2",        InstructionSet::BMI2());
    support_message("CLFSH",       InstructionSet::CLFSH());
    support_message("CMPXCHG16B",  InstructionSet::CMPXCHG16B());
    support_message("CX8",         InstructionSet::CX8());
    support_message("ERMS",        InstructionSet::ERMS());
    support_message("F16C",        InstructionSet::F16C());
    support_message("FMA",         InstructionSet::FMA());
    support_message("FSGSBASE",    InstructionSet::FSGSBASE());
    support_message("FXSR",        InstructionSet::FXSR());
    support_message("HLE",         InstructionSet::HLE());
    support_message("INVPCID",     InstructionSet::INVPCID());
    support_message("LAHF",        InstructionSet::LAHF());
    support_message("LZCNT",       InstructionSet::LZCNT());
    support_message("MMX",         InstructionSet::MMX());
    support_message("MMXEXT",      InstructionSet::MMXEXT());
    support_message("MONITOR",     InstructionSet::MONITOR());
    support_message("MOVBE",       InstructionSet::MOVBE());
    support_message("MSR",         InstructionSet::MSR());
    support_message("OSXSAVE",     InstructionSet::OSXSAVE());
    support_message("PCLMULQDQ",   InstructionSet::PCLMULQDQ());
    support_message("POPCNT",      InstructionSet::POPCNT());
    support_message("PREFETCHWT1", InstructionSet::PREFETCHWT1());
    support_message("RDRAND",      InstructionSet::RDRAND());
    support_message("RDSEED",      InstructionSet::RDSEED());
    support_message("RDTSCP",      InstructionSet::RDTSCP());
    support_message("RTM",         InstructionSet::RTM());
    support_message("SEP",         InstructionSet::SEP());
    support_message("SHA",         InstructionSet::SHA());
    support_message("SSE",         InstructionSet::SSE());
    support_message("SSE2",        InstructionSet::SSE2());
    support_message("SSE3",        InstructionSet::SSE3());
    support_message("SSE4.1",      InstructionSet::SSE41());
    support_message("SSE4.2",      InstructionSet::SSE42());
    support_message("SSE4a",       InstructionSet::SSE4a());
    support_message("SSSE3",       InstructionSet::SSSE3());
    support_message("SYSCALL",     InstructionSet::SYSCALL());
    support_message("TBM",         InstructionSet::TBM());
    support_message("XOP",         InstructionSet::XOP());
    support_message("XSAVE",       InstructionSet::XSAVE());
   
    bool monitor = InstructionSet::MONITOR();
    bool rdtscp = InstructionSet::RDTSCP();


    // Некоторые отключают флаг rdtscp в аргументах
    // monitor отсутствует в виртуалках.
    if (!monitor || !rdtscp) {
        outstream << "\n>> Virtual machine detected" << std::endl;
    } else {
        outstream << "\n>> Not virtual machine" << std::endl;
    }
   
    printf("\nPress any key to exit...");
    _getch();
}

Пример с smbios type 0 (BIOS characteristics)

В qemu по дефолту стоит только "BIOS Characteristics are not supported."
Также в Characteristics Extension Byte 2 бит 4 "SMBIOS table describes a virtual machine." (В коде не добавлена проверка на неё).
В другой вм установлено меньше 10 флагов характеристик биоса.

Проверяйте, пользуйтесь.

C:

// bios_characteristics.c
#include <windows.h>
#include <stdio.h>
#include <tchar.h>
#include <conio.h>


#pragma pack(push, 1)
typedef struct {
    BYTE type;
    BYTE length;
    WORD handle;
    BYTE vendorIdx;
    BYTE versionIdx;
    WORD startingAddrSeg;
    BYTE releaseDateIdx;
    BYTE biosRomSize;
    ULONGLONG characteristics;
    BYTE extBytes[1];
} SMBIOS_BIOS_INFO;
#pragma pack(pop)


const TCHAR* biosCharDesc[32] = {
    _T("Reserved"), _T("Reserved"), _T("Unknown"), _T("BIOS Characteristics Not Supported"),
    _T("ISA supported"), _T("MCA supported"), _T("EISA supported"), _T("PCI supported"),
    _T("PC Card (PCMCIA) supported"), _T("Plug and Play supported"), _T("APM supported"),
    _T("BIOS Upgradable (Flash)"), _T("BIOS shadowing allowed"), _T("VL-VESA supported"),
    _T("ESCD support available"), _T("Boot from CD supported"), _T("Selectable Boot supported"),
    _T("BIOS ROM socketed"), _T("Boot From PC Card (PCMCIA) supported"),
    _T("EDD (Enhanced Disk Drive) supported"),
    _T("Int 13h - Japanese Floppy (NEC 9800 1.2mb) supported"),
    _T("Int 13h - Japanese Floppy (Toshiba 1.2mb) supported"),
    _T("Int 13h - 5.25\"/360 KB Floppy Services supported"),
    _T("Int 13h - 5.25\"/1.2MB Floppy Services supported"),
    _T("Int 13h - 3.5\"/720 KB Floppy Services supported"),
    _T("Int 13h - 3.5\"/2.88 MB Floppy Services supported"),
    _T("Int 5h, Print Screen Service supported"),
    _T("Int 9h, 8042 Keyboard services supported"),
    _T("Int 14h, Serial Services supported"), _T("Int 17h, printer services supported"),
    _T("Int 10h, CGA/Mono Video Services supported"), _T("NEC PC-98")
};


const TCHAR* extByte1Desc[8] = {
    _T("ACPI supported"),
    _T("USB Legacy supported"),
    _T("AGP supported"),
    _T("I2O boot supported"),
    _T("LS-120 SuperDisk boot supported"),
    _T("ATAPI ZIP drive boot supported"),
    _T("1394 boot supported"),
    _T("Smart Battery supported")
};


const TCHAR* extByte2Desc[8] = {
    _T("BIOS Boot Specification supported"),
    _T("Function key-initiated network service boot supported"),
    _T("Enable targeted content distribution"),
    _T("UEFI Specification supported"),
    _T("SMBIOS describes virtual machine"),
    _T("Manufacturing mode supported"),
    _T("Manufacturing mode enabled"),
    _T("Reserved for future assignment")
};


static int popcount64(ULONGLONG x) {
    int cnt = 0;
    while (x) {
        cnt += (int)(x & 1);
        x >>= 1;
    }
    return cnt;
}


const TCHAR* getString(const BYTE* strTable, BYTE index) {
    if (index == 0) return _T("Not Specified");
   
    const TCHAR* p = (const TCHAR*)strTable;
    BYTE count = 1;
   
    while (count < index) {
        while (*p != 0) p++;
        p++;
        if (*p == 0) return _T("Bad Index");
        count++;
    }
    return p;
}


void printBiosCharacteristics(ULONGLONG chars, BYTE ext1, BYTE ext2) {
    int charCount = popcount64(chars);
    _tprintf(_T("\nBIOS Characteristics (%d features):\n"), charCount);
    _tprintf(_T("--------------------------------\n"));
   
    for (int i = 0; i < 32; i++) {
        if (chars & (1ULL << i)) {
            _tprintf(_T("  [%02d] %s\n"), i, biosCharDesc[i]);
        }
    }
   
    if (ext1) {
        _tprintf(_T("\nExtension Byte 1:\n"));
        for (int i = 0; i < 8; i++) {
            if (ext1 & (1 << i)) {
                _tprintf(_T("  [%02d] %s\n"), i + 32, extByte1Desc[i]);
            }
        }
    }
   
    if (ext2) {
        _tprintf(_T("\nExtension Byte 2:\n"));
        for (int i = 0; i < 8; i++) {
            if (ext2 & (1 << i)) {
                _tprintf(_T("  [%02d] %s\n"), i + 40, extByte2Desc[i]);
            }
        }
    }
}


void parseBiosInfo(SMBIOS_BIOS_INFO* bios) {
    const BYTE* strTable = (const BYTE*)bios + bios->length;
   
    _tprintf(_T("\nSMBIOS BIOS Information (Type 0)\n"));
    _tprintf(_T("================================\n"));
    _tprintf(_T("Vendor: %s\n"), getString(strTable, bios->vendorIdx));
    _tprintf(_T("Version: %s\n"), getString(strTable, bios->versionIdx));
    _tprintf(_T("Release Date: %s\n"), getString(strTable, bios->releaseDateIdx));
   
    BYTE extByte1 = 0, extByte2 = 0;
    if (bios->length > 0x12) extByte1 = bios->extBytes[0];
    if (bios->length > 0x13) extByte2 = bios->extBytes[1];
   
    ULONGLONG chars = bios->characteristics;
    int totalBits = popcount64(chars);
    BOOL notSupported = (chars == (1ULL << 3));
    BOOL vm = (totalBits < 10);
   
    printBiosCharacteristics(chars, extByte1, extByte2);
   
    if (notSupported) {
        _tprintf(_T("\n>> BIOS Characteristics Not Supported flag is set\n"));
        _tprintf(_T(">> Virtual machine detected\n"));
    }
    // Не уверен, но на протестированных ПК было всегда больше 10. В виртуалках 4-7.
    if (vm) {
        _tprintf(_T("\n>> Only %d BIOS characteristics supported (minimum 10+ expected)\n"), totalBits);
        _tprintf(_T(">> Virtual machine detected\n"));
    }
    if (!notSupported && !vm) {
        _tprintf(_T("\n>> Not virtual machine\n"));
    }
 
}


int _tmain() {
    DWORD bufferSize = 0;
    DWORD ret = GetSystemFirmwareTable('RSMB', 0, NULL, 0);
   
    if (ret == 0) {
        _tprintf(_T("Error getting SMBIOS table size: %d\n"), GetLastError());
        _tprintf(_T("Press any key to exit..."));
        _getch();
        return 1;
    }
   
    bufferSize = ret;
    BYTE* buffer = (BYTE*)malloc(bufferSize);
    if (!buffer) {
        _tprintf(_T("Memory allocation failed\n"));
        _tprintf(_T("Press any key to exit..."));
        _getch();
        return 1;
    }
   
    ret = GetSystemFirmwareTable('RSMB', 0, buffer, bufferSize);
    if (ret == 0) {
        _tprintf(_T("Error getting SMBIOS table: %d\n"), GetLastError());
        free(buffer);
        _tprintf(_T("Press any key to exit..."));
        _getch();
        return 1;
    }
   
    // Skip entry point structure (8 bytes for SMBIOS 2.1+)
    BYTE* table = buffer + 8;
    BYTE* end = buffer + bufferSize;
    BOOL biosFound = FALSE;
   
    while (table < end) {
        BYTE type = *table;
        BYTE length = *(table + 1);
       
        if (type == 127) break; // End of table
        if (type == 0) { // BIOS Information
            parseBiosInfo((SMBIOS_BIOS_INFO*)table);
            biosFound = TRUE;
            break;
        }
       
        table += length;
        while (table < end - 1) {
            if (table[0] == 0 && table[1] == 0) {
                table += 2;
                break;
            }
            table++;
        }
    }
   
    if (!biosFound) {
        _tprintf(_T("\nBIOS Information structure not found\n"));
    }
   
    free(buffer);
    _tprintf(_T("\nPress any key to exit..."));
    _getch();
}

nice one !

UmaxSoft · 17.10.2025

Способ хороший, но трафик заметно отъехал по отстуку при тестах. Уж слишком агрессивно. Что можно убрать что бы облегчить проверку?

anti-vm [source]

iskaprox

floppy-диск

xiao

floppy-диск

UmaxSoft

floppy-диск