Windows C++ / Hyper-V Signature
Author | kernelwernel |
Platform | Windows |
Language | C++ |
Technique | Hyper-V Signature |
Code
/**
* Hyper-V has a signature value of "Hv#1" in eax if leaf `0x40000001` is provided to CPUID.
*
* This code snippet is from the VMAware project at https://github.com/kernelwernel/VMAware
*
* detection made by kernelwernel, 2024
*/
#if (defined(_MSC_VER) || defined(_WIN32) || defined(_WIN64) || defined(__MINGW32__))
#define MSVC 1
#define LINUX 0
#elif (defined(__linux__))
#define MSVC 0
#define LINUX 1
#else
#define MSVC 0
#define LINUX 0
#endif
#if (LINUX)
#include <cpuid.h>
#elif (MSVC)
#include <intrin.h>
#endif
#include <cstdint>
#include <thread>
#include <array>
#include <iostream>
bool hyperv_sig() {
auto cpuid_eax = [](
std::uint32_t& eax,
const std::uint32_t leaf
) -> void {
#if (MSVC)
std::int32_t x[4]{};
__cpuid((std::int32_t*)x, static_cast<std::int32_t>(leaf));
eax = static_cast<std::uint32_t>(x[0]);
#elif (LINUX)
std::uint32_t unused = 0;
__get_cpuid(leaf, &eax, &unused, &unused, &unused);
#else
return;
#endif
};
std::uint32_t eax = 0;
cpuid_eax(eax, 0x40000001);
constexpr std::uint32_t signature = 0x31237648; // "Hv#1"
return (eax == signature);
}
int main() {
std::cout << "Hyper-V's signature found? = " << (hyperv_sig() ? "Yes, very likely a Hyper-V VM" : "No, could be baremetal") << "\n";
return 0;
}
Created
August 17, 2024
Last Revised
August 17, 2024