VMAware

It utilises a comprehensive list of low-level and high-level anti-VM techniques that gets accounted in a scoring system. The scores (0-100) for each technique are given based on an objective criteria focused on detecting the most stealthy VMs by minimizing false positives as much as possible, and every technique that has detected a VM will have their score added to a single accumulative point, where a threshold point number will decide whether it’s actually running in a VM.

It’s designed for security researchers, VM engineers, anticheat developers, and pretty much anybody who needs a practical and rock-solid VM detection mechanism in their project. The library is useful for malware analysts testing the concealment of their VMs and for proprietary software developers aiming to protect their applications from reverse engineering. It’s an effective tool to benchmark how well a VM can hide itself from detection.

Additionally, software could adjust the behaviour of their program based on the detected environment. It could be useful for debugging purposes, while system administrators could manage configurations differently. Finally, some applications might want to legally restrict usage in VMs as a license clause to prevent unauthorized distribution or testing.

There’s already loads of projects that have the same goal such as InviZzzible, pafish and Al-Khaser. The difference between the aforementioned projects is that they don’t provide a programmable interface to interact with the detection mechanisms, on top of having little to no support for non-Windows systems. Additionally, the VM detections in all those projects are often not sophisticated enough to be practically applied to real-world scenarios. An additional hurdle is that they are all GPL projects, so using them for proprietary projects (which would be the main audience for such a functionality), is out of the question. Pafish and InviZzzible have been abandoned for years.

While those projects have been useful to VMAware to some extent, we wanted to make them far better. Our goal was to make the detection techniques to be accessible programmatically in a cross-platform and flexible way for everybody to get something useful out of it rather than providing just a CLI tool. In summary, this is a VM detection framework that focuses on practical and realistic usability for any scenario, aiming to provide the most accurate result of the environment where your software is running under.

VMAware is fully open source, which makes the job of bypassers easier compared to having it closed source. However, We’d argue that’s a worthy tradeoff by having as many VM detection techniques in an open and interactive manner. It means we can have valuable community feedback to strengthen the library more effectively and accurately through discussions, collaborations, and competition against anti-anti-vm projects and malware analysis tools which try to hide their presence.

All of this combined has further advanced the forefront innovations in the field of VM detections much more productively, compared to having it closed source. In other words, it’s about better quality AND quantity, better feedback, and better openness over security through obfuscation. It’s the same reason why OpenSSH, OpenSSL, the Linux kernel, and other security-based software projects are relatively secure because of how there’s more people helping to make it better compared to people trying to probe the source code with malicious intent. VMAware has this philosophy, and if you know anything about security, you should be familiar with the phrase: “Security through obfuscation is NOT security”.

Publicly known hardeners are not effective and most of them on Windows have been beaten, but this doesn’t mean that the lib is immune to them. Custom hardeners that we may not be aware of might have a theoretical advantage, but they are substantially more difficult to produce.

We continously track both open and closed source projects and bypasses to detect them. Windows is the most targeted operating system for bypassing VM detections, so our main focus is to strengthen detections for this platform.

Currently, no public repository, project or code base in general is able to fully bypass on Windows. When a working public bypass is found, it usually gets fixed in a couple of days. Our arms race is mostly battled against private methods gatekept by cheaters to bypass both VMAware and anti-cheats.

By researching, we identify the methods currently used to hide VMs and investigate generic detection techniques capable of detecting those methods.

Once we have production-ready code, we upload it to this repository and begin experimental testing in real environments. All code in any github branch is experimental, while the latest release represent our stable code.

Some products that use our project run our library on thousands of systems, collaborating with us to report back how VMAware behaved in such systems. All those reports are manually checked by us for false positives or any other problem in general.

While techniques are evaluated, scores for those techniques are dynamically adjusted based on their effectiveness, reliability, and how they operate together with other detection techniques. The criteria used to put our scores can be found here.

Using GitHub Actions, we automatically monitor if both compilation and runtime problems occur in every platform we target, each time a new commit is uploaded to our repository.

When the library has accumulated enough changes under our view, we publish a release and explain those changes in detail. Before releasing, we do a security audit to ensure the new published version is safe.

This project is not soliciting the development of malware for obvious reasons. Even if you intend to use it for concealment purposes, it’ll most likely be flagged by antiviruses anyways and nothing is obfuscated to begin with.

We do not intentionally develop the library to try to stop or avoid EDR flags, such as using direct/indirect syscalling, inline hooking detection, and any other kind of malware evasion technique not related to virtualization detection.

No. In our opinion, there are no good user-mode solutions for VM detection, and we want to devote all our time to meeting this demand. We can still detect most stealthy virtualised environments while being completely user-mode.

No. Do not call functions of this library with multiple threads simultaneously, we don’t take more than 1s to run.

If you’re compiling with gcc or clang, add the -lm and -lstdc++ flags, or use g++/clang++ compilers instead. If you’re receiving linker errors from a brand new VM environment on Linux, update your system with sudo apt/dnf/yum update -y to install the necessary C++ components.