hyperdetect.c

//this requires being able to run at kernel mode and assumes you're using MSVC //this also uses an unnamed structure for cr0_t, which is a nonstandard extension of the C language

//data structure for cr0 typedef union _cr0_t { struct { uint64_t protection_enable : 1; uint64_t monitor_coprocessor : 1; uint64_t emulation : 1; uint64_t task_switched : 1; uint64_t extension_type : 1; uint64_t numeric_error : 1; uint64_t reserved : 10; uint64_t write_protect : 1; uint64_t reserved_1 : 1; uint64_t alignment_mask : 1; uint64_t reserved_2 : 10; uint64_t not_write_through : 1; uint64_t cache_disable : 1; uint64_t paging : 1; uint64_t reserved_3 : 32; };

uint64_t full;

} cr0_t;

bool is_lazy_hypervisor_running(void) { //hypervisors like VMWare don't check if the change to cr0.pe is a valid one and just write it to the control register //since cr0.pg will be set, this is an invalid cr0 state and causes a VM entry failure __try { cr0_t cr0; cr0.full = __readcr0();

	cr0.numeric_error = !cr0.numeric_error; //force a VM exit by toggling the VMX required numeric error bit; this isn't required for VMWare since it VM exits on cr0.pe
	cr0.protection_enable = 0; //disable the PE bit

	__writecr0(cr0.full);
	
	//write was ignored, return true since this should have caused a #GP(0)
	return true;
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
	//this causes VMWare to close; good hypervisors will inject a #GP(0)
}

//alternative check: a hypervisor may dislike VMX bits being toggled and inject a #GP(0) when it shouldn't
//cr4.vmxe isn't checked as the hypervisor may have an excuse for that by setting CPUID.1:ECX.VMX[bit 5] to 0 and injecting a #UD
//they also may ignore the write which must be checked
{
	cr0_t old_cr0;
	old_cr0.full = __readcr0();
	
	__try
	{
		//disable interrupts as we're modifying the state of a control register, which value won't be upheld on context switches
		_disable();

		{
			cr0_t cr0 = old_cr0;
			cr0.numeric_error = !cr0.numeric_error;
			__writecr0(cr0.full);
			
			//additionally, check if the hypervisor actually toggles the bit
			cr0.full = __readcr0();
			
			if (cr0.numeric_error == old_cr0.numeric_error)
			{
				//the write did not update cr0.ne
				_enable();
				return true;
			}
		}

		__writecr0(old_cr0.full);
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
		//only reachable in a virtualized environment
		_enable();
		return true;
	}

	_enable();
}

//many hypervisors (including ones made by people I know, many projects online, as well as mine up until recently) don't properly handle reserved bits of cr0 and cr4
//this could cause either a VM entry failure or a triple fault (repeated #GP(0)) since the processor can't reset cr4
//a previous version used cr0 to test this; that was incorrect as reserved CR0 bits will just get forced to 0 by the processor
__try
{
	__writecr4(__readcr4() | (1 << 23)); //non-existant bit

	//this point is only reachable if the hypervisor ignores the change
	return true;
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
	//if properly handled, a #GP(0) is generated and cr4's value is never changed
}

//along with realizing my previous mistake, this also opens up a detection vector for hypervisors that inject a #GP(0) upon changing cr0 reserved bits
__try
{
	__writecr0(__readcr0() | (1 << 23));
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
	return true; //should never cause a fault
}

//check if cr0's value isn't changed after a #GP(0)
{
	_disable();
	
	cr0_t old_cr0;
	old_cr0.full = __readcr0();
	
	__try
	{
		cr0_t cr0 = old_cr0;
		cr0.numeric_error = !cr0.numeric_error; //a bit which is guaranteed to cause a VM exit, and which we've verified won't cause a #GP(0)
		cr0.protection_enable = 0; //a bit which is guaranteed not to cause VM entry failure, and which will cause a #GP(0)
		cr0.write_protect = !cr0.write_protect; //a bit which won't cause a VM entry failure nor a #GP(0)
		
		__writecr0(cr0.full);
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
		cr0_t cr0;
		cr0.full = __readcr0();
		
		//if everything was handled correctly, cr0.write_protect will be equal to its old value
		if (cr0.write_protect != old_cr0.write_protect)
		{
			_enable();
			
			__writecr0(old_cr0.full);
			return true;
		}
	}
	
	_enable();
}

//all checks passed
return false;

}