Can you tell about what it is checking for physical ports ?

[Greatz08]

I wanna know exactly what it is detecting in physical ports to decide whether machine is vm or not ? is it number of ports or type of ports ? or any unique signature which is different from real machine ?
Please guide me on this :-)
Thankyou

[kernelwernel]

It's mostly signature based with a few examples:

VM::VMWARE_IOPORTS:

This basically checks the /proc/ioports file on Linux which gives people access to see which ports are being used by privileged processes such as drivers and kernel modules. The file looks like this:

0000-0000 : PCI Bus 0000:00
  0000-0000 : dma1
  0000-0000 : pic1
  0000-0000 : timer0
  0000-0000 : timer1
  0000-0000 : keyboard
  0000-0000 : PNP0C09:00
 
  (and so on...)

  0000-0000 : PCI Bus 0000:2c
  0000-0000 : PCI Bus 0000:56
  0000-0000 : PCI Bus 0000:80
  0000-0000 : 0000:00:1f.4
    0000-0000 : i801_smbus

In a more simpler sense, it just fetches the content of /proc/ioports, scans for the "VMware" string, and if the string is present then it detects a VMware machine.

VM::VMWARE_PORT_MEM

This basically queries "VMXh" (0x686D5856) in port "VX" (0x5658), it's basically like the "official" way to detect a VMware VM that was deliberately designed for this purpose by the company.

VM::VMWARE_BACKDOOR

Same as above, but it's much more specialised by querying in port "VX" and "VY" which both are supported by VMware.

VM::PORT_CONNECTORS

Basically this just checks whether the WMI query of "Win32_PortConnector" is empty, which it should in a VM. I'm not exactly sure why, but that's windows for you I guess (#46)

---

Hope that answers your question :)

[Greatz08]

@kernelwernel can you tell me why it is is not able to fetch info if the ports are available in smbios and you can test in your real machine too with hardware info(hwinfo) application in which i highlighted these ports . The command -> powershell -Command "Get-WmiObject Win32_PortConnector" actually detects these ports only so why in this case it is not able to is what i am unable to understand

[kernelwernel]

That looks like a false positive to me. I'll try to find a fix really soon, thanks for reporting this.

Also I thought you meant port-based techniques in general rather than that specific technique in your original question, my mistake.

[NotRequiem]

The Win32_PortConnector WMI class provides information about the physical port connectors on your machine (e.g., USB, HDMI, PS/2).
A VM doesnt have physical ports and thats why we added it as a vm detection.

To query this WMI class, we're using the execute function in our wmi struct, with the following query: L"SELECT * FROM Win32_PortConnector", { L"Caption" }

This query basically returns the "Caption" property, which is usually "Port Connector". In your image, this property is not shown because the Caption property is part of the wmi object but is not included in the default displayed output for readability. To show all properties (and all ports), you should run:

Get-WmiObject Win32_PortConnector | Format-List *, or Get-WmiObject Win32_PortConnector | Select-Object -ExpandProperty Caption if you want to run the same query that VMAware is executing