basedpill / detectvm

Small program to detect if it is running on a virtual machine (windows only) and self deletes if it is.

VMware and VBox Detector 👋

✨ Overview ✨

• Can detect VMware (If VMware tools are installed)
• Can detect Oracle VirtualBox
• Can self delete if a vm is detected
• Header file is included with all the functions in a namespace DetectVM

Checks for the psuedo device \\.\VBoxMiniRdrDN which exists in virtualbox vms.
Checks for the vmware tools registry SOFTWARE\VMware, Inc.\VMware Tool .
Self Delete function spawns a hidden cmd shell which gets the file path and deletes it.

Prerequisites

Uses standard libraries
Can be built using g++ (Sometimes cannot run on VMs using gcc unsure why)

g++ antivm.cpp -o antivm.exe -static-libgcc -static-libstdc++

Demo 🎥

VMware Demonstration

VirtualBox Demonstration

Author

• char*#1337 on discord
• mayhapsDev on GitHub

🤝 Contributing

Contributions, issues and feature requests are welcome!

Feel free to check

Show your support

Give a ⭐️ if this project helped you!

To-Do

• Add KVM detection
• Add Hyper-V detection
• Add QEMU detection
• Improve VMware detection

detectvm's Issues

Error while compiling

In file included from antivm.cpp:3:
antivm.hpp: In function 'BOOL DetectVM::SelfDelete()':
antivm.hpp:32:74: error: cast from 'HINSTANCE' {aka 'HINSTANCE__*'} to 'int' loses precision [-fpermissive]
32 | if((GetEnvironmentVariable(_T("ComSpec"),szFile,MAX_PATH)!=0) &&((int) ShellExecute(0,0,szFile,szCmd,0,SW_HIDE) > 32))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~