.

pkg/antivm/antivm_linux.go

@@ -0,0 +1,161 @@
+//go:build linux
+
+package antivm
+
+import (
+	"net"
+	"os"
+	"strings"
+	"time"
+)
+
+var vmIdentifiers = []string{
+	"VMware",
+	"VirtualBox",
+	"QEMU",
+	"KVM",
+	"Xen",
+	"Microsoft Corporation",
+	"Parallels",
+}
+
+var vmMACPrefixes = []string{
+	"00:0c:29",
+	"08:00:27",
+	"52:54:00",
+	"00:1c:42",
+}
+
+var vmPCIVendors = []string{
+	"15ad",
+	"80ee",
+	"1234",
+}
+
+func readSysfsTrimmed(path string) string {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
+
+func containsAny(s string, needles []string) bool {
+	for _, n := range needles {
+		if strings.Contains(s, n) {
+			return true
+		}
+	}
+	return false
+}
+
+func checkDMI() bool {
+	paths := []string{
+		"/sys/class/dmi/id/sys_vendor",
+		"/sys/class/dmi/id/product_name",
+	}
+	for _, p := range paths {
+		val := readSysfsTrimmed(p)
+		if containsAny(val, vmIdentifiers) {
+			return true
+		}
+	}
+	return false
+}
+
+func checkMAC() bool {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return false
+	}
+	for _, iface := range ifaces {
+		mac := strings.ToLower(iface.HardwareAddr.String())
+		if mac == "" {
+			continue
+		}
+		for _, prefix := range vmMACPrefixes {
+			if strings.HasPrefix(mac, prefix) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func checkCPUID() bool {
+	data, err := os.ReadFile("/proc/cpuinfo")
+	if err != nil {
+		return false
+	}
+	content := string(data)
+
+	if strings.Contains(content, "hypervisor") {
+		return true
+	}
+
+	if strings.Contains(content, "QEMU Virtual CPU") {
+		return true
+	}
+
+	return false
+}
+
+func checkDisk() bool {
+	entries, err := os.ReadDir("/sys/block")
+	if err != nil {
+		return false
+	}
+	for _, entry := range entries {
+		modelPath := "/sys/block/" + entry.Name() + "/device/model"
+		model := readSysfsTrimmed(modelPath)
+		if containsAny(model, vmIdentifiers) {
+			return true
+		}
+	}
+	return false
+}
+
+func checkPCI() bool {
+	entries, err := os.ReadDir("/sys/bus/pci/devices")
+	if err != nil {
+		return false
+	}
+	for _, entry := range entries {
+		vendorPath := "/sys/bus/pci/devices/" + entry.Name() + "/vendor"
+		vendor := readSysfsTrimmed(vendorPath)
+		vendorID := strings.TrimPrefix(vendor, "0x")
+		for _, v := range vmPCIVendors {
+			if vendorID == v {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func checkTiming() bool {
+	start := time.Now()
+	sum := 0
+	for i := 0; i < 100000; i++ {
+		sum += i
+	}
+	elapsed := time.Since(start)
+	_ = sum
+	return elapsed > 10*time.Millisecond
+}
+
+func checkSystemProfiler() bool {
+	return false
+}
+
+func checkIOKit() bool {
+	return false
+}
+
+func checkRegistry() bool {
+	return false
+}
+
+func checkWMI() bool {
+	return false
+}