hyper-x test

kernelwernel · Oct 11, 2024 · e1b893e · e1b893e
1 parent 8edc0ae
commit e1b893e
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/src/vmaware.hpp b/src/vmaware.hpp
@@ -1739,7 +1739,7 @@ struct VM {
             auto is_event_log_hyperv = []() -> bool {
                 std::wstring logName = L"Microsoft-Windows-Kernel-PnP/Configuration";
                 std::vector<std::wstring> searchStrings = { L"Virtual_Machine", L"VMBUS" };
-        
+
                 return (util::query_event_logs(logName, searchStrings));
             };
 
@@ -1748,7 +1748,11 @@ struct VM {
             auto is_root_partition = []() -> bool {
                 u32 ebx, unused = 0;
                 cpu::cpuid(unused, ebx, unused, unused, 0x40000003);
-                return (ebx & 1);
+                const bool result = (ebx & 1);
+
+                if (result) {
+                    core_debug("HYPER_X: root partition returned true");
+                }
             };
 
 
@@ -1768,6 +1772,7 @@ struct VM {
 
             // neither an artifact nor a real VM
             if (!eax_result) {
+                core_debug("HYPER_X: none detected");
                 memo::hyperx::store(hyperx_state::UNKNOWN);
                 return false;
             }
@@ -1786,11 +1791,14 @@ struct VM {
             if (is_real_hyperv_vm) {
                 state = hyperx_state::HYPERV_REAL_VM;
                 core::add(HYPERV);
+                core_debug("HYPER_X: added Hyper-V real VM");
             } else {
                 state = hyperx_state::HYPERV_ARTIFACT_VM;
                 core::add(HYPERV_ARTIFACT);
+                core_debug("HYPER_X: added Hyper-V artifact VM");
             }
 
+            core_debug("HYPER_X: cached");
             memo::hyperx::store(state);
 
             // false means it's an artifact, which is what the