NVRAM false flag

[literallyayden]

Hello there! I am testing using VMAware 2.5.0, recently downloaded off the releases page.

I have tried to use the debug build, however it gave me a VC runtime error. I have also tried to make a debug build myself, yet that also failed too.

Below is my VMAware output:

[NOT DETECTED] Checking VMID...
[NOT DETECTED] Checking CPU brand...
[NOT DETECTED] Checking CPUID hypervisor bit...
[NOT DETECTED] Checking hypervisor str...
[NOT DETECTED] Checking timing anomalies...
[NOT DETECTED] Checking thread count...
[NOT DETECTED] Checking MAC addresses...
[NOT DETECTED] Checking temperature...
[NOT DETECTED] Checking systemd virtualisation...
[NOT DETECTED] Checking chassis vendor...
[NOT DETECTED] Checking chassis type...
[NOT DETECTED] Checking Dockerenv...
[NOT DETECTED] Checking dmidecode output...
[NOT DETECTED] Checking dmesg output...
[NOT DETECTED] Checking hwmon presence...
[NOT DETECTED] Checking DLLs...
[  DETECTED  ] Checking registry keys...
[NOT DETECTED] Checking Wine...
[NOT DETECTED] Checking hw.model...
[NOT DETECTED] Checking VBox default specs...
[NOT DETECTED] Checking processes...
[NOT DETECTED] Checking default Linux user/host...
[NOT DETECTED] Checking gamarue ransomware technique...
[NOT DETECTED] Checking BOCHS CPU techniques...
[NOT DETECTED] Checking MacOS hw.memsize...
[NOT DETECTED] Checking MacOS registry IO-kit...
[NOT DETECTED] Checking IO registry grep...
[NOT DETECTED] Checking MacOS SIP...
[NOT DETECTED] Checking registry values...
[NOT DETECTED] Checking audio devices...
[NOT DETECTED] Checking VPC invalid instructions...
[NOT DETECTED] Checking SIDT...
[NOT DETECTED] Checking SGDT...
[NOT DETECTED] Checking SLDT...
[NOT DETECTED] Checking SMSW...
[NOT DETECTED] Checking /proc/iomem file...
[NOT DETECTED] Checking /proc/ioports file...
[NOT DETECTED] Checking /proc/scsi/scsi file...
[  DISABLED  ] Skipped VMware dmesg
[NOT DETECTED] Checking STR instruction...
[NOT DETECTED] Checking VMware IO port backdoor...
[NOT DETECTED] Checking mutex strings...
[NOT DETECTED] Checking Intel thread count mismatch...
[NOT DETECTED] Checking Intel Xeon thread count mismatch...
[NOT DETECTED] Checking AMD thread count mismatch...
[NOT DETECTED] Checking Cuckoo directory...
[NOT DETECTED] Checking Cuckoo pipe...
[NOT DETECTED] Checking Hyper-V Azure hostname...
[NOT DETECTED] Checking general VM hostnames...
[NOT DETECTED] Checking display...
[NOT DETECTED] Checking bogus device string...
[NOT DETECTED] Checking BlueStacks folders...
[NOT DETECTED] Checking CPUID signatures...
[NOT DETECTED] Checking Intel KGT signature...
[NOT DETECTED] Checking QEMU virtual DMI directory...
[NOT DETECTED] Checking QEMU USB...
[NOT DETECTED] Checking hypervisor directory (Linux)...
[NOT DETECTED] Checking User-mode Linux CPU...
[NOT DETECTED] Checking /dev/kmsg hypervisor message...
[NOT DETECTED] Checking VBox kernel module...
[NOT DETECTED] Checking /proc/sysinfo...
[NOT DETECTED] Checking DMI scan...
[NOT DETECTED] Checking SMBIOS VM bit...
[NOT DETECTED] Checking podman file...
[NOT DETECTED] Checking WSL string in /proc...
[NOT DETECTED] Checking ANY.RUN driver...
[NOT DETECTED] Checking ANY.RUN directory...
[NOT DETECTED] Checking driver names...
[NOT DETECTED] Checking disk serial number...
[NOT DETECTED] Checking IVSHMEM device...
[NOT DETECTED] Checking GPU capabilities...
[NOT DETECTED] Checking power capabilities...
[NOT DETECTED] Checking QEMU fw_cfg device...
[NOT DETECTED] Checking virtual processors...
[NOT DETECTED] Checking hypervisor query...
[NOT DETECTED] Checking AMD-SEV MSR...
[NOT DETECTED] Checking registry emulation...
[NOT DETECTED] Checking firmware...
[NOT DETECTED] Checking low file access count...
[NOT DETECTED] Checking nsjail PID...
[NOT DETECTED] Checking TPM manufacturer...
[NOT DETECTED] Checking PCI vendor/device ID...
[NOT DETECTED] Checking ACPI device signatures...
[NOT DETECTED] Checking hypervisor interception...
[NOT DETECTED] Checking undefined exceptions...
[NOT DETECTED] Checking single step with trap flag...
[NOT DETECTED] Checking Dark Byte's hypervisor...
[NOT DETECTED] Checking boot logo...
[NOT DETECTED] Checking boot manager...
[NOT DETECTED] Checking system profiler...
[NOT DETECTED] Checking objects...
[  DETECTED  ] Checking NVRAM...
[NOT DETECTED] Checking SMBIOS passthrough...

VM brand: Microsoft Hyper-V
VM type: Hypervisor (type 2)
VM likeliness: 99%
VM confirmation: false
VM detections: 2/97
VM hardening: not found

VM description:
[omitted, probably not relevant here]


====== CONCLUSION: Running on baremetal ======

Hardware (if relevant, does not affect the detections as far as i can tell):

[kernelwernel]

We removed the registry keys technique and improved the NVRAM technique a long way after the 2.5.0, including fixing false positives. Can you compile the binary from the main branch and see if the issue persists?

I won’t be active for the next few days as i’m taking long flights, my apologies in advance if i can’t respond in time.

[literallyayden]

Alright, going ahead to compile the binary from main. I'll come back with the output as soon as it's done.

[kernelwernel]

Everything good? If there's no activity on this issue then I'll have to close it in a few days. I'm 90% sure it should be fixed with the current main branch anyway.

[literallyayden]

We removed the registry keys technique and improved the NVRAM technique a long way after the 2.5.0, including fixing false positives. Can you compile the binary from the main branch and see if the issue persists?

I won’t be active for the next few days as i’m taking long flights, my apologies in advance if i can’t respond in time.

Sorry, having trouble compiling it myself.
Should I be compiling the project with VS 2025-2026, or another version? The instructions listed on the readme have Visual Studio 16 2019 in the cmake command.

[NotRequiem]

Sorry, having trouble compiling it myself. Should I be compiling the project with VS 2025-2026, or another version? The instructions listed on the readme have Visual Studio 16 2019 in the cmake command.

VMAware is compatible with any of those versions, personally I compile it with VS 26, using clang or gcc, but MSVC will work as well

[NotRequiem]

@literallyayden pretty sure this false flag has been patched months ago tho because the version you're using is 4 months old (330 commits since now), in fact I entirely removed registry key checks, and updated NVRAM dozens of times, we will be releasing 2.6.0 soon.

[literallyayden]

I compiled from source and got conflicting results. My machine is still getting detected as a VM, just now an "unknown VM".

Compiled debug, non-admin:

[    NOTE    ] Not running as admin - NVRAM detections will be disabled.
[DEBUG] HYPER_X: Detected Hyper-V host machine
[NOT DETECTED] Checking VMID...
[DEBUG] CPUID: max extended leaf = 2147483656
[DEBUG] CPU: 12th Gen Intel(R) Core(TM) i7-1255U
[NOT DETECTED] Checking CPU brand...
[DEBUG] HYPER_X: returned from cache
[NOT DETECTED] Checking CPUID hypervisor bit...
[NOT DETECTED] Checking hypervisor str...
[DEBUG] CPUID: max hypervisor leaf = 1073741836
[DEBUG] TIMER: Current CPU base speed -> 2611.33 MHz
[DEBUG] TIMER: Processor's true base speed -> 1700 MHz
[DEBUG] TIMER: CPU supports invariant TSC
[DEBUG] TIMER: RDTSC -> 271, QIT -> 260, Ratio: 11
[DEBUG] TIMER: VMEXIT latency -> 895
[NOT DETECTED] Checking timing anomalies...
[NOT DETECTED] Checking thread count...
[NOT DETECTED] Checking MAC addresses...
[NOT DETECTED] Checking temperature...
[NOT DETECTED] Checking systemd virtualisation...
[NOT DETECTED] Checking chassis vendor...
[NOT DETECTED] Checking chassis type...
[NOT DETECTED] Checking Dockerenv...
[NOT DETECTED] Checking dmidecode output...
[NOT DETECTED] Checking dmesg output...
[NOT DETECTED] Checking hwmon presence...
[NOT DETECTED] Checking DLLs...
[NOT DETECTED] Checking Wine...
[NOT DETECTED] Checking hw.model...
[NOT DETECTED] Checking processes...
[NOT DETECTED] Checking default Linux user/host...
[NOT DETECTED] Checking gamarue ransomware technique...
[NOT DETECTED] Checking BOCHS CPU techniques...
[NOT DETECTED] Checking MacOS hw.memsize...
[NOT DETECTED] Checking MacOS registry IO-kit...
[NOT DETECTED] Checking IO registry grep...
[NOT DETECTED] Checking MacOS SIP...
[NOT DETECTED] Checking audio devices...
[NOT DETECTED] Checking device handles...
[NOT DETECTED] Checking VPC invalid instructions...
[NOT DETECTED] Checking SIDT...
[NOT DETECTED] Checking SGDT...
[NOT DETECTED] Checking SLDT...
[NOT DETECTED] Checking SMSW...
[NOT DETECTED] Checking /proc/iomem file...
[NOT DETECTED] Checking /proc/ioports file...
[NOT DETECTED] Checking /proc/scsi/scsi file...
[  DISABLED  ] Skipped VMware dmesg
[NOT DETECTED] Checking STR instruction...
[NOT DETECTED] Checking VMware IO port backdoor...
[NOT DETECTED] Checking mutex strings...
[DEBUG] INTEL_THREAD_MISMATCH: CPU model = 12th Gen Intel(R) Core(TM) i7-1255U
[NOT DETECTED] Checking Thread count mismatch...
[NOT DETECTED] Checking Cuckoo directory...
[NOT DETECTED] Checking Cuckoo pipe...
[NOT DETECTED] Checking Azure Hyper-V...
[NOT DETECTED] Checking display...
[NOT DETECTED] Checking bogus device string...
[NOT DETECTED] Checking BlueStacks folders...
[DEBUG] CPUID_SIGNATURE: eax = 824407624
[NOT DETECTED] Checking CPUID signatures...
[NOT DETECTED] Checking Intel KGT signature...
[NOT DETECTED] Checking QEMU virtual DMI directory...
[NOT DETECTED] Checking QEMU USB...
[NOT DETECTED] Checking hypervisor directory (Linux)...
[NOT DETECTED] Checking User-mode Linux CPU...
[NOT DETECTED] Checking /dev/kmsg hypervisor message...
[NOT DETECTED] Checking VBox kernel module...
[NOT DETECTED] Checking /proc/sysinfo...
[NOT DETECTED] Checking DMI scan...
[NOT DETECTED] Checking SMBIOS VM bit...
[NOT DETECTED] Checking podman file...
[NOT DETECTED] Checking WSL string in /proc...
[NOT DETECTED] Checking ANY.RUN driver...
[NOT DETECTED] Checking ANY.RUN directory...
[NOT DETECTED] Checking driver names...
[DEBUG] DISK_SERIAL: 0000_0000_0000_0001_00A0_7525_511F_3C49.
[NOT DETECTED] Checking disk serial number...
[NOT DETECTED] Checking IVSHMEM device...
[NOT DETECTED] Checking GPU capabilities...
[NOT DETECTED] Checking power capabilities...
[NOT DETECTED] Checking QEMU fw_cfg device...
[DEBUG] VIRTUAL_PROCESSORS: MaxVirtualProcessors -> 2048, MaxLogicalProcessors -> 2048
[NOT DETECTED] Checking virtual processors...
[NOT DETECTED] Checking hypervisor query...
[NOT DETECTED] Checking AMD-SEV MSR...
[NOT DETECTED] Checking registry emulation...
[NOT DETECTED] Checking firmware...
[NOT DETECTED] Checking low file access count...
[NOT DETECTED] Checking nsjail PID...
[NOT DETECTED] Checking PCI vendor/device ID...
[DEBUG] ACPI_SIGNATURE: PCIROOT(0)#PCI(0200)
[DEBUG] ACPI_SIGNATURE: ACPI(_SB_)#ACPI(PCI0)#ACPI(GFX0)
[DEBUG] ACPI_SIGNATURE: Valid signature -> PCIROOT(0)#PCI(0200)
[DEBUG] ACPI_SIGNATURE: Valid signature -> ACPI(_SB_)#ACPI(PCI0)#ACPI(GFX0)
[NOT DETECTED] Checking ACPI device signatures...
[NOT DETECTED] Checking hypervisor interception...
[NOT DETECTED] Checking undefined exceptions...
[NOT DETECTED] Checking single step with trap flag...
[NOT DETECTED] Checking Dark Byte's hypervisor...
[DEBUG] BOOT_LOGO: size=150462, flags=1, offset=8, crc=0x488cabb8
[NOT DETECTED] Checking boot logo...
[NOT DETECTED] Checking system profiler...
[NOT DETECTED] Checking kernel objects...
[NOT DETECTED] Checking NVRAM...
[NOT DETECTED] Checking SMBIOS integrity...
[NOT DETECTED] Checking EDID...
[NOT DETECTED] Checking CPU heuristics...
[NOT DETECTED] Checking system timers...

[DEBUG] theoretical maximum points: 3860
VM brand: Unknown
VM type: Unknown
VM likeliness: 0%
VM confirmation: false
VM detections: 0/92
VM hardening: not found


====== CONCLUSION: Running on baremetal ======

Press Enter to exit...

Compiled debug, admin:

[DEBUG] HYPER_X: Detected Hyper-V host machine
[NOT DETECTED] Checking VMID...
[DEBUG] CPUID: max extended leaf = 2147483656
[DEBUG] CPU: 12th Gen Intel(R) Core(TM) i7-1255U
[NOT DETECTED] Checking CPU brand...
[DEBUG] HYPER_X: returned from cache
[NOT DETECTED] Checking CPUID hypervisor bit...
[NOT DETECTED] Checking hypervisor str...
[DEBUG] CPUID: max hypervisor leaf = 1073741836
[DEBUG] TIMER: Current CPU base speed -> 2611.34 MHz
[DEBUG] TIMER: Processor's true base speed -> 1700 MHz
[DEBUG] TIMER: CPU supports invariant TSC
[DEBUG] TIMER: RDTSC -> 270, QIT -> 258, Ratio: 12
[DEBUG] TIMER: VMEXIT latency -> 901
[NOT DETECTED] Checking timing anomalies...
[NOT DETECTED] Checking thread count...
[NOT DETECTED] Checking MAC addresses...
[NOT DETECTED] Checking temperature...
[NOT DETECTED] Checking systemd virtualisation...
[NOT DETECTED] Checking chassis vendor...
[NOT DETECTED] Checking chassis type...
[NOT DETECTED] Checking Dockerenv...
[NOT DETECTED] Checking dmidecode output...
[NOT DETECTED] Checking dmesg output...
[NOT DETECTED] Checking hwmon presence...
[NOT DETECTED] Checking DLLs...
[NOT DETECTED] Checking Wine...
[NOT DETECTED] Checking hw.model...
[NOT DETECTED] Checking processes...
[NOT DETECTED] Checking default Linux user/host...
[NOT DETECTED] Checking gamarue ransomware technique...
[NOT DETECTED] Checking BOCHS CPU techniques...
[NOT DETECTED] Checking MacOS hw.memsize...
[NOT DETECTED] Checking MacOS registry IO-kit...
[NOT DETECTED] Checking IO registry grep...
[NOT DETECTED] Checking MacOS SIP...
[NOT DETECTED] Checking audio devices...
[NOT DETECTED] Checking device handles...
[NOT DETECTED] Checking VPC invalid instructions...
[NOT DETECTED] Checking SIDT...
[NOT DETECTED] Checking SGDT...
[NOT DETECTED] Checking SLDT...
[NOT DETECTED] Checking SMSW...
[NOT DETECTED] Checking /proc/iomem file...
[NOT DETECTED] Checking /proc/ioports file...
[NOT DETECTED] Checking /proc/scsi/scsi file...
[  DISABLED  ] Skipped VMware dmesg
[NOT DETECTED] Checking STR instruction...
[NOT DETECTED] Checking VMware IO port backdoor...
[NOT DETECTED] Checking mutex strings...
[DEBUG] INTEL_THREAD_MISMATCH: CPU model = 12th Gen Intel(R) Core(TM) i7-1255U
[NOT DETECTED] Checking Thread count mismatch...
[NOT DETECTED] Checking Cuckoo directory...
[NOT DETECTED] Checking Cuckoo pipe...
[NOT DETECTED] Checking Azure Hyper-V...
[NOT DETECTED] Checking display...
[NOT DETECTED] Checking bogus device string...
[NOT DETECTED] Checking BlueStacks folders...
[DEBUG] CPUID_SIGNATURE: eax = 824407624
[NOT DETECTED] Checking CPUID signatures...
[NOT DETECTED] Checking Intel KGT signature...
[NOT DETECTED] Checking QEMU virtual DMI directory...
[NOT DETECTED] Checking QEMU USB...
[NOT DETECTED] Checking hypervisor directory (Linux)...
[NOT DETECTED] Checking User-mode Linux CPU...
[NOT DETECTED] Checking /dev/kmsg hypervisor message...
[NOT DETECTED] Checking VBox kernel module...
[NOT DETECTED] Checking /proc/sysinfo...
[NOT DETECTED] Checking DMI scan...
[NOT DETECTED] Checking SMBIOS VM bit...
[NOT DETECTED] Checking podman file...
[NOT DETECTED] Checking WSL string in /proc...
[NOT DETECTED] Checking ANY.RUN driver...
[NOT DETECTED] Checking ANY.RUN directory...
[NOT DETECTED] Checking driver names...
[DEBUG] DISK_SERIAL: 0000_0000_0000_0001_00A0_7525_511F_3C49.
[NOT DETECTED] Checking disk serial number...
[NOT DETECTED] Checking IVSHMEM device...
[NOT DETECTED] Checking GPU capabilities...
[NOT DETECTED] Checking power capabilities...
[NOT DETECTED] Checking QEMU fw_cfg device...
[DEBUG] VIRTUAL_PROCESSORS: MaxVirtualProcessors -> 2048, MaxLogicalProcessors -> 2048
[NOT DETECTED] Checking virtual processors...
[NOT DETECTED] Checking hypervisor query...
[NOT DETECTED] Checking AMD-SEV MSR...
[NOT DETECTED] Checking registry emulation...
[NOT DETECTED] Checking firmware...
[NOT DETECTED] Checking low file access count...
[NOT DETECTED] Checking nsjail PID...
[NOT DETECTED] Checking PCI vendor/device ID...
[DEBUG] ACPI_SIGNATURE: PCIROOT(0)#PCI(0200)
[DEBUG] ACPI_SIGNATURE: ACPI(_SB_)#ACPI(PCI0)#ACPI(GFX0)
[DEBUG] ACPI_SIGNATURE: Valid signature -> PCIROOT(0)#PCI(0200)
[DEBUG] ACPI_SIGNATURE: Valid signature -> ACPI(_SB_)#ACPI(PCI0)#ACPI(GFX0)
[NOT DETECTED] Checking ACPI device signatures...
[NOT DETECTED] Checking hypervisor interception...
[NOT DETECTED] Checking undefined exceptions...
[NOT DETECTED] Checking single step with trap flag...
[NOT DETECTED] Checking Dark Byte's hypervisor...
[DEBUG] BOOT_LOGO: size=150462, flags=1, offset=8, crc=0x488cabb8
[NOT DETECTED] Checking boot logo...
[NOT DETECTED] Checking system profiler...
[NOT DETECTED] Checking kernel objects...
[DEBUG] NVRAM: Environment was loaded using a virtual boot loader
[  DETECTED  ] Checking NVRAM...
[NOT DETECTED] Checking SMBIOS integrity...
[NOT DETECTED] Checking EDID...
[NOT DETECTED] Checking CPU heuristics...
[NOT DETECTED] Checking system timers...

[DEBUG] theoretical maximum points: 3860
VM brand: Unknown
VM type: Unknown
VM likeliness: 99%
VM confirmation: false
VM detections: 1/92
VM hardening: found


====== CONCLUSION: Very likely an unknown VM ======

[    NOTE    ] If you found a false positive, please make sure to create
               an issue at https://github.com/kernelwernel/VMAware/issues

Press Enter to exit...

Previously, my hardware was detected as a Hyper-V VM whilst using VMAware 2.5.0. After compiling from source, I now get a much higher VM likeliness and unknown VM conclusion as opposed to previously getting the bare metal conclusion. I do not have VM hardening as my hardware is not virtualized.

For reference, VMAware 2.5.0 (Administrator) output excerpt from the first post in this issue:

VM brand: Microsoft Hyper-V
VM type: Hypervisor (type 2)
VM likeliness: 99%
VM confirmation: false
VM detections: 2/97
VM hardening: not found

VM description:
[omitted, probably not relevant here]


====== CONCLUSION: Running on baremetal ======

[NotRequiem]

ty, will be fixed soon, didn't remember I didn't delete that faulty check, completely my fault

[NotRequiem]

Fixed.

1. First of all, you got conflicting results because vmaware tells you that you didnt ran as admin and NVRAM detection (the only check that false flags) will be disabled, you can see it in your own logs:

2. The problem was me not adding the removal of that check to my to-do list , but we were aware of the false flag

Now everything will work. Ty for your issue!