> For the complete documentation index, see [llms.txt](https://easyauth.papelship.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://easyauth.papelship.com/csharp-document/remote-settings/vm-detection.md).

# VM Detection

The Virtual Machine & Hypervisor Detection subsystem identifies virtualized sandboxes, automated analysis environments, and hypervisors commonly used for software cracking and unpacking.

***

## Detection Heuristics

The engine evaluates multiple hardware and hypervisor indicators to calculate an aggregate VM confidence score (0 to 100):

* **CPUID Hypervisor Signature**: Evaluates CPUID leaf `0x40000000` for known vendor hypervisor strings (`VMwareVMware`, `Microsoft Hv`, `VBoxVBoxVBox`, `KVMKVMKVM`, `QEMUQEMUQEMU`, `XenVMMXenVMM`).
* **RDTSC / APERF Timing Analysis**: Measures instruction execution latency jitter caused by hypervisor VM-exit traps.
* **Hardware Device Artifacts**: Scans PCI devices, ACPI tables, and storage controller strings (e.g. `VBOX_HARDDISK`, `QEMU_HARDDISK`, `VMware_Virtual_IDE`).
* **Driver & Service Signatures**: Detects guest integration agents (`VBoxGuest.sys`, `vmmouse.sys`, `vboxservice.exe`, `vmtoolsd.exe`).
* **IDT / GDT Base Address**: Checks descriptor table base addresses against bare-metal physical ranges.

***

## C# Implementation

{% tabs %}
{% tab title="Basic VM Detection" %}

```csharp
using System;
using qPapelEasyAuth;

public class EnvironmentChecker
{
    public static void CheckEnvironment()
    {
        bool isVm = qPapelEasyAuth.qPapelEasyAuth.IsVirtualMachine(out int vmScore, out string vmVendor);

        if (isVm)
        {
            Console.WriteLine($"[!] Environment Warning: Virtual machine environment detected.");
            Console.WriteLine($"    Vendor     : {vmVendor}");
            Console.WriteLine($"    Risk Score : {vmScore} / 100");
        }
        else
        {
            Console.WriteLine("[+] Environment Verified: Bare-metal physical PC.");
        }
    }
}
```

{% endtab %}

{% tab title="Enforcing Bare-Metal Policy" %}

```csharp
// Reject execution in virtual machines or sandbox environments
if (qPapelEasyAuth.qPapelEasyAuth.IsVirtualMachine(out int score, out string vendor))
{
    if (score >= 60)
    {
        Console.WriteLine($"[-] Execution is restricted on virtualized systems ({vendor}).");
        Environment.Exit(0);
    }
}
```

{% endtab %}
{% endtabs %}

***

## Hypervisor Signatures Identified

| Hypervisor String | Vendor / Platform                  | Score Weight |
| ----------------- | ---------------------------------- | ------------ |
| `VMwareVMware`    | VMware Workstation / ESXi          | 100          |
| `VBoxVBoxVBox`    | Oracle VirtualBox                  | 100          |
| `Microsoft Hv`    | Microsoft Hyper-V / WSL2           | 80           |
| `KVMKVMKVM`       | Linux Kernel-based Virtual Machine | 100          |
| `QEMUQEMUQEMU`    | QEMU Emulator / Proxmox            | 100          |
| `XenVMMXenVMM`    | Xen Hypervisor                     | 90           |

{% hint style="info" %}
WSL2 and Windows Sandbox utilize Microsoft Hyper-V. You can configure the VM sensitivity threshold on the server dashboard if you wish to allow legitimate Hyper-V environments.
{% endhint %}