vm-detect

Are you in a VM? 20 probes, one score. Comprehensive virtual machine detection for Linux.

How it works

Runs 20 independent detection probes, each scoring 0–100. Weighted combination produces a final verdict with an evidence chain.

$ vm-detect

Environment: Virtual Machine (QEMU)
VM Score:    62/100 (13 evidence signals)
VM Brand:    QEMU

── VM Evidence (13 signals) ──

[ 95] dmi_product: product_name='KVM Virtual Machine' → KVM
[100] systemd_virt: systemd-detect-virt: kvm
[ 90] pci_devices: VM PCI devices: virtio (KVM/QEMU)
[ 85] dmi_bios: bios_vendor='EFI Development Kit II / OVMF'
[ 85] kernel_modules: virtio_gpu, virtio_dma_buf (KVM/QEMU)
...

Probes

Probe	Score	What it checks
dmi_product	95	DMI product name vs 22 known VM strings
dmi_vendor	90	System vendor identification
dmi_bios	85	BIOS vendor (OVMF/SeaBIOS = QEMU/KVM)
hypervisor_dir	100	/sys/hypervisor presence
cpuinfo_flag	100	CPUID hypervisor bit
systemd_virt	100	systemd-detect-virt output
pci_devices	90	PCI vendor IDs (virtio, VMware, VBox, Hyper-V, Xen)
kernel_modules	85	VM kernel modules (virtio, vmw_, hv_, xen_)
mac_address	80	VM MAC prefix (11 known prefixes)
scsi	85	SCSI device strings
acpi_tables	75	ACPI OEM signatures
dmesg	70	Kernel log VM strings
disk_model	80	Disk model VM strings
qemu_fw_cfg	100	QEMU firmware config interface
dmi_chassis	50	Chassis type 1/2 = VM indicator
hwmon	40	Absent hardware monitors
temperature	30	Absent thermal zones
device_tree	90	ARM device tree model string
hostname	20	Default VM hostname patterns
proc_bus	—	PCI bus presence (context)

Deep Checks

Beyond probes, includes cycle-accurate timing analysis, memory TLB/EPT overhead measurement, interrupt pattern analysis, and SIDT/SGDT descriptor table inspection (x86).

Install

[dependencies]
vm-detect = { git = "https://github.com/InnerWarden/vm-detect" }

Or run as CLI:

cargo install --git https://github.com/InnerWarden/vm-detect
vm-detect
vm-detect --json  # machine-readable output

Supported Hypervisors

VMware, VirtualBox, KVM/QEMU, Hyper-V, Xen, Parallels, bhyve, AWS Nitro, Google Compute, Oracle Cloud, DigitalOcean, Hetzner, OVH, Linode, Vultr, OpenStack, Nutanix, Bochs, Docker.

---

Part of the InnerWarden security ecosystem.