fix: updated cli with hardener from vmaware struct and fixed false positive from logic due to Hyper-X

Author: kernelwernel

src/cli.cpp

@@ -368,12 +368,12 @@ R"(Usage:
     std::exit(0);
 }
 
-static const char* color(const u8 score) {
+static const char* color(const u8 score, const bool is_hardened) {
     if (arg_bitset.test(NO_ANSI)) {
         return "";
     }
 
-    if (VM::is_hardened()) {
+    if (is_hardened) {
         return green.c_str();
     }
 
@@ -1100,10 +1100,10 @@ static void general(
     {
         std::cout << bold << "VM hardening: " << ansi_exit;
 
-        if (VM::is_hardened()) {
-            std::cout << green << "found" << ansi_exit << "\n";
+        if (vm.is_hardened) {
+            std::cout << green << "likely" << ansi_exit << "\n";
         } else {
-            std::cout << grey << "not found" << ansi_exit << "\n";
+            std::cout << grey << "unlikely" << ansi_exit << "\n";
         }
     }
 
@@ -1177,7 +1177,7 @@ static void general(
 
     // conclusion manager
     {
-        const char* conclusion_color = color(vm.percentage);
+        const char* conclusion_color = color(vm.percentage, vm.is_hardened);
 
         std::string conclusion = vm.conclusion;
 

src/vmaware.hpp

@@ -12693,10 +12693,11 @@ struct VM {
             };
 
             const bool hv_present = (check(VM::HYPERVISOR_BIT) || check(VM::HYPERVISOR_STR));
+            const bool has_hyper_x = (detected_brand(VM::HYPERVISOR_BIT) == brand_enum::HYPERV_ARTIFACT);
 
             // rule 1: if VM::FIRMWARE is detected, so should VM::HYPERVISOR_BIT or VM::HYPERVISOR_STR
             const enum brand_enum firmware_brand = detected_brand(VM::FIRMWARE);
-            if (firmware_brand != brand_enum::NULL_BRAND && !hv_present) {
+            if (firmware_brand != brand_enum::NULL_BRAND && !hv_present && !has_hyper_x) {
                 debug("is_hardened(): firmware and hypervisor bit/str are not detected together");
                 return true;
             }
@@ -12721,7 +12722,7 @@ struct VM {
             }
 
             // rule 4: if VM::TRAP or VM::NVRAM is detected, so should VM::HYPERVISOR_BIT or VM::HYPERVISOR_STR
-            if ((check(VM::TRAP) || check(VM::NVRAM)) && !hv_present) {
+            if ((check(VM::TRAP) || check(VM::NVRAM)) && !hv_present && !has_hyper_x) {
                 debug("is_hardened(): trap/NVRAM and hypervisor bit/str are not detected together");
                 return true;
             }