Desktop - Virtual Environment - Detector (Pro)

Some players run the game inside a virtual machine, such as VMware, VirtualBox, Hyper-V, QEMU, or Parallels. That makes it easier to inspect memory, rewind the game, or run bots. VirtualEnvironmentDetector looks for signs of that.

Walkthrough: Protecting a desktop build.

Detector

VirtualEnvironmentDetector does not need a monitor. It runs three checks:

  1. Network adapter addresses: On Windows, macOS, and Linux it compares adapter addresses with a list of virtual-machine vendors. Examples: 08:00:27 VirtualBox, 00:0C:29 and 00:50:56 VMware, 00:15:5D Hyper-V, 52:54:00 QEMU, 00:1C:42 Parallels.
  2. BIOS text: It reads BIOS text and other virtual-machine signs, such as the system vendor or product name. Some of these signs are only available on some systems.
  3. Other virtual-machine signs: A further check looks for signs that the computer itself is virtual. That check is only available on some systems.

Observed subject

There is no monitor. The scan runs when you call ManualScan(). If the repeat option is on, it also runs in Start and again on an interval.

Status

When a virtual machine is found, the detector sends a DesktopCheatingDetectionStatus:

public struct DesktopCheatingDetectionStatus : IDesktopCheatingDetectionStatus
{
    // Probability that the detection is a false positive, in the range [0.0, 1.0].
    public float PossibilityOfFalsePositive { get; }

    // The threat rating reported with this detection.
    public uint ThreatRating { get; }

    // The type of cheating detected on the desktop platform.
    public EDesktopCheatingType DesktopCheatingType { get; }

    // A short, human-readable string describing what triggered the detection.
    public string Evidence { get; }
}
  • Evidence: A short text that says what was found, such as an address or a BIOS word.

DesktopCheatingType can be:

public enum EDesktopCheatingType : byte
{
    VIRTUAL_MACHINE_BIOS = 30,           // BIOS / DMI strings indicate a VM vendor.
    VIRTUAL_MACHINE_MAC = 31,            // A MAC address belongs to a known VM vendor OUI.
    VIRTUAL_MACHINE_HYPERVISOR_BIT = 32, // Another virtual-machine sign was found. Only available on some systems.
    VIRTUAL_MACHINE_PROCESS = 33         // A VM guest-additions process is running.
}

Threat rating and false positives

  • PossibilityOfFalsePositive: default 0.15 (range 0 to 1). This is higher on purpose. Many honest players use Hyper-V, WSL, or a cloud PC.
  • ThreatRating: default 200 (recommended 200). Raise it only if your game must not run in a virtual machine.

Configuration

  • Is Active (isActive, bool, default true): Turns the detector on or off.
  • Possibility Of False Positive (possibilityOfFalsePositive, float, default 0.15, range 0 to 1).
  • Threat Rating (threatRating, uint, default 200).
  • On Cheating Detection Event (OnCheatingDetectionEvent): Functions to call when a virtual machine is found.
  • Check Only On Game Start (CheckOnlyOnGameStart, bool, default true): On means check once. Off means check again on the interval. A virtual machine rarely appears in the middle of a session.
  • Recheck Interval For Possible Cheating (RecheckIntervalForPossibleCheating, float, default 120, range 1 to 600): Seconds between checks.

The address list and the text list are in Project Settings.

Supported platforms

Windows, macOS, and Linux standalone players. The network-adapter check runs on all three. The BIOS text check and the other signs are only available on some systems.

Requirements

No extra plugin. In the Editor and in development builds, the detector runs only when Desktop_Enable_Development is on.

False alarms

This is the desktop check most likely to be wrong. Developers, testers, cloud players, and some work laptops use a virtual machine on purpose. Do not close the game on this check alone. Flag the session, lower trust, or turn off a leaderboard. The threat rating lets you keep the reaction soft.

How to use

Add VirtualEnvironmentDetector as a child of the AntiCheat-Monitor. The monitor prefab already includes it. Set the Desktop tab. Then choose a soft reaction.

Add the component

Add VirtualEnvironmentDetector from GUPS.AntiCheat.Detector.Desktop. A child of the monitor is the best place. No extra monitor is needed.

Add the VirtualEnvironmentDetector component.

Settings

The virtual-machine detector settings, shown with the debugger detector.

  • General Settings: Turn the detector on or off.
  • Threat Rating Settings: How serious one find is.
  • Observable Settings: Functions to call when cheating is found.
  • Virtual Environment Settings: Check once at start, or again on an interval.

Runtime

On start, and again on the interval, the detector checks network adapter addresses, BIOS text, and other virtual-machine signs. You can also call ManualScan().

Desktop settings

Open Edit > Project Settings > GuardingPearSoftware > AntiCheat and switch to the Desktop tab.

Virtual machine settings.

  • Enable in Development (Desktop_Enable_Development): On means the check also runs in the Editor and in development builds. Off by default.
  • Detect Virtual Machine (Desktop_DetectVirtualMachine): Master switch. On by default.
  • Virtual Machine MAC OUIs (Desktop_VirtualMachine_MacOuis): The first three bytes of adapter addresses that belong to virtual-machine vendors. Letter case does not matter. Separators are optional, such as 080027, 08-00-27, or 08:00:27.
  • Virtual Machine BIOS Keywords (Desktop_VirtualMachine_BiosKeywords): Words to look for in BIOS text. Letter case does not matter. Examples: VirtualBox, VMware, Hyper-V, QEMU, Xen, Parallels.

If a list is empty, the detector uses a built-in list of well-known vendors.

Read the detection in code

You can also listen yourself. Cast the status to DesktopCheatingDetectionStatus to read the desktop fields.

using System;
using GUPS.AntiCheat;
using GUPS.AntiCheat.Core.Detector;
using GUPS.AntiCheat.Detector.Desktop;
using UnityEngine;

public class VirtualEnvironmentDetectionLogger : MonoBehaviour, IObserver<IDetectorStatus>
{
    private void Start()
    {
        var detector = AntiCheatMonitor.Instance.GetDetector<VirtualEnvironmentDetector>();
        detector.Subscribe(this);
    }

    public void OnNext(IDetectorStatus status)
    {
        if (status is DesktopCheatingDetectionStatus desktopStatus)
        {
            Debug.LogWarning($"Virtual environment detected: {desktopStatus.DesktopCheatingType} " +
                             $"(threat={desktopStatus.ThreatRating}, evidence={desktopStatus.Evidence}).");
        }
    }

    public void OnError(Exception error) { }
    public void OnCompleted() { }
}

React when a cheat is found

The detector tells the AntiCheat-Monitor. The monitor adds the report to the threat score.

Punisher. Add a punisher prefab as a child of the monitor. It runs when the score reaches its limit.

Built-in punisher prefabs.

Inspector. Add a function to On Cheating Detection Event. It runs when this detector finds a cheat.

Code.

var detector = AntiCheatMonitor.Instance
      .GetDetector<VirtualEnvironmentDetector>();

detector.Subscribe(myObserver);

PossibleCheatingDetected stays true after the first find.