Desktop - Virtual Environment - Detector (Pro)

A frequent cheating pattern on desktop is running your game inside a virtual machine (e.g. VMware, VirtualBox, Hyper-V, QEMU/KVM, Parallels) to ease memory inspection, snapshot and rewind game state, or run automation farms. Use the 'VirtualEnvironmentDetector' to detect a virtualized host and react accordingly.

Detector

The 'VirtualEnvironmentDetector' does not require any monitor. On demand, it performs three independent scans:

  1. MAC address OUI scan: Iterates 'NetworkInterface.GetAllNetworkInterfaces()' and checks the OUI prefix (the first three bytes of each adapter's MAC address) against the configured list of vendor OUIs (e.g. '08:00:27' VirtualBox, '00:0C:29' / '00:50:56' VMware, '00:15:5D' Hyper-V, '52:54:00' QEMU/KVM, '00:1C:42' Parallels).

  2. BIOS / DMI string scan: Asks the platform-specific 'IPlatformProbe.IsRunningInVirtualMachine'. On Windows this reads HKLM 'HARDWARE\DESCRIPTION\System\BIOS' (vendor, version, system manufacturer, system product) and probes well-known guest service registry keys (e.g. VBoxService, vmtools) using direct 'advapi32.dll' P/Invokes. On macOS it queries 'sysctlbyname' for 'hw.model' and related identifiers. On Linux it reads '/sys/class/dmi/id/sys_vendor', 'product_name', 'bios_vendor', and 'board_vendor'.

  3. Hypervisor bit: Asks the platform-specific 'IPlatformProbe.IsHypervisorBitSet'. On Linux this checks for the 'hypervisor' flag in '/proc/cpuinfo'. On Windows and macOS this is currently a no-op and reserved for a future native plugin probe that reads CPUID directly.

Observed Subject

The detector does not observe any monitor. It runs an on-demand scan when 'ManualScan()' is invoked or, if enabled, automatically during 'Start' and on a configurable interval.

Detector Status

When a virtual environment is found, the detector notifies its observers with a 'DesktopCheatingDetectionStatus' which implements 'IDesktopCheatingDetectionStatus'. The status contains the following properties:

  1. PossibilityOfFalsePositive: A value indicating the possibility of a false positive when assessing threats for the implementing subject, from 0.0 to 1.0.
  2. ThreatRating: The threat rating associated with the detected cheating, indicating the assessed level of a potential threat.
  3. DesktopCheatingType: The type of cheating detected on the desktop platform.
  4. Evidence: A short, human-readable string describing what triggered the detection (e.g. the matching OUI, BIOS value, or service key).

The 'DesktopCheatingType' property can take the following values for this detector:

  • VIRTUAL_MACHINE_BIOS: The system BIOS / DMI strings indicate a virtual machine vendor.
  • VIRTUAL_MACHINE_MAC: A network interface MAC address belongs to a known virtual machine vendor OUI.
  • VIRTUAL_MACHINE_HYPERVISOR_BIT: The CPUID hypervisor present bit is set, indicating the OS runs inside a hypervisor.
  • VIRTUAL_MACHINE_PROCESS: A process belonging to a virtual machine guest additions package was found running on the system.

Supported Platforms

The detector is available on Windows, macOS, and Linux Standalone players. The MAC OUI scan is fully cross-platform. The BIOS/DMI scan uses platform-specific probes. The hypervisor-bit probe is currently effective on Linux; Windows and macOS coverage is reserved for a future native plugin.

Requirements

There are no native requirements; the detector uses managed APIs and platform P/Invokes provided by the package. In the Unity Editor and in Development Builds, the detector only runs when 'Desktop_Enable_Development' is enabled in the global AntiCheat settings.

False Positives

VM detection is the most false-positive-prone of the desktop detectors: many legitimate users (developers, QA, cloud-streaming providers, security-conscious players, corporate laptops with Hyper-V enabled) run inside virtual environments. We recommend pairing this detector with a soft reaction (e.g. flag the session, reduce trust score, disable leaderboards) rather than immediately exiting the game. The 'PossibilityOfFalsePositive' value reflects this, and the configurable threat rating lets you tune severity.

How To Use

The usage is straightforward: attach a 'VirtualEnvironmentDetector' to a child GameObject of the 'AntiCheat-Monitor', configure the global Desktop settings, and define a reaction to detected cheating.

Requirements

There are none. No additional monitor is required.

Add Detector Component

Manual

Add the 'VirtualEnvironmentDetector' MonoBehavior from the 'GUPS.AntiCheat.Detector.Desktop' namespace to your 'AntiCheat-Monitor' GameObject, or better, to a child GameObject.

Settings

After attaching the 'VirtualEnvironmentDetector' MonoBehavior to a GameObject, you will see the following in the inspector:

  • General Settings: Define here whether the detector should be active.
  • Threat Rating Settings: Define here the severity of the detected cheating.
  • Observable Settings: Add here callbacks invoked when cheating is detected.
  • Scan Settings: Set whether the scan runs once on Start and/or repeats on a configurable interval.

Runtime

On Start (and on the configured interval), the detector runs the OUI, BIOS/DMI, and hypervisor-bit checks and notifies observers if a virtual environment is found. You can also trigger 'ManualScan()' yourself.

Configure Desktop Settings

Open 'Edit -> Project Settings -> GuardingPearSoftware -> AntiCheat' and switch to the 'Desktop' tab.

In the AntiCheat Project Settings, configure the Desktop virtual environment detection.

Use the following entries to control this detector:

  • Enable in Development: 'Desktop_Enable_Development'. Set to true to allow detection inside the Unity Editor and Development Builds. Off by default.
  • Detect Virtual Machine: 'Desktop_DetectVirtualMachine'. Master switch for this detector. On by default.
  • Virtual Machine MAC OUIs: 'Desktop_VirtualMachine_MacOuis'. List of case-insensitive MAC address OUIs (first three bytes), with or without separators (e.g. '080027', '08-00-27', '08:00:27'). Used to identify VM-vendor network adapters.
  • Virtual Machine BIOS Keywords: 'Desktop_VirtualMachine_BiosKeywords'. List of case-insensitive substrings to look for in BIOS / DMI strings (e.g. 'VirtualBox', 'VMware', 'Hyper-V', 'QEMU', 'Xen', 'Parallels').

When any of these lists is empty, the detector falls back to a built-in default list of well-known virtualization vendors.

React On Cheating

When the detector is set up, you surely want to react to detected cheating.

Punisher

In general, any cheat detected is forwarded to the 'AntiCheat-Monitor', which calculates an overall threat level. Based on the threat level, you can apply punishments by using Punisher components added to a child GameObject of the 'AntiCheat-Monitor'. There are some built-in punishers that you can find here as prefabs:

The location of the built-in Punisher prefabs.

Inspector

You can set a callback in the Unity Inspector view of the detector. This callback is invoked as soon as the specific cheating is detected.

Code

If you would like to write a custom listener for the detector, you can attach an observer:

// Get the detector.
var detector = AntiCheatMonitor.Instance
      .GetDetector<VirtualEnvironmentDetector>();

// Subscribe as observer and get notified on inconsistency.
detector.Subscribe(myObserver);

The detector also has an inherited property 'PossibleCheatingDetected' which is set to true once cheating has been detected.