check dmi table may cause misjudgement

[chenxinlong]

VM-Detection/vmdetect/linux.go

Lines 19 to 32 in 4fd05cb

	blacklistDMI := []string{
	"innotek",
	"virtualbox",
	"vbox",
	"kvm",
	"qemu",
	"vmware",
	"vmw",
	"oracle",
	"xen",
	"bochs",
	"parallels",
	"bhyve",
	}

DMI id may contains xen string, but I'm sure it is not a virtual machine :

root@node1:~# cat /sys/class/dmi/id/board_serial
07V122XEN6001010

[ShellCode33]

Thanks for your feedback, it seems to be a tricky situation that would require some thinking.
Unfortunately I don't have time to maintain this. However I'd be more than happy to review and merge any PR you submit.

[chenxinlong]

I noticed that there's many conditions to check if is running in a virtual machine, can I say remove the checkDMITable() check condition still makes IsRunningInVirtualMachine() reliable ?

VM-Detection/vmdetect/linux.go

Lines 167 to 214 in 4fd05cb

	/*
	Public function returning true if a VM is detected.
	If so, a non-empty string is also returned to tell how it was detected.
	*/
	func IsRunningInVirtualMachine() (bool, string) {
	if currentUser, _ := user.Current(); currentUser != nil && currentUser.Uid != "0" {
	PrintWarning("Unprivileged user detected, some techniques might not work")
	}
	if vmDetected, how := CommonChecks(); vmDetected {
	return vmDetected, how
	}
	if checkKernelModules() {
	return true, "Kernel module (/proc/modules)"
	}
	if checkUML() {
	return true, "CPU Vendor (/proc/cpuinfo)"
	}
	if checkSysInfo() {
	return true, "System Information (/proc/sysinfo)"
	}
	if checkDMITable() {
	return true, "DMI Table (/sys/class/dmi/id/*)"
	}
	if checkKernelRingBuffer() {
	return true, "Kernel Ring Buffer (/dev/kmsg)"
	}
	if checkDeviceTree() {
	return true, "VM device tree (/proc/device-tree)"
	}
	if checkHypervisorType() {
	return true, "Hypervisor type file (/sys/hypervisor/type)"
	}
	if checkXenProcFile() {
	return true, "Xen proc file (/proc/xen)"
	}
	return false, "nothing"
	}

[ShellCode33]

Yes you can remove it on your end if you want, it will still detect most of the usual stuff. I don't want to completely remove it here though. The "real" solution might be to perform a case-sensitive comparison with Xen instead.