Skip to content

Conversation

@IgorKorkin
Copy link
Contributor

Remove outdated CPUID timing check on modern Windows rdtsc_diff_vmexit due to false positive.

  • Tested Al-Khaser on Windows 25H2 and 26H1 (regular modern laptop, non-sandbox environment).
  • On Windows 11 25H2/26H1, virtualization-based security (VBS) and Hyper-V are enabled by default on typical clean installs, placing a hypervisor layer under the OS even on bare-metal laptops.
  • In this configuration, CPUID is trapped by the Windows hypervisor, so CPUID timing (rdtsc_diff_vmexit) reports a “virtualized” environment on non-sandbox systems.
  • This check is outdated and misleading — it undermines the credibility of Al-Khaser’s detection results on modern Windows systems.
  • To maintain accuracy and relevance, this check has been disabled from active test sets.
  • Applied code style formatting.

Note: Two new detection techniques will be added in the next pull requests, so this removal will be compensated by fresh, more reliable checks.

26H1-results-al-khaser_x64.txt
26H1-Get-ComputerInfo.txt
26H1-systeminfo.txt

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant