WineDetector

Detect if user uses wine using various methods

linux wine output:

linux portproton output:

windows output (thanks Belka):

Methods

Drives test

If you open wine file manager you can find drive with letter Z: which have your linux fs on it This checker checks if user have drive Z with folder bin on it

Registry test

Wine has many register keys so it's easy to detect it

Services test

You can notice that wine creates services with name WinedeviceX

Process test

Sometimes winedevice.exe can be found on wine (for me it works only in portproton)

Files test

C:\windows\syswow64\wineboot.exe - it's all what you need to know

DLL Exports Test

Thanks to shavitush for this information about this

Some system dlls have suspicious exports:

• ntdll.dll!wine_get_version
• ntdll.dll!wine_get_host_version
• kernel32.dll!wine_get_unix_file_name
• .. and others