Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [virtual-machines]

Software-based simulation or emulation of a hardware platform (CPU and hardware devices). Famous examples of virtual-machines are VMware, QEMU, VirtualBox, Microsoft Hyper-V, ...

0
votes
2answers
56 views

Debugging a process running in a Virtual Machine with Radare2?

Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a built in debugger. I'm not sure if it's possible for ...
1
vote
0answers
42 views

Is there any way to capture the state of an application so as to restore execution of it later?

There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt ...
3
votes
1answer
86 views

What are the steps to reverse engineering a Shockwave .DCR file?

I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
0
votes
1answer
188 views

IDA Pro v7 installation problem in VM

I have different problem. I created VM (windows7x86SP1) with VMware Fusion on Mac OSX. When I try to install IDA Pro, I have a such a error. But I couldn't find any solution. I removed VM than ...
-1
votes
1answer
474 views

VMProtect keygen, turn off the anti-debugging

who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
3
votes
1answer
288 views

How to deal with heavy control flow flattening?

I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to ...
1
vote
2answers
76 views

Test malware files in host machine?

To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly. I want to know how to test malware files with out ...
6
votes
2answers
285 views

What are some ways in which virtual machines make native static and dynamic reversing of a binary more difficult?

It is practically common knowledge in reverse engineering that trying to use a native debugger or disassembler on a "VM protected" or virtualized program is much more difficult to analyze. However, I ...
3
votes
2answers
581 views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
1
vote
2answers
935 views

Anti-VM and anti-sandbox malware samples

I'm learning malware analysis. I'm looking for malware samples that terminate themselves when recognize working on a VM or sandbox. Thanks.
2
votes
1answer
2k views

How to connect two Windows VMWare virtual machines over a virtual serial port for kernel debugging on a Linux host

The problem: Recently I had to perform a kernel debugging on two MS windows VMWare virtual machines connected via a virtual serial port, and while running on a GNU/Linux host. The layout: GNU/Linux ...
2
votes
1answer
1k views

Kernel debugging between two virtual machines not working

i want to do kernel debugging on my vm from another vm. My setup is pretty simple, Debugged - VM: Windows XP SP3 x32 (To be debugged) Debugger - VM: Windows 7 SP1 x64 (With Windbg installed - the ...
1
vote
2answers
791 views

how do I debug full screen applications

I need to debug an old (1999) full screen application. When I window the application and attach olly the program crashes. I have heard of remote debugging. Would running the program on a VM and then ...
4
votes
3answers
6k views

Kernel debugging - how to set breakpoint at DriverEntry?

I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
1
vote
1answer
102 views

How does one leverage VTx to disable screen capture?

I came across this cool feature while playing around with Kaspersky '15. Basically, when you launch a "Smart Money" Protected Browser (this browser is just a modified, clean install of Chrome), if ...
0
votes
0answers
1k views

Emulating a sentinel c-plus security dongle to attach to a virtual machine

My company has an ancient payroll system that we want to virtualise so that it can be preserved for legal reasons. The software runs on an operating system called THEOS http://www.theos-software.com/ ...
1
vote
3answers
382 views

Detect specific algorithms running in a virtual machine via behavior analysis

Let us suppose that I have a program that perform some well known cryptographic routines like AES, RSA or whatever. I would like to detect when such algorithms run, on which key material and possibly ...
0
votes
1answer
597 views

Saving Kik conversations using VirtualBox Android device [closed]

I'm using a virtual Android device on VirtualBox to chat using Kik. Kik doesn't officially support saving conversations, but can I do it using my setup? My thoughts: when I take a snapshot of Andy ...
0
votes
1answer
112 views

Setting up virtual machine to recover from malware

I'm running two virtual machines with Windows 7 (host OS Mac) using Virtualbox which I'd like to use to analyze malware. I have configured Visual Studio debugging and WinDBG, as well as other tools. ...
2
votes
2answers
2k views

Debugging Virtual Machine using Windbg

I am trying to connect to a Windows XP Professional Virtual Machine running under Microsoft Virtual PC for debugging purposes. I was following the MSDN kernel mode debugging article, however bcdedit ...
2
votes
2answers
598 views

osx + IDA + virtualbox, keyboard mapping for “Insert”

I use the free version of IDA and I'm trying to define structs. Unfortunately, I'm using Windows XP as a VM on OSX and am having trouble remapping Insert to something else. I'm hoping someone has ...
4
votes
1answer
3k views

Can IDA Pro automatically deal with VM obfuscated binaries?

VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro. According to this slides www.hex-rays.com/products/ida/...
5
votes
1answer
1k views

Using a VMM/hypervisor to monitor guest OS execution?

I would like to set up a virtual machine monitor using Microsoft Hyper-V, VMware vSphere/ESX, Xen, or any other alternative hypervisor solution that is able to monitor the execution of a guest OS (a ...
11
votes
1answer
286 views

Virtual Machine escape through page faults

The trapcc project on Github by Sergey Bratus and Julian Bangert claims that using the Turing complete capabilities of x86 MMU it is possible for a code to escape the virtual machine using a single ...
11
votes
5answers
2k views

Malware in virtual machines

Once I perform static analysis on a malware sample, I next run it in a virtual machine. Does this give the malware a chance to spread to the real machine? Does this give the malware a chance to ...
19
votes
8answers
18k views

How to detect a virtualized environment?

What are the different ways for a program to detect that it executes inside a virtualized environment ? And, would it be possible to detect what kind of virtualization is used ?
62
votes
4answers
4k views

How can I analyze a potentially harmful binary safely?

I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...