Questions tagged [virtual-machines]
Software-based simulation or emulation of a hardware platform (CPU and hardware devices). Famous examples of virtual-machines are VMware, QEMU, VirtualBox, Microsoft Hyper-V, ...
38
questions
1
vote
0
answers
21
views
Detect what app uses a comport - potentially for a vmware escape via a comport/named pipe ntoskrnl
How could I diagnose if this named pipe that goes to com1 in vmware (now to a txt file) is malware or a legitimate piece of software?
Are there anyways to track what sends data to a comport in windows ...
- 263
0
votes
0
answers
70
views
Why is Windows 10 still blocking me from running malware?
I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
- 131
2
votes
0
answers
182
views
How can i Lifting x86_64 assembly code to LLVM-IR
I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting ...
- 21
1
vote
0
answers
234
views
ReadProcessMemory from host to Hyper-V Windows Guest VM
Is it possible to use ReadProcessMemory or some other form of it maybe via a library to read memory from a virtual machine running inside Hyper-V?
The host is running Windows 11 the Guest is running ...
- 11
1
vote
1
answer
94
views
How to capture control flow pins on emulated serial port?
I am reverse engineering how a CPS software package communicates to a radio device. I have the basics down, and want to trick the software into thinking COM1 is the radio, when in reality I want to ...
- 271
1
vote
0
answers
288
views
pick dump from a specific process from virtualbox coredump
i'm interested in reverse engineering and assembly stuff i have started to do some research and im still a complete beginner
what i have learned so far that we could use virtualbox to dump the RAM ...
- 21
2
votes
2
answers
4k
views
Virtual machine code obfuscation implementation details
I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is ...
- 123
3
votes
0
answers
992
views
How to use Ghidra to work with VM obfuscated binaries?
By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
- 474
1
vote
1
answer
207
views
How to track/debug/manipulate Windows processes in a VM?
I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization.
Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
- 179
1
vote
1
answer
214
views
Difficulty obtaining malware traffic
I'm trying to get a particular piece of malware to beacon, and I have my box connected to remnux, with inetsim and fakedns running. Using this setup I have been able to acquire good pcap from most ...
- 173
3
votes
1
answer
552
views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
- 163
4
votes
3
answers
918
views
Debugging a process running in a Virtual Machine with Radare2?
Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a built in debugger. I'm not sure if it's possible for ...
- 1,789
1
vote
0
answers
121
views
Is there any way to capture the state of an application so as to restore execution of it later?
There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt ...
- 2,254
4
votes
1
answer
3k
views
What are the steps to reverse engineering a Shockwave .DCR file?
I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
- 143
0
votes
1
answer
1k
views
IDA Pro v7 installation problem in VM
I have different problem.
I created VM (windows7x86SP1) with VMware Fusion on Mac OSX. When I try to install IDA Pro, I have a such a error. But I couldn't find any solution. I removed VM than ...
- 11
-1
votes
1
answer
2k
views
VMProtect keygen, turn off the anti-debugging
who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
- 141
3
votes
1
answer
2k
views
How to deal with heavy control flow flattening?
I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to ...
- 263
1
vote
2
answers
124
views
Test malware files in host machine?
To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly.
I want to know how to test malware files with out ...
- 121
5
votes
2
answers
417
views
What are some ways in which virtual machines make native static and dynamic reversing of a binary more difficult?
It is practically common knowledge in reverse engineering that trying to use a native debugger or disassembler on a "VM protected" or virtualized program is much more difficult to analyze. However, I ...
- 1,880
3
votes
2
answers
2k
views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
- 51
1
vote
2
answers
2k
views
Anti-VM and anti-sandbox malware samples
I'm learning malware analysis.
I'm looking for malware samples that terminate themselves when recognize working on a VM or sandbox.
Thanks.
- 11
2
votes
1
answer
3k
views
How to connect two Windows VMWare virtual machines over a virtual serial port for kernel debugging on a Linux host
The problem: Recently I had to perform a kernel debugging on two MS windows VMWare virtual machines connected via a virtual serial port, and while running on a GNU/Linux host.
The layout: GNU/Linux ...
- 196
3
votes
1
answer
2k
views
Kernel debugging between two virtual machines not working
i want to do kernel debugging on my vm from another vm.
My setup is pretty simple,
Debugged - VM:
Windows XP SP3 x32 (To be debugged)
Debugger - VM:
Windows 7 SP1 x64 (With Windbg installed - the ...
- 668
2
votes
2
answers
2k
views
how do I debug full screen applications
I need to debug an old (1999) full screen application. When I window the application and attach olly the program crashes.
I have heard of remote debugging. Would running the program on a VM and then ...
- 183
5
votes
3
answers
13k
views
Kernel debugging - how to set breakpoint at DriverEntry?
I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
- 53
1
vote
1
answer
108
views
How does one leverage VTx to disable screen capture?
I came across this cool feature while playing around with Kaspersky '15. Basically, when you launch a "Smart Money" Protected Browser (this browser is just a modified, clean install of Chrome), if ...
- 11
1
vote
0
answers
2k
views
Emulating a sentinel c-plus security dongle to attach to a virtual machine
My company has an ancient payroll system that we want to virtualise so that it can be preserved for legal reasons. The software runs on an operating system called THEOS.
We've run into a bit of a snag....
- 111
1
vote
3
answers
480
views
Detect specific algorithms running in a virtual machine via behavior analysis
Let us suppose that I have a program that perform some well known cryptographic routines like AES, RSA or whatever. I would like to detect when such algorithms run, on which key material and possibly ...
0
votes
1
answer
711
views
Saving Kik conversations using VirtualBox Android device [closed]
I'm using a virtual Android device on VirtualBox to chat using
Kik. Kik doesn't officially support saving conversations, but can I do
it using my setup?
My thoughts: when I take a snapshot of Andy ...
user10070
0
votes
1
answer
125
views
Setting up virtual machine to recover from malware
I'm running two virtual machines with Windows 7 (host OS Mac) using Virtualbox which I'd like to use to analyze malware. I have configured Visual Studio debugging and WinDBG, as well as other tools.
...
- 474
2
votes
2
answers
2k
views
Debugging Virtual Machine using Windbg
I am trying to connect to a Windows XP Professional Virtual Machine running under Microsoft Virtual PC for debugging purposes.
I was following the MSDN kernel mode debugging article, however bcdedit ...
- 143
2
votes
2
answers
914
views
osx + IDA + virtualbox, keyboard mapping for "Insert"
I use the free version of IDA and I'm trying to define structs. Unfortunately, I'm using Windows XP as a VM on OSX and am having trouble remapping Insert to something else.
I'm hoping someone has ...
user1743
5
votes
2
answers
5k
views
Can IDA Pro automatically deal with VM obfuscated binaries?
VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro.
According to this slides
www.hex-rays.com/products/ida/...
- 2,485
5
votes
1
answer
2k
views
Using a VMM/hypervisor to monitor guest OS execution?
I would like to set up a virtual machine monitor using Microsoft Hyper-V, VMware vSphere/ESX, Xen, or any other alternative hypervisor solution that is able to monitor the execution of a guest OS (a ...
- 53
12
votes
1
answer
352
views
Virtual Machine escape through page faults
The trapcc project on Github by Sergey Bratus and Julian Bangert claims that using the Turing complete capabilities of x86 MMU it is possible for a code to escape the virtual machine using a single ...
- 784
13
votes
5
answers
2k
views
Malware in virtual machines
Once I perform static analysis on a malware sample, I next run it in a virtual machine.
Does this give the malware a chance to spread to the real machine?
Does this give the malware a chance to ...
- 437
19
votes
8
answers
28k
views
How to detect a virtualized environment?
What are the different ways for a program to detect that it executes inside a virtualized environment ? And, would it be possible to detect what kind of virtualization is used ?
- 19.2k
67
votes
4
answers
6k
views
How can I analyze a potentially harmful binary safely?
I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
- 1,485