Questions tagged [virtual-machines]

Software-based simulation or emulation of a hardware platform (CPU and hardware devices). Famous examples of virtual-machines are VMware, QEMU, VirtualBox, Microsoft Hyper-V, ...

Filter by
Sorted by
Tagged with
64 votes
4 answers

How can I analyze a potentially harmful binary safely?

I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
user avatar
  • 1,425
5 votes
2 answers

Can IDA Pro automatically deal with VM obfuscated binaries?

VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro. According to this slides
user avatar
19 votes
8 answers

How to detect a virtualized environment?

What are the different ways for a program to detect that it executes inside a virtualized environment ? And, would it be possible to detect what kind of virtualization is used ?
user avatar
  • 18.1k
12 votes
5 answers

Malware in virtual machines

Once I perform static analysis on a malware sample, I next run it in a virtual machine. Does this give the malware a chance to spread to the real machine? Does this give the malware a chance to ...
user avatar
  • 417
3 votes
2 answers

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
user avatar
  • 51
4 votes
3 answers

Debugging a process running in a Virtual Machine with Radare2?

Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a built in debugger. I'm not sure if it's possible for ...
user avatar
  • 1,664
3 votes
1 answer

custom virtual machine protection

How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
user avatar
  • 163
3 votes
0 answers

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
user avatar