Questions tagged [virtual-machines]

Software-based simulation or emulation of a hardware platform (CPU and hardware devices). Famous examples of virtual-machines are VMware, QEMU, VirtualBox, Microsoft Hyper-V, ...

Filter by
Sorted by
Tagged with
64 votes
4 answers
5k views

How can I analyze a potentially harmful binary safely?

I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
user avatar
  • 1,425
19 votes
8 answers
26k views

How to detect a virtualized environment?

What are the different ways for a program to detect that it executes inside a virtualized environment ? And, would it be possible to detect what kind of virtualization is used ?
user avatar
  • 18.1k
12 votes
5 answers
2k views

Malware in virtual machines

Once I perform static analysis on a malware sample, I next run it in a virtual machine. Does this give the malware a chance to spread to the real machine? Does this give the malware a chance to ...
user avatar
  • 417
11 votes
1 answer
334 views

Virtual Machine escape through page faults

The trapcc project on Github by Sergey Bratus and Julian Bangert claims that using the Turing complete capabilities of x86 MMU it is possible for a code to escape the virtual machine using a single ...
user avatar
  • 734
5 votes
2 answers
5k views

Can IDA Pro automatically deal with VM obfuscated binaries?

VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro. According to this slides www.hex-rays.com/products/ida/...
user avatar
5 votes
3 answers
11k views

Kernel debugging - how to set breakpoint at DriverEntry?

I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
user avatar
5 votes
1 answer
2k views

Using a VMM/hypervisor to monitor guest OS execution?

I would like to set up a virtual machine monitor using Microsoft Hyper-V, VMware vSphere/ESX, Xen, or any other alternative hypervisor solution that is able to monitor the execution of a guest OS (a ...
user avatar
5 votes
2 answers
369 views

What are some ways in which virtual machines make native static and dynamic reversing of a binary more difficult?

It is practically common knowledge in reverse engineering that trying to use a native debugger or disassembler on a "VM protected" or virtualized program is much more difficult to analyze. However, I ...
user avatar
  • 1,625
4 votes
1 answer
2k views

What are the steps to reverse engineering a Shockwave .DCR file?

I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
user avatar
4 votes
3 answers
724 views

Debugging a process running in a Virtual Machine with Radare2?

Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a built in debugger. I'm not sure if it's possible for ...
user avatar
  • 1,664
3 votes
2 answers
2k views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
user avatar
  • 51
3 votes
1 answer
398 views

custom virtual machine protection

How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
user avatar
  • 163
3 votes
1 answer
2k views

Kernel debugging between two virtual machines not working

i want to do kernel debugging on my vm from another vm. My setup is pretty simple, Debugged - VM: Windows XP SP3 x32 (To be debugged) Debugger - VM: Windows 7 SP1 x64 (With Windbg installed - the ...
user avatar
  • 658
3 votes
1 answer
1k views

How to deal with heavy control flow flattening?

I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to ...
user avatar
  • 253
3 votes
0 answers
614 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
user avatar
2 votes
2 answers
2k views

Debugging Virtual Machine using Windbg

I am trying to connect to a Windows XP Professional Virtual Machine running under Microsoft Virtual PC for debugging purposes. I was following the MSDN kernel mode debugging article, however bcdedit ...
user avatar
2 votes
2 answers
1k views

Virtual machine code obfuscation implementation details

I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is ...
user avatar
  • 93
2 votes
2 answers
2k views

how do I debug full screen applications

I need to debug an old (1999) full screen application. When I window the application and attach olly the program crashes. I have heard of remote debugging. Would running the program on a VM and then ...
user avatar
  • 183
2 votes
1 answer
3k views

How to connect two Windows VMWare virtual machines over a virtual serial port for kernel debugging on a Linux host

The problem: Recently I had to perform a kernel debugging on two MS windows VMWare virtual machines connected via a virtual serial port, and while running on a GNU/Linux host. The layout: GNU/Linux ...
user avatar
  • 186
2 votes
2 answers
870 views

osx + IDA + virtualbox, keyboard mapping for "Insert"

I use the free version of IDA and I'm trying to define structs. Unfortunately, I'm using Windows XP as a VM on OSX and am having trouble remapping Insert to something else. I'm hoping someone has ...
user avatar
1 vote
2 answers
2k views

Anti-VM and anti-sandbox malware samples

I'm learning malware analysis. I'm looking for malware samples that terminate themselves when recognize working on a VM or sandbox. Thanks.
user avatar
1 vote
2 answers
115 views

Test malware files in host machine?

To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly. I want to know how to test malware files with out ...
user avatar
  • 121
1 vote
3 answers
455 views

Detect specific algorithms running in a virtual machine via behavior analysis

Let us suppose that I have a program that perform some well known cryptographic routines like AES, RSA or whatever. I would like to detect when such algorithms run, on which key material and possibly ...
user avatar
1 vote
1 answer
29 views

How to capture control flow pins on emulated serial port?

I am reverse engineering how a CPS software package communicates to a radio device. I have the basics down, and want to trick the software into thinking COM1 is the radio, when in reality I want to ...
user avatar
1 vote
1 answer
99 views

How to track/debug/manipulate Windows processes in a VM?

I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization. Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
user avatar
  • 179
1 vote
1 answer
153 views

Difficulty obtaining malware traffic

I'm trying to get a particular piece of malware to beacon, and I have my box connected to remnux, with inetsim and fakedns running. Using this setup I have been able to acquire good pcap from most ...
user avatar
  • 153
1 vote
1 answer
107 views

How does one leverage VTx to disable screen capture?

I came across this cool feature while playing around with Kaspersky '15. Basically, when you launch a "Smart Money" Protected Browser (this browser is just a modified, clean install of Chrome), if ...
user avatar
1 vote
0 answers
64 views

ReadProcessMemory from host to Hyper-V Windows Guest VM

Is it possible to use ReadProcessMemory or some other form of it maybe via a library to read memory from a virtual machine running inside Hyper-V? The host is running Windows 11 the Guest is running ...
user avatar
  • 11
1 vote
0 answers
148 views

pick dump from a specific process from virtualbox coredump

i'm interested in reverse engineering and assembly stuff i have started to do some research and im still a complete beginner what i have learned so far that we could use virtualbox to dump the RAM ...
user avatar
  • 11
1 vote
0 answers
83 views

Is there any way to capture the state of an application so as to restore execution of it later?

There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt ...
user avatar
  • 2,154
1 vote
0 answers
2k views

Emulating a sentinel c-plus security dongle to attach to a virtual machine

My company has an ancient payroll system that we want to virtualise so that it can be preserved for legal reasons. The software runs on an operating system called THEOS. We've run into a bit of a snag....
user avatar
  • 111
0 votes
1 answer
820 views

IDA Pro v7 installation problem in VM

I have different problem. I created VM (windows7x86SP1) with VMware Fusion on Mac OSX. When I try to install IDA Pro, I have a such a error. But I couldn't find any solution. I removed VM than ...
user avatar
  • 11
0 votes
1 answer
702 views

Saving Kik conversations using VirtualBox Android device [closed]

I'm using a virtual Android device on VirtualBox to chat using Kik. Kik doesn't officially support saving conversations, but can I do it using my setup? My thoughts: when I take a snapshot of Andy ...
user avatar
0 votes
1 answer
124 views

Setting up virtual machine to recover from malware

I'm running two virtual machines with Windows 7 (host OS Mac) using Virtualbox which I'd like to use to analyze malware. I have configured Visual Studio debugging and WinDBG, as well as other tools. ...
user avatar
  • 474
-1 votes
1 answer
1k views

VMProtect keygen, turn off the anti-debugging

who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
user avatar