The title mentions "sandbox" but VMWare or QEMU is usually not called that, so the question seems to be more about "how do I analyze it without a danger of infection?"
There are three broad categories of tools and approaches you could take here.
1. User-mode sandboxes
A user-mode sandbox basically runs the sample being investigated but intercepts all or ...
Bochs if you don't need speed but lots of flexibility. You can use Bochs with GDB.
Qemu if you need more speed and less flexibility (it does dynamic translation so you gain bit of speed but lose the acutal sequence of the instructions) possibly a bit less safe than bochs. Its similar to Vmware and virtualbox actually derives from it. You can use GDB with ...
You may capture the traffic with packet sniffer to capture all the communications of client\server application, or You may use reverse proxy to intercept and alter data in real time.
In simple words, network sniffers allow You to see data flow between client and server, analyse it and reverse the protocol communications
Reverse proxy intercept communication ...
Gilles provided some great links and I want to discuss the use a virtual machines for malware analysis a bit more. While a VM breakout certainly is a possibility, I have yet to come across such a case or even heard about one and I assume this would make some buzz should someone find one. To be safe, simply run your VM software on an isolated computer and ...
Let's make a couple of assumptions. Software is divided into functional components. Licenses are for functional components within that software package. Licenses can be based on time, on version or on a number of uses, i.e you may use the functionality until a set point in time, you may the functionality of the version you purchased or ...
Clearly Peter has addressed the main points of proper implementation. Given that I have - without publishing the results - "cracked" two different dongle systems in the past, I'd like to share my insights as well. user276 already hints, in part, at what the problem is.
Many software vendors think that they purchase some kind of security for their licensing ...
Some information might be found in Barnaby Jack's BlackHat presentation:
Jackpotting Automated Teller Machines (Youtube)
The most prevalent attacks on Automated Teller Machines typically involve the use of card skimmers, or the physical theft of the machines themselves. Rarely do we see any targeted attacks on the underlying software.
Can't find the ...
On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely implemented. This was alluded to in AlephOne's venerable "Smashing the Stack for Fun and Profit":
The problem we are faced when trying to overflow the buffer of ...
There are a couple of ways that come to mind. The first would be to use a network packet analyzer on the actual client running the application. Some well known packet analyzers are Wireshark, tcpdump, and even Microsoft Network Monitor.
Another alternative would be to intercept the traffic via man-in-the-middle (M. The easiest way to do this (if you control ...
Literally, for a first look on malware, you won't need anything special locally installed.
There are enough online sandboxes you may use:
virustotal.com have their sandbox implemented using Cuckoo Sandbox. When you apply new sample, it automatically executed as part of analysis. After about 10-15 mins you can see the result in "Behavioural information"
As Peter has indicated, looking at how the dongle is used for security is the starting point to identify the attack vectors. In most cases, the software developers implementing the dongle security is the weakest point.
In the past when I have tested software with dongles, I have used free tools like ProcessMonitor and RegShot to identify simple ...
In the paper Heart of Darkness - exploring the uncharted backwaters of HID iCLASS TM security
is a technique described (section III.C) that might work,but it does require a working device which might not be at hand in your situation.
In short they use a TTL-232 cable in synchronous bit bang mode to emulate the PIC programmer. They then override the boot ...
You should not confuse "code protection" and "code obfuscation". "Code protection" techniques target in recognizing code modifications (you mention a checksum) and take suitable means like crashing or delivering wrong results when tampering with the code has been recognized. Anti-Debug measures also belong into this category.
"Code obfuscation" in a binary ...
If the network traffic is in "plain text" (not encrypted) then a network sniffer such as Wireshark is ideal.
If the network traffic is encrypted via SSL but you have the private key (or if the client application does not validate the server's public key) then you can use a proxy such as Burp.
If the network traffic is encrypted via SSL and you don't have ...
Just before posting this answer I realized he's asking how to do this on windows and my answers is for Mac. I'm posting it regardless because I believe it might be useful for others trying to perform the same thing but then using a Mac
If you're using a Mac, then it's really easy by the combination of a Remote Virtual Interface (rvi) and Wireshark. Note ...
All ATMs that I am aware of and have worked on in a past life have a way to get into 'admin' mode either from the front or a rear keypad. Methods vary. Sniffing a network probably won't help as the communication is encrypted.
That said, buy one:
Then you'll have all the ...
You can't do much without physical access, if not to the specific machine you're attacking then to the same or similar model. That's what Barnaby Jack did - he ordered 3 ATM machines and investigated them at home. I suppose there may be service menus reachable from the normal screen by some key combinations but I wouldn't count on it.
Once you know the ...
There is no LIF file in the D-Link binary file containing the firmware image. file returns a false positive. Since there is no LIF file present, tools in the lifutils package will fail or produce erroneous results
Do not trust tools implicitly. Tools can return false positives if they rely on magic numbers, particular byte sequences and the like. When ...
You can build your own USB RF receiver fairly cheaply, for example:
This might be a good starting point, run the usb receiver, sniff the RF, press some buttons and see what happens :)
Not in the long run.
Hashing of certain parts of files is still used to push data updates quickly when a new malicious sample shows up in the wild, to get the clients protected as soon as possible.
But malware nowadays is very polymorphic so hashing is easy to defeat.
Detailed analysis of samples take a lot of time often weeks or months
and after that ...
This paper shows why it is not the best choice using MD5 for virus signatures. You should avoid SHA-1 also, because practical collision may be possible within years. So, consider using SHA-256 or SHA-3.
The import table can theoretically have as many references to a DLL as there are imports. It is a function of the linker that produces this effect, and in some cases, the linker does not perform any kind of string pooling.
Borland products treat units as stand-alone objects, so any imported functions that are used are included without reference to any ...
Bachelor's project is supposed to be a showcase of a person's
strengths in computer science
I don't have any first hand experience of [reverse engineering]
Given your two statements above, I would posit that you should not do your bachelor's project on reverse engineering :(
If the whole purpose of your application is to let the user input some data and then create a file in a specific file format from that data and you want to prevent unauthorized users from doing that, then yes, moving the file creation to a server will prevent that.
Though there are still some things to keep in mind:
You need to secure your server. If an ...
Similar to what's touched on in the article, the issue is that no matter ...
Its a base64 that once decoded will give you a HEX string, that if converted to chars will let you find your reversed flag string:
Redacted reversed flag:
Redacted flag is:
From Oreans KB:
The Taggant System is a cryptographic signature added to a software to
fight against antivirus false positives in protected applications. The
Taggant information in your Themida/WinLicense license contains an
internal ID and your private key to insert and sign the protected
binary with your Taggant information, so antivirus ...
Look for the writes to the qword_18009FBD0 to see where it's initialized.
Apparently it's a part of an array called __encodedKERNEL32Functions where various pointers to kernel32 functions are stored after being XORed with __security_cookie. You can rename the pointer to the kernel32 function's name to better see what is happening:
As you mentioned, many things can leave you with a different memory layout than the one you expect:
The name of the binary is one.
The environment variables the binary gets is another one.
If it's being debugged (related to the previous point)
Security measures such as stack cookies
Using hardcoded addresses pointing to the stack as the address that ...