6 votes
Accepted

What are the steps to reverse engineering a Shockwave .DCR file?

There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is this post on the ZenHAX forum, where a script ...
user avatar
  • 2,154
6 votes

Anti-VM and anti-sandbox malware samples

For learning purposes, I would recommend you the following Github projects to start with: Paranoid Fish by a0rtega https://github.com/a0rtega/pafish Al-Khaser v0.60 by Noteworthy https://github....
user avatar
  • 2,438
5 votes

Kernel debugging - how to set breakpoint at DriverEntry?

you can try breaking on driver load instead on just the entry: sxe ld drv.sys This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else ...
user avatar
  • 34.9k
4 votes

Debugging a process running in a Virtual Machine with Radare2?

i'm the developer of r2vmi, and found your topic by googling my own project. I have been working on an improved version by reimplementing a GDB stub: https://github.com/Wenzel/pyvmidbg The README ...
user avatar
  • 41
3 votes

IDA Pro v7 installation problem in VM

IDA 7.0 is x64 application, i.e. both ida.exe and ida64.exe are built for x64, despite the naming. So you won't be able to run 7.0 on x86 at all. Use IDA versions previous to 7.0.
user avatar
  • 1,760
3 votes

Test malware files in host machine?

I want to know how to test malware files with out using virtual environment. Check out the answers in the following, similar, question: Analysing malware in a real environment (non-virtual ...
user avatar
  • 8,659
3 votes

custom virtual machine protection

When a sample is protected with a VM, the only way to reverse engineer the code itself is to start with understanding the VM. From what I've found, a lot of VMs have two things in common: They are ...
user avatar
  • 253
3 votes
Accepted

Virtual machine code obfuscation implementation details

You will need to go through each of the over 200 instructions, and figure out how to do the "same" thing in your instruction set. So you'll need to see how the stack may be changing, the stack pointer,...
user avatar
3 votes

Slow kernel dbg with VirtualBox and WinDBG

You should try VirtualKD which uses a fast VM-specific mechanism to communicate with the debugger instead of slow serial port emulation. Another option could be Ethernet or USB-based debugging but I'm ...
user avatar
  • 34.9k
3 votes

How to detect a virtualized environment?

Here is a collection of anti-sandbox/vm/debugger techniques implemented in a open source program which will give you a clear idea how to detect virtualization: https://github.com/LordNoteworthy/al-...
user avatar
3 votes
Accepted

How to connect two Windows VMWare virtual machines over a virtual serial port for kernel debugging on a Linux host

This is a step-by-step approach, excluding the actual host system installation, VMware setup and Virtual Machine creation, since these are rudimentary steps and anyone willing to perform kernel ...
user avatar
  • 186
3 votes
Accepted

Kernel debugging between two virtual machines not working

Fixed the problem.. On the windbg client, uncheck the 'Reconnect' and 'Pipe' checkboxes on the COM tab - then it will connect to the debugger.
user avatar
  • 658
3 votes
Accepted

how do I debug full screen applications

you can use windbg like an user-mode debugger from a kernel connection open the vm install windbg in vm install the full screen game in vm connect the vm to a kernel debugger in host execute ...
user avatar
  • 15k
3 votes

Kernel debugging - how to set breakpoint at DriverEntry?

patch the Address of Entry Point with a (0xcc aka int 3) and load the driver AddrOfEntryPoint normally points to either DriverEntry or GsDriverEntry when broken you need to replace 0xcc by ...
user avatar
  • 15k
3 votes

Virtual machine code obfuscation implementation details

If you want proof-of-concept VM based obfuscator, you can actually skip the virtualization step and bytecode generation step. You can write an interpreter of x86 instructions in x86 assembler so that ...
user avatar
  • 133
2 votes
Accepted

Detect specific algorithms running in a virtual machine via behavior analysis

As Guntram mentioned, the PANDA project is built to make this kind of thing possible. Essentially, it adds instrumentation points to QEMU so that you can build plugins that perform analysis on a whole ...
user avatar
2 votes

how do I debug full screen applications

I usually do one of the following when dealing with full screen software: As blabb said setting up a remote debugger is an option, although I usually find it a bit slow and annoying to use and set up....
user avatar
  • 11.4k
2 votes
Accepted

Slow kernel dbg with VirtualBox and WinDBG

Fixed the issue this was a two part problem. Avast anti virus was slowing down the VM to a crawl solution uninstall avast or in some cases DISABLE the option: Settings > Troubleshooting > "Enable ...
user avatar
  • 51
1 vote

How to track/debug/manipulate Windows processes in a VM?

This is called Virtual Machine Introspection (VMI) and, while definitely possible, requires you to implement parsing of the internal OS structures to isolate individual processes, modules etc instead ...
user avatar
  • 34.9k
1 vote
Accepted

Difficulty obtaining malware traffic

Ok, nevermind. The answer to my question is that my particular sample uses it's own custom protocol that it sends over SSL. I can't go into further detail without mentioning the particular sample ...
user avatar
  • 153
1 vote

Debugging a process running in a Virtual Machine with Radare2?

Radare is able to connect to gdb remote sessions. So if you use something like qemu for your virtualization you would be able to connect to this. The problem will be to find the desired process inside ...
user avatar
  • 516
1 vote

What are some ways in which virtual machines make native static and dynamic reversing of a binary more difficult?

It depends on your goal. If all you care about is side-effects (as in API calls, written files, network stuff and so on), they don't really make life difficult. As you said, in the end the API has to ...
user avatar
1 vote
Accepted

VMProtect keygen, turn off the anti-debugging

You can use something like ScyllaHide to hide your debugger while you still don‘t know the method they use to detect you.
user avatar
  • 341
1 vote

How to deal with heavy control flow flattening?

One would have to look at the code. How are the jump targets calculated? From your diagrams it could also be something as simple as: void jump_to_x_plus_5(uint x) { jmp x+5; } void jump_to_x_plus_7(...
user avatar
  • 341
1 vote

Test malware files in host machine?

Use KVM. Most of the time malwares will try to detect VMWare and Virtualbox based artifacts.
user avatar
1 vote

Anti-VM and anti-sandbox malware samples

https://github.com/a0rtega/pafish is old but it is good tool. https://github.com/AlicanAkyol/sems is current. You can use it.
user avatar
1 vote

How does one leverage VTx to disable screen capture?

This question will most likely be closed as primarily opinion based, since "how does a particular system work" can't be answered unless there's either documentation about it or someone has reverse-...
user avatar
1 vote

Detect specific algorithms running in a virtual machine via behavior analysis

A nice idea! I don't know of an existing solution directly matching your approach. But you might use "Virtual Machine Introspection" as a key term to find out about similar approaches. The 2003 paper ...
user avatar
  • 51
1 vote

Detect specific algorithms running in a virtual machine via behavior analysis

I recommend you taking a look to the following presentation from Recon 2012: Cryptographic Function Identification in Obfuscated Binary Programs If I'm not wrong, this is exactly the same you want ...
user avatar
  • 4,325
1 vote

Saving Kik conversations using VirtualBox Android device

You would need to mount the VM's VDI HD image and then look through the file system for the conversation logs. If you can't easily find the logs in the file system, you'll need to reverse engineer the ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible