6
votes
Accepted
What are the steps to reverse engineering a Shockwave .DCR file?
There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is this post on the ZenHAX forum, where a script ...
- 2,234
6
votes
Anti-VM and anti-sandbox malware samples
For learning purposes, I would recommend you the following Github projects to start with:
Paranoid Fish by a0rtega
https://github.com/a0rtega/pafish
Al-Khaser v0.60 by Noteworthy
https://github....
- 2,438
4
votes
Accepted
How to connect two Windows VMWare virtual machines over a virtual serial port for kernel debugging on a Linux host
This is a step-by-step approach, excluding the actual host system installation, VMware setup and Virtual Machine creation, since these are rudimentary steps and anyone willing to perform kernel ...
- 196
4
votes
Debugging a process running in a Virtual Machine with Radare2?
i'm the developer of r2vmi, and found your topic by googling my own project.
I have been working on an improved version by reimplementing a GDB stub:
https://github.com/Wenzel/pyvmidbg
The README ...
- 41
3
votes
Virtual machine code obfuscation implementation details
If you want proof-of-concept VM based obfuscator, you can actually skip the virtualization step and bytecode generation step. You can write an interpreter of x86 instructions in x86 assembler so that ...
- 143
3
votes
Accepted
Virtual machine code obfuscation implementation details
You will need to go through each of the over 200 instructions, and figure out how to do the "same" thing in your instruction set. So you'll need to see how the stack may be changing, the stack pointer,...
- 474
3
votes
custom virtual machine protection
When a sample is protected with a VM, the only way to reverse engineer the code itself is to start with understanding the VM.
From what I've found, a lot of VMs have two things in common:
They are ...
- 263
3
votes
IDA Pro v7 installation problem in VM
IDA 7.0 is x64 application, i.e. both ida.exe and ida64.exe are built for x64, despite the naming. So you won't be able to run 7.0 on x86 at all. Use IDA versions previous to 7.0.
- 1,840
3
votes
Test malware files in host machine?
I want to know how to test malware files with out using virtual
environment.
Check out the answers in the following, similar, question:
Analysing malware in a real environment (non-virtual ...
- 8,919
3
votes
How to detect a virtualized environment?
Here is a collection of anti-sandbox/vm/debugger techniques implemented in a open source program which will give you a clear idea how to detect virtualization: https://github.com/LordNoteworthy/al-...
- 141
3
votes
Accepted
how do I debug full screen applications
you can use windbg like an user-mode debugger from a kernel connection
open the vm
install windbg in vm
install the full screen game in vm
connect the vm to a kernel debugger in host
execute ...
- 16.3k
3
votes
Slow kernel dbg with VirtualBox and WinDBG
You should try VirtualKD which uses a fast VM-specific mechanism to communicate with the debugger instead of slow serial port emulation. Another option could be Ethernet or USB-based debugging but I'm ...
- 36.4k
3
votes
Accepted
Kernel debugging between two virtual machines not working
Fixed the problem..
On the windbg client, uncheck the 'Reconnect' and 'Pipe' checkboxes on the COM tab - then it will connect to the debugger.
- 668
2
votes
how do I debug full screen applications
I usually do one of the following when dealing with full screen software:
As blabb said setting up a remote debugger is an option, although I usually find it a bit slow and annoying to use and set up....
- 11.7k
2
votes
Accepted
Slow kernel dbg with VirtualBox and WinDBG
Fixed the issue this was a two part problem.
Avast anti virus was slowing down the VM to a crawl
solution uninstall avast or in some cases DISABLE the option: Settings > Troubleshooting > "Enable ...
- 51
1
vote
Accepted
How to capture control flow pins on emulated serial port?
To answer my own question, you can use the Linux kernel module tty0tty to capture the control pins and data flow.
- 271
1
vote
Debugging a process running in a Virtual Machine with Radare2?
Radare is able to connect to gdb remote sessions. So if you use something like qemu for your virtualization you would be able to connect to this. The problem will be to find the desired process inside ...
- 536
1
vote
How to track/debug/manipulate Windows processes in a VM?
This is called Virtual Machine Introspection (VMI) and, while definitely possible, requires you to implement parsing of the internal OS structures to isolate individual processes, modules etc instead ...
- 36.4k
1
vote
Accepted
Difficulty obtaining malware traffic
Ok, nevermind.
The answer to my question is that my particular sample uses it's own custom protocol that it sends over SSL. I can't go into further detail without mentioning the particular sample ...
- 173
1
vote
Accepted
VMProtect keygen, turn off the anti-debugging
You can use something like ScyllaHide to hide your debugger while you still don‘t know the method they use to detect you.
- 351
1
vote
How to deal with heavy control flow flattening?
One would have to look at the code.
How are the jump targets calculated?
From your diagrams it could also be something as simple as:
void jump_to_x_plus_5(uint x) { jmp x+5; }
void jump_to_x_plus_7(...
- 351
1
vote
Test malware files in host machine?
Use KVM. Most of the time malwares will try to detect VMWare and Virtualbox based artifacts.
- 395
1
vote
What are some ways in which virtual machines make native static and dynamic reversing of a binary more difficult?
It depends on your goal. If all you care about is side-effects (as in API calls, written files, network stuff and so on), they don't really make life difficult. As you said, in the end the API has to ...
- 1,391
1
vote
Anti-VM and anti-sandbox malware samples
https://github.com/a0rtega/pafish is old but it is good tool.
https://github.com/AlicanAkyol/sems is current. You can use it.
- 111
1
vote
Can IDA Pro automatically deal with VM obfuscated binaries?
There's now (from 2020) a plugin for IDA Pro that helps in working with obfuscated binaries. It is called D810: Creating an extensible deobfuscation plugin for IDA Pro.
- 474
Only top scored, non community-wiki answers of a minimum length are eligible