15

the list could be endless, so I'll keep it short: virtualized environment artifacts: registry keys, hard disk name, network card address, specific drivers,... environment differences: no mouse, internet connection, sound card,... execution difference: detection of block translation (create another thread and apply statistics on IP), different system ...


15

There are a multitude of ways to detect virtual machines/emulators, mostly following the pattern of identifying an imperfection in the simulation and then testing for it. At the simplest end, common virtualization toolkits plaster their name over all kinds of system drivers and devices. Simply looking at the name of network connections or their MAC address ...


13

In fact, they do not claim at all to evade from any virtual machine. But, by using the MMU fault handler mechanism to perform computation, they expect to render the encapsulation of their program unpractical. Indeed, the point is to find unexpected primitives to perform computation, doing so only a few virtual machine environments will be able handle such ...


12

Here are some tricks for detecting VM's: VirtualBox http://pastebin.com/RU6A2UuB (9 different methods, registry, dropped VBOX dlls, pipe names etc) http://pastebin.com/xhFABpPL (Machine provider name) http://pastebin.com/v8LnMiZs (Innotek trick) http://pastebin.com/fPY4MiYq (Bios Brand and Bios Version) http://pastebin.com/Geggzp4G (Bios Brand and Bios ...


12

The malware can propagate from the VM to the host in several circumstances: If there's a bug in the VM software. That's not very common, but it's possible. If there's a bug in the host OS. A bug that specifically allows malware to break out of a VM is unlikely but again possible. If there's a bug in the processor. That's even more unlikely but still not ...


9

Regarding question #1, no IDA does not handle obfuscated binaries. You might be interested by the Virtual Deofbuscator talk Jason Raber gave at Blackhat last year, he also released an IDA plugin and the source code is available. Slides : https://media.blackhat.com/us-13/US-13-Raber-Virtual-Deobfuscator-A-DARPA-Cyber-Fast-Track-Funded-Effort-Slides.pdf ...


6

It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: http://silverstr.ufies.org/lotr0/windbg-vmware.html However, Virtual PC is extremely outdated (7 years old) and it's much easier nowadays to do VM kernel debugging with VirtualKD along with VMware or VirtualBox.


6

For learning purposes, I would recommend you the following Github projects to start with: Paranoid Fish by a0rtega https://github.com/a0rtega/pafish Al-Khaser v0.60 by Noteworthy https://github.com/LordNoteworthy/al-khaser or Colection by AlicanAkyol https://github.com/AlicanAkyol/sems Grab one you like, compile and analyze. In case you look for in ...


5

you can try breaking on driver load instead on just the entry: sxe ld drv.sys This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else fails.


5

I wrote a test program a while go (in Delphi). The following two functions detect VMware and HyperV // VMware detection as described by Elias Bachaalany function IsInsideVMware: Boolean; begin Result := True; try asm push edx; push ecx; push ebx; mov eax, 'VMXh'; mov ebx, 0; mov ecx, 10; mov edx, 'VX'; ...


5

There were a lot of saying in replays, but I'd like to stress on some answers from the practical point of view: network connection - a while ago I would agree that simply disconnecting the vm from the network will solve the problem of spreading through the network. Today, there are more and more malwares that will work only when the connection to CnC has ...


5

There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is this post on the ZenHAX forum, where a script or two have been created for use with their program, QuickBMS. That won't teach you how to reverse the format, but if you spend some time reading what QuickBMS ...


4

If the VM software has a bug a malware can also spread out of the VM and infect the host computer. There is also the possibility that the underlying processor (if you are using hardware virtualization) has a bug which lets the malware escape the VM. If you have a network connection it is possible that the malware can spread over the network. So to prevent ...


4

In addons on the answers post before, cuckoosandbox implements few yara rules for vm detection: https://github.com/cuckoobox/cuckoo/blob/1884b5579ff8e053b3d4a8523a5da576eee43552/data/yara/binaries/vmdetect.yar


4

You can find common tricks in cuckoo sandbox repository.


4

if youre using VMWare I suggest using a host only connection. Typically when you create a VM it will use NAT or bridged, sharing the host computers IP and/or network adapter. Using Host-Only lets the VM only be locally connected to that particular adapter with no internet connectivity(It's assigned its own local IP and uses its own Gateway) Typically when ...


4

i'm the developer of r2vmi, and found your topic by googling my own project. I have been working on an improved version by reimplementing a GDB stub: https://github.com/Wenzel/pyvmidbg The README contains a demo if you want a quick look. I'm able to debug a Windows XP VMs, both kernel and userland, given you have the right symbols, with radare2. I ...


3

Here is a collection of anti-sandbox/vm/debugger techniques implemented in a open source program which will give you a clear idea how to detect virtualization: https://github.com/LordNoteworthy/al-khaser. Here are the list of supported techniques: Anti-debugging attacks IsDebuggerPresent CheckRemoteDebuggerPresent Process Environement Block (BeingDebugged)...


3

Just as a kind of related note, but side-stepping the actual question a bit. There was a presentation at the VB conference last year (2013) in Berlin, about a KVM-based modified hypervisor. It is called CXPInspector and the presentation they gave (the first one in the tech stream) can be found here. Here's the corresponding thesis/dissertation (237 pages) ...


3

Use the latest and greatest version of VMWare. Monitor your real system. :) Why? well I've seen malware that 'breaks' out Vmware. How? Ring -1 exploitation. It's not something you'll commonly seen. But it can happen, will it with your sample unlikely but, it might. So, monitor your own system (ProcMon). Don't install VMware tools (easier detected by the ...


3

that is normal for virtual pc to say debugee not connected as it has not connectedto the target yet it has just established a transport press ctrl+break once to connect and press g to resume running. As Jason suggested get the free vmware player and configure virtualkd for a much faster debugging com port is too slow for many things especially conditinal ...


3

you can use windbg like an user-mode debugger from a kernel connection open the vm install windbg in vm install the full screen game in vm connect the vm to a kernel debugger in host execute ntsd -d {the fullscreen app in vm} the kernel debugger in host will kick to life as a plain user-mode debugger debugging the app ( the syntax for continuing ...


3

VMware exposes a GDB stub specifically for this purpose. Using this stub, one can connect GDB (or any GDB front-end) to manipulate the guest OS, as if it were a process. VMware - OSDev Wiki Debugging Windows kernel under VMWare using IDA's GDB debugger - HexRays


3

Fixed the problem.. On the windbg client, uncheck the 'Reconnect' and 'Pipe' checkboxes on the COM tab - then it will connect to the debugger.


3

This is a step-by-step approach, excluding the actual host system installation, VMware setup and Virtual Machine creation, since these are rudimentary steps and anyone willing to perform kernel debugging should be capable doing. The approach is split into three parts - the VM hardware settings, MS Windows configuration, and establishing a debugging session. ...


3

You should try VirtualKD which uses a fast VM-specific mechanism to communicate with the debugger instead of slow serial port emulation. Another option could be Ethernet or USB-based debugging but I'm not sure how to set it up with VMs...


3

I want to know how to test malware files with out using virtual environment. Check out the answers in the following, similar, question: Analysing malware in a real environment (non-virtual environment) TL;DR: Check out Faronics Depp Freeze for example. I recommend reading the answers as a whole. In addition, read the answers to the following question on ...


3

IDA 7.0 is x64 application, i.e. both ida.exe and ida64.exe are built for x64, despite the naming. So you won't be able to run 7.0 on x86 at all. Use IDA versions previous to 7.0.


3

When a sample is protected with a VM, the only way to reverse engineer the code itself is to start with understanding the VM. From what I've found, a lot of VMs have two things in common: They are not complex (sometimes the bytecode instructions themselves are just decoded into x86 instructions - usually some VM instructions as well) Complexity in a VM ...


2

As Guntram mentioned, the PANDA project is built to make this kind of thing possible. Essentially, it adds instrumentation points to QEMU so that you can build plugins that perform analysis on a whole system as it executes. One challenge is that the kinds of analyses you want to do are extremely computationally intensive, to the point where it's not really ...


Only top voted, non community-wiki answers of a minimum length are eligible