13

In fact, they do not claim at all to evade from any virtual machine. But, by using the MMU fault handler mechanism to perform computation, they expect to render the encapsulation of their program unpractical. Indeed, the point is to find unexpected primitives to perform computation, doing so only a few virtual machine environments will be able handle such ...


9

Regarding question #1, no IDA does not handle obfuscated binaries. You might be interested by the Virtual Deofbuscator talk Jason Raber gave at Blackhat last year, he also released an IDA plugin and the source code is available. Slides : https://media.blackhat.com/us-13/US-13-Raber-Virtual-Deobfuscator-A-DARPA-Cyber-Fast-Track-Funded-Effort-Slides.pdf ...


6

For learning purposes, I would recommend you the following Github projects to start with: Paranoid Fish by a0rtega https://github.com/a0rtega/pafish Al-Khaser v0.60 by Noteworthy https://github.com/LordNoteworthy/al-khaser or Colection by AlicanAkyol https://github.com/AlicanAkyol/sems Grab one you like, compile and analyze. In case you look for in ...


6

It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: http://silverstr.ufies.org/lotr0/windbg-vmware.html However, Virtual PC is extremely outdated (7 years old) and it's much easier nowadays to do VM kernel debugging with VirtualKD along with VMware or VirtualBox.


5

you can try breaking on driver load instead on just the entry: sxe ld drv.sys This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else fails.


5

There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is this post on the ZenHAX forum, where a script or two have been created for use with their program, QuickBMS. That won't teach you how to reverse the format, but if you spend some time reading what QuickBMS ...


4

i'm the developer of r2vmi, and found your topic by googling my own project. I have been working on an improved version by reimplementing a GDB stub: https://github.com/Wenzel/pyvmidbg The README contains a demo if you want a quick look. I'm able to debug a Windows XP VMs, both kernel and userland, given you have the right symbols, with radare2. I ...


3

I want to know how to test malware files with out using virtual environment. Check out the answers in the following, similar, question: Analysing malware in a real environment (non-virtual environment) TL;DR: Check out Faronics Depp Freeze for example. I recommend reading the answers as a whole. In addition, read the answers to the following question on ...


3

You should try VirtualKD which uses a fast VM-specific mechanism to communicate with the debugger instead of slow serial port emulation. Another option could be Ethernet or USB-based debugging but I'm not sure how to set it up with VMs...


3

that is normal for virtual pc to say debugee not connected as it has not connectedto the target yet it has just established a transport press ctrl+break once to connect and press g to resume running. As Jason suggested get the free vmware player and configure virtualkd for a much faster debugging com port is too slow for many things especially conditinal ...


3

This is a step-by-step approach, excluding the actual host system installation, VMware setup and Virtual Machine creation, since these are rudimentary steps and anyone willing to perform kernel debugging should be capable doing. The approach is split into three parts - the VM hardware settings, MS Windows configuration, and establishing a debugging session. ...


3

Fixed the problem.. On the windbg client, uncheck the 'Reconnect' and 'Pipe' checkboxes on the COM tab - then it will connect to the debugger.


3

VMware exposes a GDB stub specifically for this purpose. Using this stub, one can connect GDB (or any GDB front-end) to manipulate the guest OS, as if it were a process. VMware - OSDev Wiki Debugging Windows kernel under VMWare using IDA's GDB debugger - HexRays


3

Here is a collection of anti-sandbox/vm/debugger techniques implemented in a open source program which will give you a clear idea how to detect virtualization: https://github.com/LordNoteworthy/al-khaser. Here are the list of supported techniques: Anti-debugging attacks IsDebuggerPresent CheckRemoteDebuggerPresent Process Environement Block (BeingDebugged)...


3

Just as a kind of related note, but side-stepping the actual question a bit. There was a presentation at the VB conference last year (2013) in Berlin, about a KVM-based modified hypervisor. It is called CXPInspector and the presentation they gave (the first one in the tech stream) can be found here. Here's the corresponding thesis/dissertation (237 pages) ...


3

you can use windbg like an user-mode debugger from a kernel connection open the vm install windbg in vm install the full screen game in vm connect the vm to a kernel debugger in host execute ntsd -d {the fullscreen app in vm} the kernel debugger in host will kick to life as a plain user-mode debugger debugging the app ( the syntax for continuing ...


3

IDA 7.0 is x64 application, i.e. both ida.exe and ida64.exe are built for x64, despite the naming. So you won't be able to run 7.0 on x86 at all. Use IDA versions previous to 7.0.


3

When a sample is protected with a VM, the only way to reverse engineer the code itself is to start with understanding the VM. From what I've found, a lot of VMs have two things in common: They are not complex (sometimes the bytecode instructions themselves are just decoded into x86 instructions - usually some VM instructions as well) Complexity in a VM ...


3

You will need to go through each of the over 200 instructions, and figure out how to do the "same" thing in your instruction set. So you'll need to see how the stack may be changing, the stack pointer, the program counter, and also if any memory or register changes. For differences like not having enough registers, you could set aside a portion of memory to ...


3

If you want proof-of-concept VM based obfuscator, you can actually skip the virtualization step and bytecode generation step. You can write an interpreter of x86 instructions in x86 assembler so that the implementation is easy. You can add custom instructions one by one later through assembler macros, for example. This is much less complicated process than ...


2

As Guntram mentioned, the PANDA project is built to make this kind of thing possible. Essentially, it adds instrumentation points to QEMU so that you can build plugins that perform analysis on a whole system as it executes. One challenge is that the kinds of analyses you want to do are extremely computationally intensive, to the point where it's not really ...


2

patch the Address of Entry Point with a (0xcc aka int 3) and load the driver AddrOfEntryPoint normally points to either DriverEntry or GsDriverEntry when broken you need to replace 0xcc by original byte and reset eip back by a byte use eb <address> originalbyte enter r eip = <addresss> here is the entry point of beep.sys which points to ...


2

I usually do one of the following when dealing with full screen software: As blabb said setting up a remote debugger is an option, although I usually find it a bit slow and annoying to use and set up. Occasionally there's a configuration option to switch to windowed mode. Its not always there but when it is its the best choice. Since you are already ...


2

Fixed the issue this was a two part problem. Avast anti virus was slowing down the VM to a crawl solution uninstall avast or in some cases DISABLE the option: Settings > Troubleshooting > "Enable hardware assisted visualization" There is a bug in newer versions of WinDBG when debugging older versions of windows solution use an older version of WinDBG, or ...


1

One would have to look at the code. How are the jump targets calculated? From your diagrams it could also be something as simple as: void jump_to_x_plus_5(uint x) { jmp x+5; } void jump_to_x_plus_7(uint x) { jmp x+7; } void jump_to_x_plus_9(uint x) { jmp x+9; } And they just replaced all absolute jumps in the .asm with calls to random.choice() of those ...


1

Use KVM. Most of the time malwares will try to detect VMWare and Virtualbox based artifacts.


1

It depends on your goal. If all you care about is side-effects (as in API calls, written files, network stuff and so on), they don't really make life difficult. As you said, in the end the API has to be used and you will be able to catch it. The purpose of virtualization is preventing people from understanding internal processes of the target. As such, ...


1

https://github.com/a0rtega/pafish is old but it is good tool. https://github.com/AlicanAkyol/sems is current. You can use it.


1

You can follow the steps in the comments on this site: http://windbg.info/doc/1-common-cmds.html This roughly equals to what Igor suggested.


1

This question will most likely be closed as primarily opinion based, since "how does a particular system work" can't be answered unless there's either documentation about it or someone has reverse-engineered it already. So take this answer with a grain of salt - it describes how i'd tackle the problem. It might not even be feasible after closer ...


Only top voted, non community-wiki answers of a minimum length are eligible