VirtualBox Hardened Loader x64 (kernelmode.info)

[Insid3Code]

VirtualBox Hardened VM detection mitigation loader x64 from kernelmode.info.

Step by step guide for VirtualBox Hardened (4.3.14+) VM detection mitigation configuring.

PHP Code:

http://www.kernelmode.info/forum/viewtopic.php?f=11&t=3478 


Project comes with full source code. In order to build from source you need: Microsoft Visual Studio 2013 U4 and later versions for loader build. Windows Driver Kit 8.1 U1 and later versions for driver build.

PHP Code:

https://github.com/hfiref0x/VBoxHardenedLoader 


[user1]

May I ask to explain a bit more?

[Insid3Code]

Originally Posted by user1

May I ask to explain a bit more?

When you try to analyze a suspicious file (malware), usually you do it in a virtual machine, and in case where the suspicious file uses some tricks to detect your virtual analysis lab, based on its strings or hardware signature, here you need to make a custom configuration or patch some strings/hardware signature to avoid virtual machine detection.

EP_X0FF has made a great job by releasing and sharing (tut and tool with source) VM detection mitigation for (VirtualBox)

[user1]

So if I give u a custom Hwid that has a soft tied to HDD and BIOS can this VirtualBox emulate them?

[sendersu]

>Project comes with full source code. In order to build from source you need: Microsoft Visual Studio 2013 U4 and later versions for loader build. Windows Driver Kit 8.1 U1 and later versions for driver build.

vbox AFAIK has a lot of drivers, what about signing them for correct usage udner win7+?

[mr.exodia]

Originally Posted by sendersu

vbox AFAIK has a lot of drivers, what about signing them for correct usage udner win7+?

use a patched kernel or enable testsigning

[Insid3Code]

Originally Posted by user1

So if I give u a custom Hwid that has a soft tied to HDD and BIOS can this VirtualBox emulate them?

The main problem you need to resolve when using another Hardware (configuration) is the compatibility with VirtualBox releases, so full testing is required.
I have not yet replaced or modified the (Tables) provided by EP_X0FF.

Originally Posted by sendersu

vbox AFAIK has a lot of drivers, what about signing them for correct usage udner win7+?

Self-Signing and changing/patching the boot configuration (x64 kernel) is the best way you need for testing purpose as alternative to (Buy) digital certificate $$$

[ahmadmansoor]

what about vmware ??, alot of guys use it .

[Insid3Code]

Originally Posted by ahmadmansoor

what about vmware ??, alot of guys use it .

Yes, I have read several articles dealing with the subject, I think the best way is to try to collect and expose all VMware detection tricks (widely used/private) in open source snippet project (GitHub) and binary ready to use for testing purpose, then develop some countermeasures.

[Insid3Code]

Updated...

VirtualBox EFI video driver patched. Now you can install UEFI compatible OS'es using AntiVM detection patch without problems with video (e.g. black screen during install, or when already installed VM accessible only via RDP).

If you plan to use EFI based VM's:

1) Make sure, Tsugumi is properly unloaded (using remove.cmd) before doing next step.
2) Make copy of VBoxEFI64.fd in VirtualBox directory.
3) Replace VBoxEFI64.fd in VirtualBox directory with it patched version from this patch data directory.
4) Use hidevm_efiahci (AHCI controller mode) or hidevm_efiide (IDE controller mode) for your EFI VM.
5) Load Tsugumi (using install.cmd).
6) Run VirtualBox.

Binaries and loader source -> https://github.com/hfiref0x/VBoxHardenedLoader.

[user1]

Yes, I have read several articles dealing with the subject, I think the best way is to try to collect and expose all VMware detection tricks (widely used/private) in open source snippet project (GitHub) and binary ready to use for testing purpose, then develop some countermeasures.

Don't know if open source project is best way to expose anti - VM detection tricks....

[Insid3Code]

Yes, releasing something (vulnerability/exploit) that can be used for malicious purposes by bad guys is always problematic, but IMHO expose a vulnerability (to the author first, then to the public after that the fix was released) can help developers and users to be better protected.

In VM detection case, EP_X0FF work around known tricks used by malware authors in real life, and malware authors also search what is new (Underground/Private forums). Do not expose these tricks lead to more victims.

Collect and expose all VM detection tricks in open source project can help also all RCE Newbies to better learn and test binary analysis.

[Conquest]

I have previously tried vbox , but its is slow compared to vmware workstation. how much performance hit will i get disabling the 2d/3d accelerations and these customizations

[Evilcry]

Loader has been updated for VirtualBox 4.3.28, UEFI - available on the github repository previously mentioned.

[Fyyre]

EP_X0FF is a long time good friend of mine. He makes such tools not for malicious usage.