Enderman

🧪 Beyond the limitations of the Virtual Environment I

It doesn't matter if you're an amateur malware tester or a professional cyber-sec expert, you've surely had a problem where a sample just wouldn't run on your virtual environment, be it a Sandbox, or a Virtual Machine. Regardless of your struggle, there exists a common technique used to detect any suspicious environment, and it allows for developers to filter hardware their applications can run on, be it for malicious or defensive purposes. It's commonly called an Anti-VM and there are various proprietary and open-source solutions (e. g. VMProtect, Safengine) providing a wide range of application protection utilities.

Despite all the expenses developers go for to secure their application, the Anti-VM mechanisms are very predictable and relatively easy to bypass. Their weakest point is the fact that a virtual environment isn't so much different from a real one. The only potential fruitful ways to detect a virtual environment are hardware signatures and drivers for that specific set of hardware. Some cheeky paid tools go as far as searching for generic patterns and strings in the local network, known VM files in your system directory, but such checks are far more strict and can't ever warrant a Virtual Machine on the other end.

I will not get into technical side of things in this post, and we don't really need them to bypass basic Anti-VM checks and evade even some of the paid solutions out there. Essentially, we will be cooking up an Anti-Anti-VM environment to trick pesky programs to run without the need of real hardware.

The cornerstone of that endeavor will be the VMware Hardened Loader by hzqst. As the name suggests, you will need a VMware machine to pull this off. I'll boil down the tutorial to a few simple steps down below. You can find the original text in the readme file attached in the repository.

▪️ Create a virtual machine with a SCSI hard disk
▪️ Replace all the optical drives with SCSI ones
🔻 Paste the following settings inside the .vmx file of your newly created VM:

    hypervisor.cpuid.v0 = "FALSE"
    board-id.reflectHost = "TRUE"
    hw.model.reflectHost = "TRUE"
    serialNumber.reflectHost = "TRUE"
    smbios.reflectHost = "TRUE"
    SMBIOS.noOEMStrings = "TRUE"
    isolation.tools.getPtrLocation.disable = "TRUE"
    isolation.tools.setPtrLocation.disable = "TRUE"
    isolation.tools.setVersion.disable = "TRUE"
    isolation.tools.getVersion.disable = "TRUE"
    monitor_control.disable_directexec = "TRUE"
    monitor_control.disable_chksimd = "TRUE"
    monitor_control.disable_ntreloc = "TRUE"
    monitor_control.disable_selfmod = "TRUE"
    monitor_control.disable_reloc = "TRUE"
    monitor_control.disable_btinout = "TRUE"
    monitor_control.disable_btmemspace = "TRUE"
    monitor_control.disable_btpriv = "TRUE"
    monitor_control.disable_btseg = "TRUE"
    monitor_control.restrict_backdoor = "TRUE"

They will minimize the hardware signature presence inside your VM.
Now you want to rename virtual drives to remove VMware from their name:

    scsi0:0.productID = "Samsung SSD"
    scsi0:0.vendorID = "Samsung"
    scsi0:X.productID = "Matshita DVD-RAM" // X is the DVD slot
    scsi0:X.vendorID = "Matshita"

The rest of the steps are in the next post.

🤯44👍17❤4🤔3⚡2😁2😱1🤬1

5.19K viewsedited 12:20