SlideShare uma empresa Scribd logo

Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques

•Transferir como PPTX, PDF•
•
securityxploded
securityxploded

This document provides an overview of an advanced malware analysis training program. It includes sections on anti-reversing techniques used by malware like anti-debugging and anti-VM methods. It also covers anti-anti-reversing techniques and includes an agenda for the training with topics like API-based debugging detection, flags-based checks, and virtual machine detection techniques.

1 de 28
Advanced Malware Analysis Training Series www.SecurityXploded.com
Disclaimer The Content, Demonstration, Source Code and Programs presented here is "AS IS" without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the trainer‟s only and nothing to do with the company or the organization in which the trainer is currently working. However in no circumstances neither the Trainer nor SecurityXploded is responsible for any damage or loss caused due to use or misuse of the information presented here. www.SecurityXploded.com
Acknowledgement  Special thanks to Null community for their extended support and co-operation.  Special thanks to ThoughtWorks for the beautiful venue.  Thanks to all the trainers who have devoted their precious time and countless hours to make it happen. www.SecurityXploded.com
Advanced Malware Analysis Training This presentation is part of our Advanced Malware Analysis Training program. Currently it is delivered only during our local meets for FREE of cost. For complete details of this course, visit our Security Training page. www.SecurityXploded.com
Who am I? Swapnil Pathak  Security Researcher  Reversing, Malware Analysis, Exploit Analysis etc.  E-mail: swapnilpathak101@gmail.com www.SecurityXploded.com
Agenda  Introduction  Anti-Reversing techniques  Anti-Debugging  Anti-VM  Anti-Anti-Reversing techniques  Q&A www.SecurityXploded.com
Anti-Reversing  Implementation of techniques in code to hinder attempts at reverse engineering or debugging a target binary.  Used by commercial protectors, packers and malicious software  Covers  Anti-Debugging  Anti-VM  Anti-Disassembly  Code Obfuscation www.SecurityXploded.com
Anti-Debug Techniques  Techniques implemented to detect if the program is running under control of a debugger.  Categorized as below  API Based  Flags Based  Timing Based  Exception Based  Breakpoint Detection www.SecurityXploded.com
PEB (Process Environment Block)  Structure maintained by OS for each running process  Contains user mode parameters associated with a process  Including loaded modules list, debugger status etc  Referenced through fs:[30h]  !peb command in Windbg www.SecurityXploded.com
www.SecurityXploded.com
API Based  IsDebuggerPresent  Exported by kernel32.dll  Function accepts no parameters  Checks if BeingDebugged flag in Process Environment Block (PEB) is set  Returns 1 if process is being debugged, 0 otherwise call IsDebuggerPresent test eax,eax jnz debugger_detected CheckRemoteDebuggerPresent => NtQueryInformationProcess  CheckRemoteDubggerPresent(Handle to the target process, Pointer to a variable  Sets the variable to TRUE if the specified process is being debugged or FALSE otherwise push offset dbg push -1 call CheckRemoteDebuggerPresent test eax, eax jne debugger_detected www.SecurityXploded.com
API Based  NtQueryInformationProcess => ZwQueryInformationProcess  Exported by ntdll.dll  Retrieves information about the specified process.  NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength)  ProcessHandle – Handle to the process for which information is to be retrieved.  ProcessInformationClass : Type of process information to be retrieved. ○ Accepts following values : ProcessBasicInformation(0x0), ProcessDebugPort(0x07), ProcessWow64Information(0x26), ProcessImageFileName(0x27)  ProcessDebugPort : Retrieves port number of the debugger for the process.  Non Zero value indicates that the process is being debugged. www.SecurityXploded.com
API Based  OutputDebugString  Exported by kernel32.dll  Accepts one parameter : Null terminated string to be displayed  Sends a string to the debugger for display  Sends an error if there is no active debugger for the process to receive the string.  No error indicates presence of a debugger.  FindWindow  Exported by user32.dll  Used to search windows by name or class.  Detect debugger with graphical user interface www.SecurityXploded.com
API Based  CloseHandle  Exported by kernel32.dll  Involves passing invalid handle  If debugger present EXCEPTION_INVALID_HANDLE (0xC0000008) will be raised  Above exception if intercepted by an exception handler, indicates presence of a debugger. push 12ab ; any illegal value call CloseHandle www.SecurityXploded.com
Flags Based  BeingDebugged Flag  Present in PEB ( Process Environment Block) at offset 0x2  Set to 1 if the process is being debugged. mov eax, dword [fs:0x30] movzx eax, byte [eax + 0x02] ; PEB.BeingDebugged test eax, eax jnz debugger_detected www.SecurityXploded.com
Flags Based  NTGlobal Flag  Present in PEB ( Process Environment Block) at offset ○ 0x68 - 32 bit systems ○ 0xBC - 64 bit systems  Contains value 0x70 if the process is being debugged.  FLG_HEAP_ENABLE_TAIL_CHECK(0x10), FLG_HEAP_ENABLE_FREE_CHECK(0x20), FLG_HEAP_VALIDATE_PARAMETERS(0x40) mov eax, fs :[30h] mov eax, [eax+68h] and eax, 0x70 test eax, eax jne debugger_detected www.SecurityXploded.com
Flags Based  Heap Flags  ProcessHeap present in PEB ( Process Environment Block) at offset 0x18  Has Flags and ForceFlags Fields set to 0x02 (HEAP_GROWABLE) and 0x0 respectively if the process is not being debugged. mov eax, fs:[30h] mov eax, [eax + 18h] ; eax = PEB.ProcessHeap cmp [eax + 10h] , 0 ; ProcessHeap.ForceFlags jne debugger_detected cmp [eax + 0x0c], 2 ; ProcessHeap.Flags jne debugger_detected www.SecurityXploded.com
Timing Based  Timing Checks  Compares time spent executing instructions normally and while being debugged.  Longer time taken compared to normal run indicates that the binary is being debugged.  RDTSC ( Read Time Stamp Counter)  GetTickCount()  QueryPerformanceCounter() rdtsc mov eax, ebx ……. rdtsc sub eax, ecx cmp eax, 0x100 ja debugger_detected www.SecurityXploded.com
Exception Based  Interrupts  Consists of inserting interrupt instructions in middle of valid sequence of instructions.  INT3 breakpoint (0xCC, 0xCD 0x03)  INT 1 single step INT2D are stepped through inside the debugger, exception is raised.  If the process is being debugged, exception handler is not invoked as the debugger typically handles the exception  Checks such as setting of flags inside exception handler are used to detect presence of the debugger. www.SecurityXploded.com
Breakpoint Detection  Hardware Breakpoints  Whenever an exception occurs, a context structure is created and passed to the exception handler.  Context structure contains values of general registers, control registers, debug registers.  Binary being debugged with hardware breakpoints in use will contain values in debug registers indicating presence of debugger.  Memory Breakpoints  Implemented using Guard pages.  Guard Pages are set using the PAGE_GUARD page protection modifier.  Address accessed part of Guard Page will result in STATUS_GUARD_PAGE_VIOLATION exception.  Process being debugged under Ollydbg will treat this as a memory breakpoint and no exception will be raised. www.SecurityXploded.com
VM Detection  Techniques implemented to detect if the binary is being executed in a virtual environment.  Techniques include  Memory based  Backdoor I/O communication port  Process/Registry www.SecurityXploded.com
Techniques  Memory specific techniques include Red Pill  Only one IDT, GDT, LDT per processor.  IDT : Used by OS to determine correct response to interrupts and exceptions  GDT/LDT : Define characteristics of the various memory areas used during program execution such as base address, size and access privileges.  IDTR, GDTR, LDTR are internal registers that store the address of these respective tables.  To avoid conflicts between host and guest OS , virtual machine needs to relocate IDT, GDT, LDT  SIDT, SGDT and SLDT are instructions to retrieve values from IDTR, GDTR and LDTR respectively.  Base address stored in the register define if under Virtualized environment.  IDT is at 0x80ffffff in Windows, 0xE8xxxxxx in VirtualPC, 0xFFxxxxxx in Vmware. www.SecurityXploded.com
www.SecurityXploded.com
Techniques  Backdoor I/O port  OS running inside a VMWware uses port name „VX‟ for communication between the host and guest OS.  Data from this port can be read using various opcodes using “IN” instruction ○ 0x0A provides Vmware version. ○ 0x14 gets the memory size. ○ Value checked against „VMXh‟ to detect presence of Vmware  Process/Service Check  Check for Vmware related process, services  Process Name ( Associated Service Name )  vmacthlp.exe ( Vmware Physical Disk Helper Service )  vmtoolsd.exe ( Vmware Tools ) www.SecurityXploded.com
Anti-Anti-Debug Techniques  Manually patch values in memory, registers, return values from APIs  NOP sequence of instructions  Use of Plugins  OllyAdvanced  HideDebugger  Phantom  Anti-Anti-Debugger Plugins : https://code.google.com/p/aadp/ www.SecurityXploded.com
OllyDbg Screenshots www.SecurityXploded.com
References Complete Reference Guide for Advanced Malware Analysis Training [Include links for all the Demos & Tools] www.SecurityXploded.com
Thank You ! www.SecurityXploded.com www.SecurityXploded.com

Recomendados

Reversing & Malware Analysis Training Part 13 - Future Roadmap
Reversing & Malware Analysis Training Part 13 - Future RoadmapReversing & Malware Analysis Training Part 13 - Future Roadmap
Reversing & Malware Analysis Training Part 13 - Future Roadmapsecurityxploded
 
Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
Advanced Malware Analysis Training Session 6 - Malware Sandbox AnalysisAdvanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysissecurityxploded
 
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware AnalysisReversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysissecurityxploded
 
Reversing & malware analysis training part 1 lab setup guide
Reversing & malware analysis training part 1 lab setup guideReversing & malware analysis training part 1 lab setup guide
Reversing & malware analysis training part 1 lab setup guidesecurityxploded
 
Advanced Malware Analysis Training Session 8 - Introduction to Android
Advanced Malware Analysis Training Session 8 - Introduction to AndroidAdvanced Malware Analysis Training Session 8 - Introduction to Android
Advanced Malware Analysis Training Session 8 - Introduction to Androidsecurityxploded
 
Reversing & malware analysis training part 2 introduction to windows internals
Reversing & malware analysis training part 2 introduction to windows internalsReversing & malware analysis training part 2 introduction to windows internals
Reversing & malware analysis training part 2 introduction to windows internalssecurityxploded
 
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2securityxploded
 
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of MalwaresAdvanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwaressecurityxploded
 

Recomendados

Reversing & Malware Analysis Training Part 13 - Future Roadmap
Reversing & Malware Analysis Training Part 13 - Future RoadmapReversing & Malware Analysis Training Part 13 - Future Roadmap
Reversing & Malware Analysis Training Part 13 - Future Roadmapsecurityxploded
 
Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
Advanced Malware Analysis Training Session 6 - Malware Sandbox AnalysisAdvanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysissecurityxploded
 
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware AnalysisReversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysissecurityxploded
 
Reversing & malware analysis training part 1 lab setup guide
Reversing & malware analysis training part 1 lab setup guideReversing & malware analysis training part 1 lab setup guide
Reversing & malware analysis training part 1 lab setup guidesecurityxploded
 
Advanced Malware Analysis Training Session 8 - Introduction to Android
Advanced Malware Analysis Training Session 8 - Introduction to AndroidAdvanced Malware Analysis Training Session 8 - Introduction to Android
Advanced Malware Analysis Training Session 8 - Introduction to Androidsecurityxploded
 
Reversing & malware analysis training part 2 introduction to windows internals
Reversing & malware analysis training part 2 introduction to windows internalsReversing & malware analysis training part 2 introduction to windows internals
Reversing & malware analysis training part 2 introduction to windows internalssecurityxploded
 
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2securityxploded
 
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of MalwaresAdvanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwaressecurityxploded
 
Advanced Malware Analysis Training Session 5 - Reversing Automation
Advanced Malware Analysis Training Session 5 - Reversing AutomationAdvanced Malware Analysis Training Session 5 - Reversing Automation
Advanced Malware Analysis Training Session 5 - Reversing Automationsecurityxploded
 
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]securityxploded
 
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 securityxploded
 
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory ForensicsAdvanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory Forensicssecurityxploded
 
Reversing & malware analysis training part 3 windows pe file format basics
Reversing & malware analysis training part 3 windows pe file format basicsReversing & malware analysis training part 3 windows pe file format basics
Reversing & malware analysis training part 3 windows pe file format basicssecurityxploded
 
Primer on password security
Primer on password securityPrimer on password security
Primer on password securitysecurityxploded
 
Advanced malware analysis training session 7 malware memory forensics
Advanced malware analysis training session 7 malware memory forensicsAdvanced malware analysis training session 7 malware memory forensics
Advanced malware analysis training session 7 malware memory forensicsCysinfo Cyber Security Community
 
Anti-Virus Evasion Techniques and Countermeasures
Anti-Virus Evasion Techniques and CountermeasuresAnti-Virus Evasion Techniques and Countermeasures
Anti-Virus Evasion Techniques and Countermeasuresn|u - The Open Security Community
 
Reversing malware analysis training part1 lab setup guide
Reversing malware analysis training part1 lab setup guideReversing malware analysis training part1 lab setup guide
Reversing malware analysis training part1 lab setup guideCysinfo Cyber Security Community
 
Advanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to androidAdvanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to androidCysinfo Cyber Security Community
 
Anatomy of Exploit Kits
Anatomy of Exploit KitsAnatomy of Exploit Kits
Anatomy of Exploit Kitssecurityxploded
 
Automating Malware Analysis
Automating Malware AnalysisAutomating Malware Analysis
Automating Malware Analysissecurityxploded
 
Application Virtualization
Application VirtualizationApplication Virtualization
Application Virtualizationsecurityxploded
 
Advanced malwareanalysis training session2 botnet analysis part1
Advanced malwareanalysis training session2 botnet analysis part1Advanced malwareanalysis training session2 botnet analysis part1
Advanced malwareanalysis training session2 botnet analysis part1Cysinfo Cyber Security Community
 
Reversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysisReversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysisCysinfo Cyber Security Community
 
Reversing & malware analysis training part 12 rootkit analysis
Reversing & malware analysis training part 12 rootkit analysisReversing & malware analysis training part 12 rootkit analysis
Reversing & malware analysis training part 12 rootkit analysisAbdulrahman Bassam
 
Advanced malware analysis training session4 anti-analysis techniques
Advanced malware analysis training session4 anti-analysis techniquesAdvanced malware analysis training session4 anti-analysis techniques
Advanced malware analysis training session4 anti-analysis techniquesCysinfo Cyber Security Community
 
Reversing malware analysis training part7 unpackingupx
Reversing malware analysis training part7 unpackingupxReversing malware analysis training part7 unpackingupx
Reversing malware analysis training part7 unpackingupxCysinfo Cyber Security Community
 
Reversing malware analysis training part2 introduction to windows internals
Reversing malware analysis training part2 introduction to windows internalsReversing malware analysis training part2 introduction to windows internals
Reversing malware analysis training part2 introduction to windows internalsCysinfo Cyber Security Community
 
Reversing malware analysis training part11 exploit development advanced
Reversing malware analysis training part11 exploit development advancedReversing malware analysis training part11 exploit development advanced
Reversing malware analysis training part11 exploit development advancedCysinfo Cyber Security Community
 
How to drive a malware analyst crazy
How to drive a malware analyst crazyHow to drive a malware analyst crazy
How to drive a malware analyst crazyMichael Boman
 
44CON London 2015 - How to drive a malware analyst crazy
44CON London 2015 - How to drive a malware analyst crazy44CON London 2015 - How to drive a malware analyst crazy
44CON London 2015 - How to drive a malware analyst crazy44CON
 

Mais conteúdo relacionado

Mais procurados

Advanced Malware Analysis Training Session 5 - Reversing Automation
Advanced Malware Analysis Training Session 5 - Reversing AutomationAdvanced Malware Analysis Training Session 5 - Reversing Automation
Advanced Malware Analysis Training Session 5 - Reversing Automationsecurityxploded
 
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]securityxploded
 
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 securityxploded
 
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory ForensicsAdvanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory Forensicssecurityxploded
 
Reversing & malware analysis training part 3 windows pe file format basics
Reversing & malware analysis training part 3 windows pe file format basicsReversing & malware analysis training part 3 windows pe file format basics
Reversing & malware analysis training part 3 windows pe file format basicssecurityxploded
 
Primer on password security
Primer on password securityPrimer on password security
Primer on password securitysecurityxploded
 
Advanced malware analysis training session 7 malware memory forensics
Advanced malware analysis training session 7 malware memory forensicsAdvanced malware analysis training session 7 malware memory forensics
Advanced malware analysis training session 7 malware memory forensicsCysinfo Cyber Security Community
 
Advanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to androidAdvanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to androidCysinfo Cyber Security Community
 
Automating Malware Analysis
Automating Malware AnalysisAutomating Malware Analysis
Automating Malware Analysissecurityxploded
 
Application Virtualization
Application VirtualizationApplication Virtualization
Application Virtualizationsecurityxploded
 
Advanced malwareanalysis training session2 botnet analysis part1
Advanced malwareanalysis training session2 botnet analysis part1Advanced malwareanalysis training session2 botnet analysis part1
Advanced malwareanalysis training session2 botnet analysis part1Cysinfo Cyber Security Community
 
Reversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysisReversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysisCysinfo Cyber Security Community
 
Reversing & malware analysis training part 12 rootkit analysis
Reversing & malware analysis training part 12 rootkit analysisReversing & malware analysis training part 12 rootkit analysis
Reversing & malware analysis training part 12 rootkit analysisAbdulrahman Bassam
 
Advanced malware analysis training session4 anti-analysis techniques
Advanced malware analysis training session4 anti-analysis techniquesAdvanced malware analysis training session4 anti-analysis techniques
Advanced malware analysis training session4 anti-analysis techniquesCysinfo Cyber Security Community
 
Reversing malware analysis training part2 introduction to windows internals
Reversing malware analysis training part2 introduction to windows internalsReversing malware analysis training part2 introduction to windows internals
Reversing malware analysis training part2 introduction to windows internalsCysinfo Cyber Security Community
 
Reversing malware analysis training part11 exploit development advanced
Reversing malware analysis training part11 exploit development advancedReversing malware analysis training part11 exploit development advanced
Reversing malware analysis training part11 exploit development advancedCysinfo Cyber Security Community
 

Mais procurados (20)

Advanced Malware Analysis Training Session 5 - Reversing Automation
Advanced Malware Analysis Training Session 5 - Reversing AutomationAdvanced Malware Analysis Training Session 5 - Reversing Automation
Advanced Malware Analysis Training Session 5 - Reversing Automation
 
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
 
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
 
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory ForensicsAdvanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
 
Reversing & malware analysis training part 3 windows pe file format basics
Reversing & malware analysis training part 3 windows pe file format basicsReversing & malware analysis training part 3 windows pe file format basics
Reversing & malware analysis training part 3 windows pe file format basics
 
Primer on password security
Primer on password securityPrimer on password security
Primer on password security
 
Advanced malware analysis training session 7 malware memory forensics
Advanced malware analysis training session 7 malware memory forensicsAdvanced malware analysis training session 7 malware memory forensics
Advanced malware analysis training session 7 malware memory forensics
 
Anti-Virus Evasion Techniques and Countermeasures
Anti-Virus Evasion Techniques and CountermeasuresAnti-Virus Evasion Techniques and Countermeasures
Anti-Virus Evasion Techniques and Countermeasures
 
Reversing malware analysis training part1 lab setup guide
Reversing malware analysis training part1 lab setup guideReversing malware analysis training part1 lab setup guide
Reversing malware analysis training part1 lab setup guide
 
Advanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to androidAdvanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to android
 
Anatomy of Exploit Kits
Anatomy of Exploit KitsAnatomy of Exploit Kits
Anatomy of Exploit Kits
 
Automating Malware Analysis
Automating Malware AnalysisAutomating Malware Analysis
Automating Malware Analysis
 
Application Virtualization
Application VirtualizationApplication Virtualization
Application Virtualization
 
Advanced malwareanalysis training session2 botnet analysis part1
Advanced malwareanalysis training session2 botnet analysis part1Advanced malwareanalysis training session2 botnet analysis part1
Advanced malwareanalysis training session2 botnet analysis part1
 
Reversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysisReversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysis
 
Reversing & malware analysis training part 12 rootkit analysis
Reversing & malware analysis training part 12 rootkit analysisReversing & malware analysis training part 12 rootkit analysis
Reversing & malware analysis training part 12 rootkit analysis
 
Advanced malware analysis training session4 anti-analysis techniques
Advanced malware analysis training session4 anti-analysis techniquesAdvanced malware analysis training session4 anti-analysis techniques
Advanced malware analysis training session4 anti-analysis techniques
 
Reversing malware analysis training part7 unpackingupx
Reversing malware analysis training part7 unpackingupxReversing malware analysis training part7 unpackingupx
Reversing malware analysis training part7 unpackingupx
 
Reversing malware analysis training part2 introduction to windows internals
Reversing malware analysis training part2 introduction to windows internalsReversing malware analysis training part2 introduction to windows internals
Reversing malware analysis training part2 introduction to windows internals
 
Reversing malware analysis training part11 exploit development advanced
Reversing malware analysis training part11 exploit development advancedReversing malware analysis training part11 exploit development advanced
Reversing malware analysis training part11 exploit development advanced
 

Semelhante a Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques

How to drive a malware analyst crazy
How to drive a malware analyst crazyHow to drive a malware analyst crazy
How to drive a malware analyst crazyMichael Boman
 
44CON London 2015 - How to drive a malware analyst crazy
44CON London 2015 - How to drive a malware analyst crazy44CON London 2015 - How to drive a malware analyst crazy
44CON London 2015 - How to drive a malware analyst crazy44CON
 
Современные технологии и инструменты анализа вредоносного ПО
Современные технологии и инструменты анализа вредоносного ПОСовременные технологии и инструменты анализа вредоносного ПО
Современные технологии и инструменты анализа вредоносного ПОPositive Hack Days
 
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...Ivan Piskunov
 
How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...
How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...
How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...DevOpsDays Tel Aviv
 
Anti-Debugging - A Developers View
Anti-Debugging - A Developers ViewAnti-Debugging - A Developers View
Anti-Debugging - A Developers ViewTyler Shields
 
Formbook - In-depth malware analysis (Botconf 2018)
Formbook - In-depth malware analysis (Botconf 2018)Formbook - In-depth malware analysis (Botconf 2018)
Formbook - In-depth malware analysis (Botconf 2018)Rémi Jullian
 
Reversing & malware analysis training part 6 practical reversing (i)
Reversing & malware analysis training part 6 practical reversing (i)Reversing & malware analysis training part 6 practical reversing (i)
Reversing & malware analysis training part 6 practical reversing (i)Abdulrahman Bassam
 
nullcon 2011 - Reversing MicroSoft patches to reveal vulnerable code
nullcon 2011 - Reversing MicroSoft patches to reveal vulnerable codenullcon 2011 - Reversing MicroSoft patches to reveal vulnerable code
nullcon 2011 - Reversing MicroSoft patches to reveal vulnerable coden|u - The Open Security Community
 
Django - Know Your Namespace: Middleware
Django - Know Your Namespace: MiddlewareDjango - Know Your Namespace: Middleware
Django - Know Your Namespace: Middlewarehowiworkdaily
 
Inside the Matrix,How to Build Transparent Sandbox for Malware Analysis
Inside the Matrix,How to Build Transparent Sandbox for Malware AnalysisInside the Matrix,How to Build Transparent Sandbox for Malware Analysis
Inside the Matrix,How to Build Transparent Sandbox for Malware AnalysisChong-Kuan Chen
 
Hadoop: Code Injection, Distributed Fault Injection
Hadoop: Code Injection, Distributed Fault InjectionHadoop: Code Injection, Distributed Fault Injection
Hadoop: Code Injection, Distributed Fault InjectionCloudera, Inc.
 
Advanced System Security and Digital Forensics
Advanced System Security and Digital ForensicsAdvanced System Security and Digital Forensics
Advanced System Security and Digital ForensicsDr. Ramchandra Mangrulkar
 
Double agent zero-day code injection and persistence technique
Double agent zero-day code injection and persistence techniqueDouble agent zero-day code injection and persistence technique
Double agent zero-day code injection and persistence techniqueKarlFrank99
 
Open Source ERP Technologies for Java Developers
Open Source ERP Technologies for Java DevelopersOpen Source ERP Technologies for Java Developers
Open Source ERP Technologies for Java Developerscboecking
 
.Net Debugging Techniques
.Net Debugging Techniques.Net Debugging Techniques
.Net Debugging TechniquesBala Subra
 
.NET Debugging Tips and Techniques
.NET Debugging Tips and Techniques.NET Debugging Tips and Techniques
.NET Debugging Tips and TechniquesBala Subra
 

Semelhante a Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques (20)

How to drive a malware analyst crazy
How to drive a malware analyst crazyHow to drive a malware analyst crazy
How to drive a malware analyst crazy
 
44CON London 2015 - How to drive a malware analyst crazy
44CON London 2015 - How to drive a malware analyst crazy44CON London 2015 - How to drive a malware analyst crazy
44CON London 2015 - How to drive a malware analyst crazy
 
Современные технологии и инструменты анализа вредоносного ПО
Современные технологии и инструменты анализа вредоносного ПОСовременные технологии и инструменты анализа вредоносного ПО
Современные технологии и инструменты анализа вредоносного ПО
 
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...
 
AntiRE en Masse
AntiRE en MasseAntiRE en Masse
AntiRE en Masse
 
How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...
How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...
How We Analyzed 1000 Dumps in One Day - Dina Goldshtein, Brightsource - DevOp...
 
Anti-Debugging - A Developers View
Anti-Debugging - A Developers ViewAnti-Debugging - A Developers View
Anti-Debugging - A Developers View
 
Formbook - In-depth malware analysis (Botconf 2018)
Formbook - In-depth malware analysis (Botconf 2018)Formbook - In-depth malware analysis (Botconf 2018)
Formbook - In-depth malware analysis (Botconf 2018)
 
Reversing & malware analysis training part 6 practical reversing (i)
Reversing & malware analysis training part 6 practical reversing (i)Reversing & malware analysis training part 6 practical reversing (i)
Reversing & malware analysis training part 6 practical reversing (i)
 
Anti Debugging
Anti DebuggingAnti Debugging
Anti Debugging
 
nullcon 2011 - Reversing MicroSoft patches to reveal vulnerable code
nullcon 2011 - Reversing MicroSoft patches to reveal vulnerable codenullcon 2011 - Reversing MicroSoft patches to reveal vulnerable code
nullcon 2011 - Reversing MicroSoft patches to reveal vulnerable code
 
Django - Know Your Namespace: Middleware
Django - Know Your Namespace: MiddlewareDjango - Know Your Namespace: Middleware
Django - Know Your Namespace: Middleware
 
Inside the Matrix,How to Build Transparent Sandbox for Malware Analysis
Inside the Matrix,How to Build Transparent Sandbox for Malware AnalysisInside the Matrix,How to Build Transparent Sandbox for Malware Analysis
Inside the Matrix,How to Build Transparent Sandbox for Malware Analysis
 
Hadoop: Code Injection, Distributed Fault Injection
Hadoop: Code Injection, Distributed Fault InjectionHadoop: Code Injection, Distributed Fault Injection
Hadoop: Code Injection, Distributed Fault Injection
 
Advanced System Security and Digital Forensics
Advanced System Security and Digital ForensicsAdvanced System Security and Digital Forensics
Advanced System Security and Digital Forensics
 
JavaSecure
JavaSecureJavaSecure
JavaSecure
 
Double agent zero-day code injection and persistence technique
Double agent zero-day code injection and persistence techniqueDouble agent zero-day code injection and persistence technique
Double agent zero-day code injection and persistence technique
 
Open Source ERP Technologies for Java Developers
Open Source ERP Technologies for Java DevelopersOpen Source ERP Technologies for Java Developers
Open Source ERP Technologies for Java Developers
 
.Net Debugging Techniques
.Net Debugging Techniques.Net Debugging Techniques
.Net Debugging Techniques
 
.NET Debugging Tips and Techniques
.NET Debugging Tips and Techniques.NET Debugging Tips and Techniques
.NET Debugging Tips and Techniques
 

Mais de securityxploded

Fingerprinting healthcare institutions
Fingerprinting healthcare institutionsFingerprinting healthcare institutions
Fingerprinting healthcare institutionssecurityxploded
 
Hollow Process Injection - Reversing and Investigating Malware Evasive Tactics
Hollow Process Injection - Reversing and Investigating Malware Evasive TacticsHollow Process Injection - Reversing and Investigating Malware Evasive Tactics
Hollow Process Injection - Reversing and Investigating Malware Evasive Tacticssecurityxploded
 
Malicious Client Detection Using Machine Learning
Malicious Client Detection Using Machine LearningMalicious Client Detection Using Machine Learning
Malicious Client Detection Using Machine Learningsecurityxploded
 
Understanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case StudyUnderstanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case Studysecurityxploded
 
Linux Malware Analysis using Limon Sandbox
Linux Malware Analysis using Limon SandboxLinux Malware Analysis using Limon Sandbox
Linux Malware Analysis using Limon Sandboxsecurityxploded
 
Reverse Engineering Malware
Reverse Engineering MalwareReverse Engineering Malware
Reverse Engineering Malwaresecurityxploded
 
Partial Homomorphic Encryption
Partial Homomorphic EncryptionPartial Homomorphic Encryption
Partial Homomorphic Encryptionsecurityxploded
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memorysecurityxploded
 
Return Address – The Silver Bullet
Return Address – The Silver BulletReturn Address – The Silver Bullet
Return Address – The Silver Bulletsecurityxploded
 
Defeating public exploit protections (EMET v5.2 and more)
Defeating public exploit protections (EMET v5.2 and more)Defeating public exploit protections (EMET v5.2 and more)
Defeating public exploit protections (EMET v5.2 and more)securityxploded
 
Hunting Ghost RAT Using Memory Forensics
Hunting Ghost RAT Using Memory ForensicsHunting Ghost RAT Using Memory Forensics
Hunting Ghost RAT Using Memory Forensicssecurityxploded
 
Malicious Url Detection Using Machine Learning
Malicious Url Detection Using Machine LearningMalicious Url Detection Using Machine Learning
Malicious Url Detection Using Machine Learningsecurityxploded
 
Reversing and Decrypting the Communications of APT Malware (Etumbot)
Reversing and Decrypting the Communications of APT Malware (Etumbot)Reversing and Decrypting the Communications of APT Malware (Etumbot)
Reversing and Decrypting the Communications of APT Malware (Etumbot)securityxploded
 

Mais de securityxploded (20)

Fingerprinting healthcare institutions
Fingerprinting healthcare institutionsFingerprinting healthcare institutions
Fingerprinting healthcare institutions
 
Hollow Process Injection - Reversing and Investigating Malware Evasive Tactics
Hollow Process Injection - Reversing and Investigating Malware Evasive TacticsHollow Process Injection - Reversing and Investigating Malware Evasive Tactics
Hollow Process Injection - Reversing and Investigating Malware Evasive Tactics
 
Buffer Overflow Attacks
Buffer Overflow AttacksBuffer Overflow Attacks
Buffer Overflow Attacks
 
Malicious Client Detection Using Machine Learning
Malicious Client Detection Using Machine LearningMalicious Client Detection Using Machine Learning
Malicious Client Detection Using Machine Learning
 
Understanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case StudyUnderstanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case Study
 
Linux Malware Analysis using Limon Sandbox
Linux Malware Analysis using Limon SandboxLinux Malware Analysis using Limon Sandbox
Linux Malware Analysis using Limon Sandbox
 
Introduction to SMPC
Introduction to SMPCIntroduction to SMPC
Introduction to SMPC
 
Breaking into hospitals
Breaking into hospitalsBreaking into hospitals
Breaking into hospitals
 
Bluetooth [in]security
Bluetooth [in]securityBluetooth [in]security
Bluetooth [in]security
 
Basic malware analysis
Basic malware analysisBasic malware analysis
Basic malware analysis
 
Reverse Engineering Malware
Reverse Engineering MalwareReverse Engineering Malware
Reverse Engineering Malware
 
DLL Preloading Attack
DLL Preloading AttackDLL Preloading Attack
DLL Preloading Attack
 
Partial Homomorphic Encryption
Partial Homomorphic EncryptionPartial Homomorphic Encryption
Partial Homomorphic Encryption
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memory
 
Return Address – The Silver Bullet
Return Address – The Silver BulletReturn Address – The Silver Bullet
Return Address – The Silver Bullet
 
Defeating public exploit protections (EMET v5.2 and more)
Defeating public exploit protections (EMET v5.2 and more)Defeating public exploit protections (EMET v5.2 and more)
Defeating public exploit protections (EMET v5.2 and more)
 
Hunting Ghost RAT Using Memory Forensics
Hunting Ghost RAT Using Memory ForensicsHunting Ghost RAT Using Memory Forensics
Hunting Ghost RAT Using Memory Forensics
 
Malicious Url Detection Using Machine Learning
Malicious Url Detection Using Machine LearningMalicious Url Detection Using Machine Learning
Malicious Url Detection Using Machine Learning
 
MalwareNet Project
MalwareNet ProjectMalwareNet Project
MalwareNet Project
 
Reversing and Decrypting the Communications of APT Malware (Etumbot)
Reversing and Decrypting the Communications of APT Malware (Etumbot)Reversing and Decrypting the Communications of APT Malware (Etumbot)
Reversing and Decrypting the Communications of APT Malware (Etumbot)
 

Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques

  • 1. Advanced Malware Analysis Training Series www.SecurityXploded.com
  • 2. Disclaimer The Content, Demonstration, Source Code and Programs presented here is "AS IS" without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the trainer‟s only and nothing to do with the company or the organization in which the trainer is currently working. However in no circumstances neither the Trainer nor SecurityXploded is responsible for any damage or loss caused due to use or misuse of the information presented here. www.SecurityXploded.com
  • 3. Acknowledgement  Special thanks to Null community for their extended support and co-operation.  Special thanks to ThoughtWorks for the beautiful venue.  Thanks to all the trainers who have devoted their precious time and countless hours to make it happen. www.SecurityXploded.com
  • 4. Advanced Malware Analysis Training This presentation is part of our Advanced Malware Analysis Training program. Currently it is delivered only during our local meets for FREE of cost. For complete details of this course, visit our Security Training page. www.SecurityXploded.com
  • 5. Who am I? Swapnil Pathak  Security Researcher  Reversing, Malware Analysis, Exploit Analysis etc.  E-mail: swapnilpathak101@gmail.com www.SecurityXploded.com
  • 6. Agenda  Introduction  Anti-Reversing techniques  Anti-Debugging  Anti-VM  Anti-Anti-Reversing techniques  Q&A www.SecurityXploded.com
  • 7. Anti-Reversing  Implementation of techniques in code to hinder attempts at reverse engineering or debugging a target binary.  Used by commercial protectors, packers and malicious software  Covers  Anti-Debugging  Anti-VM  Anti-Disassembly  Code Obfuscation www.SecurityXploded.com
  • 8. Anti-Debug Techniques  Techniques implemented to detect if the program is running under control of a debugger.  Categorized as below  API Based  Flags Based  Timing Based  Exception Based  Breakpoint Detection www.SecurityXploded.com
  • 9. PEB (Process Environment Block)  Structure maintained by OS for each running process  Contains user mode parameters associated with a process  Including loaded modules list, debugger status etc  Referenced through fs:[30h]  !peb command in Windbg www.SecurityXploded.com
  • 11. API Based  IsDebuggerPresent  Exported by kernel32.dll  Function accepts no parameters  Checks if BeingDebugged flag in Process Environment Block (PEB) is set  Returns 1 if process is being debugged, 0 otherwise call IsDebuggerPresent test eax,eax jnz debugger_detected CheckRemoteDebuggerPresent => NtQueryInformationProcess  CheckRemoteDubggerPresent(Handle to the target process, Pointer to a variable  Sets the variable to TRUE if the specified process is being debugged or FALSE otherwise push offset dbg push -1 call CheckRemoteDebuggerPresent test eax, eax jne debugger_detected www.SecurityXploded.com
  • 12. API Based  NtQueryInformationProcess => ZwQueryInformationProcess  Exported by ntdll.dll  Retrieves information about the specified process.  NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength)  ProcessHandle – Handle to the process for which information is to be retrieved.  ProcessInformationClass : Type of process information to be retrieved. ○ Accepts following values : ProcessBasicInformation(0x0), ProcessDebugPort(0x07), ProcessWow64Information(0x26), ProcessImageFileName(0x27)  ProcessDebugPort : Retrieves port number of the debugger for the process.  Non Zero value indicates that the process is being debugged. www.SecurityXploded.com
  • 13. API Based  OutputDebugString  Exported by kernel32.dll  Accepts one parameter : Null terminated string to be displayed  Sends a string to the debugger for display  Sends an error if there is no active debugger for the process to receive the string.  No error indicates presence of a debugger.  FindWindow  Exported by user32.dll  Used to search windows by name or class.  Detect debugger with graphical user interface www.SecurityXploded.com
  • 14. API Based  CloseHandle  Exported by kernel32.dll  Involves passing invalid handle  If debugger present EXCEPTION_INVALID_HANDLE (0xC0000008) will be raised  Above exception if intercepted by an exception handler, indicates presence of a debugger. push 12ab ; any illegal value call CloseHandle www.SecurityXploded.com
  • 15. Flags Based  BeingDebugged Flag  Present in PEB ( Process Environment Block) at offset 0x2  Set to 1 if the process is being debugged. mov eax, dword [fs:0x30] movzx eax, byte [eax + 0x02] ; PEB.BeingDebugged test eax, eax jnz debugger_detected www.SecurityXploded.com
  • 16. Flags Based  NTGlobal Flag  Present in PEB ( Process Environment Block) at offset ○ 0x68 - 32 bit systems ○ 0xBC - 64 bit systems  Contains value 0x70 if the process is being debugged.  FLG_HEAP_ENABLE_TAIL_CHECK(0x10), FLG_HEAP_ENABLE_FREE_CHECK(0x20), FLG_HEAP_VALIDATE_PARAMETERS(0x40) mov eax, fs :[30h] mov eax, [eax+68h] and eax, 0x70 test eax, eax jne debugger_detected www.SecurityXploded.com
  • 17. Flags Based  Heap Flags  ProcessHeap present in PEB ( Process Environment Block) at offset 0x18  Has Flags and ForceFlags Fields set to 0x02 (HEAP_GROWABLE) and 0x0 respectively if the process is not being debugged. mov eax, fs:[30h] mov eax, [eax + 18h] ; eax = PEB.ProcessHeap cmp [eax + 10h] , 0 ; ProcessHeap.ForceFlags jne debugger_detected cmp [eax + 0x0c], 2 ; ProcessHeap.Flags jne debugger_detected www.SecurityXploded.com
  • 18. Timing Based  Timing Checks  Compares time spent executing instructions normally and while being debugged.  Longer time taken compared to normal run indicates that the binary is being debugged.  RDTSC ( Read Time Stamp Counter)  GetTickCount()  QueryPerformanceCounter() rdtsc mov eax, ebx ……. rdtsc sub eax, ecx cmp eax, 0x100 ja debugger_detected www.SecurityXploded.com
  • 19. Exception Based  Interrupts  Consists of inserting interrupt instructions in middle of valid sequence of instructions.  INT3 breakpoint (0xCC, 0xCD 0x03)  INT 1 single step INT2D are stepped through inside the debugger, exception is raised.  If the process is being debugged, exception handler is not invoked as the debugger typically handles the exception  Checks such as setting of flags inside exception handler are used to detect presence of the debugger. www.SecurityXploded.com
  • 20. Breakpoint Detection  Hardware Breakpoints  Whenever an exception occurs, a context structure is created and passed to the exception handler.  Context structure contains values of general registers, control registers, debug registers.  Binary being debugged with hardware breakpoints in use will contain values in debug registers indicating presence of debugger.  Memory Breakpoints  Implemented using Guard pages.  Guard Pages are set using the PAGE_GUARD page protection modifier.  Address accessed part of Guard Page will result in STATUS_GUARD_PAGE_VIOLATION exception.  Process being debugged under Ollydbg will treat this as a memory breakpoint and no exception will be raised. www.SecurityXploded.com
  • 21. VM Detection  Techniques implemented to detect if the binary is being executed in a virtual environment.  Techniques include  Memory based  Backdoor I/O communication port  Process/Registry www.SecurityXploded.com
  • 22. Techniques  Memory specific techniques include Red Pill  Only one IDT, GDT, LDT per processor.  IDT : Used by OS to determine correct response to interrupts and exceptions  GDT/LDT : Define characteristics of the various memory areas used during program execution such as base address, size and access privileges.  IDTR, GDTR, LDTR are internal registers that store the address of these respective tables.  To avoid conflicts between host and guest OS , virtual machine needs to relocate IDT, GDT, LDT  SIDT, SGDT and SLDT are instructions to retrieve values from IDTR, GDTR and LDTR respectively.  Base address stored in the register define if under Virtualized environment.  IDT is at 0x80ffffff in Windows, 0xE8xxxxxx in VirtualPC, 0xFFxxxxxx in Vmware. www.SecurityXploded.com
  • 24. Techniques  Backdoor I/O port  OS running inside a VMWware uses port name „VX‟ for communication between the host and guest OS.  Data from this port can be read using various opcodes using “IN” instruction ○ 0x0A provides Vmware version. ○ 0x14 gets the memory size. ○ Value checked against „VMXh‟ to detect presence of Vmware  Process/Service Check  Check for Vmware related process, services  Process Name ( Associated Service Name )  vmacthlp.exe ( Vmware Physical Disk Helper Service )  vmtoolsd.exe ( Vmware Tools ) www.SecurityXploded.com
  • 25. Anti-Anti-Debug Techniques  Manually patch values in memory, registers, return values from APIs  NOP sequence of instructions  Use of Plugins  OllyAdvanced  HideDebugger  Phantom  Anti-Anti-Debugger Plugins : https://code.google.com/p/aadp/ www.SecurityXploded.com
  • 26. OllyDbg Screenshots www.SecurityXploded.com
  • 27. References Complete Reference Guide for Advanced Malware Analysis Training [Include links for all the Demos & Tools] www.SecurityXploded.com
  • 28. Thank You ! www.SecurityXploded.com www.SecurityXploded.com