Skip to content

Commit b9098d4

Browse files
author
hippwn
committed
Add common and windows to the paper
1 parent 546c7e2 commit b9098d4

File tree

6 files changed

+144
-74
lines changed

6 files changed

+144
-74
lines changed

‎paper/20_virtualisation.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ storage to the networks.
1414
## Isolation
1515

1616
This is an old concept on Linux-based systems which has more recently appeared
17-
on Windows 10 (1803) . It is not really a virtualisation but more of a way of
17+
on Windows 10 (1803). It is not really a virtualisation but more of a way of
1818
running a process in an independent environment that we call *context*. The
1919
isolated process access and system calls are filtered so that it is not aware
2020
of the host he's running on. This is basically the way containers work (LXC,

‎paper/30_state_of_the_art.md

Lines changed: 0 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -33,76 +33,3 @@ int swallow_redpill ()
3333
return (m[5]>0xd0) ? 1 : 0;
3434
}
3535
```
36-
37-
## Linux techniques
38-
39-
### The DMI table
40-
41-
DMI stands for *Desktop Management Interface*. It is a standard developed in
42-
the 90' with de goal of uniforming the tracking of the components in a computer
43-
and abstracting them from the softwares supposed to run them. Parsing this
44-
table can reveal practical information on the hardware used by the operating
45-
system and possibly detect the presence of names specific to virtualized
46-
environment, such as *vbox*, *virtualbox*, *oracle*, *qemu*, *kvm* and so on.
47-
48-
### Linux kernel's hypervisor detection
49-
50-
Linux's kernel comes with an hypervisor detection feature that can be used to
51-
identify a potential hypervisor below the operating system. Based on this, we
52-
easily can listen for the kernel event to see if an hypervisor has been
53-
detected by the kernel:
54-
55-
```c
56-
static inline const struct hypervisor_x86 * __init
57-
detect_hypervisor_vendor(void)
58-
{
59-
const struct hypervisor_x86 *h = NULL, * const *p;
60-
uint32_t pri, max_pri = 0;
61-
62-
for (p = hypervisors; p < hypervisors + ARRAY_SIZE(hypervisors); p++) {
63-
if (unlikely(nopv) && !(*p)->ignore_nopv)
64-
continue;
65-
66-
pri = (*p)->detect();
67-
if (pri > max_pri) {
68-
max_pri = pri;
69-
h = *p;
70-
}
71-
}
72-
73-
if (h)
74-
// this line prints the hypervisor in the `/dev/kmsg` file
75-
pr_info("Hypervisor detected: %s\n", h->name);
76-
77-
return h;
78-
}
79-
```
80-
81-
### Checking Linux's pseudo-filesystems
82-
83-
Linux provides a lot of information via a certain type of files (mostly in
84-
`/proc`) that are generated at boot and modified during runtime. A lot of
85-
binaries use this directory like `ps`, `uname`, `lspci` and so on. These
86-
information are really helpful when trying to identify wether or not you are
87-
in a virtualized environment, like UML for instance. UML refers to the
88-
aforementioned way of executing a Linux kernel in user-space. This can easily
89-
be verified by looking for the string "User Mode Linux" in the file
90-
`/proc/cpuinfo` which describes the CPU of the machine.
91-
92-
In the same way, a lot of these virtual *files* can provide information on the
93-
environment, including &ndash; but not limited to &ndash; `/proc/sysinfo` (in
94-
which some distribution expose data about virtual machines),
95-
`/proc/device-tree` (that lists the devices on the machine), `/proc/xen` (a
96-
file created by the *Xen Server*) or `/proc/modules` (that contains information
97-
about the loaded kernel modules, modules that are used by hypervisors to
98-
optimize the guests).
99-
100-
Like *procfs* (mounted in `/proc`), *sysfs* can be useful. Its role is to
101-
provide to the user an access to the devices and their drivers. The file
102-
`/sys/hypervisor/type`, for instance, is sometimes used to store information
103-
about the hypervisor Linux is running on.
104-
105-
106-
## Windows
107-
108-
<!-- TODO -->

‎paper/31_common.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
\newpage
2+
3+
## Cross-platform solutions
4+
5+
When developing a malware, people usually target an operating system, as it can
6+
be pretty difficult to build something that works as expected on each
7+
environment. Moreover, releasing variants of the same binary (compiled for the
8+
different environments) can facilitate the work of malware analysts. Despite
9+
these considerations, we aimed our researches toward cross-platform solutions
10+
in order to mutualize efforts.
11+
12+
### Networking
13+
14+
Network adapters usually come with a MAC address (*MAC* stands for Media Access
15+
Control, referring to the lowest part of the OSI model) which can be used to
16+
identify its vendor. The first half of the address (the first 3 bytes) are
17+
booked by constructors with the IEEE (Institute of Electrical and Electronics
18+
Engineers, an international organisation dedicated to the writing of standards
19+
for new technologies) to make the OUI, an unique vendor identifier.
20+
21+
Most hypervisors have an OUI so that it makes the network adapter easily
22+
recognizable for the guest system. So if the a system sees such an OUI on its
23+
network adapter, it is highly likely that it is a virtualized guest.
24+
25+
### Using CPUID
26+
27+
THe `CPUID` instruction has been introduced with Intel's *x86* architecture to
28+
allow CPU discovery by the operating system. This way, the system can adapt its
29+
behaviour to the characteristics of the processor. The use of this instruction
30+
has been extended in 2008 to allow the hypervisor to "interact" with the guest
31+
and thus optimizing its performance. By watching specific values of certain
32+
registers &ndash; mostly EBX, ECX, EDX &ndash; we can deduce the hypervisor if
33+
any.
34+
35+
### Measuring resources availability
36+
37+
Finally, low resources may be an indication that the operating system is
38+
running inside a sandbox or virtual machine. It surely cannot be used as the
39+
only clue but it can lead you to investigate: most sandboxes are ran on the
40+
laptop of the analyst, who often will give the fewest resources they can. That
41+
is why we look for resources below 3 vCPUs or 3 GB of RAM.

‎paper/32_linux.md

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
\newpage
2+
3+
## Linux techniques
4+
5+
### The DMI table
6+
7+
DMI stands for *Desktop Management Interface*. It is a standard developed in
8+
the 90' with de goal of uniforming the tracking of the components in a computer
9+
and abstracting them from the softwares supposed to run them. Parsing this
10+
table can reveal practical information on the hardware used by the operating
11+
system and possibly detect the presence of names specific to virtualized
12+
environment, such as *vbox*, *virtualbox*, *oracle*, *qemu*, *kvm* and so on.
13+
14+
### Linux kernel's hypervisor detection
15+
16+
Linux's kernel comes with an hypervisor detection feature that can be used to
17+
identify a potential hypervisor below the operating system. Based on this, we
18+
easily can listen for the kernel event to see if an hypervisor has been
19+
detected by the kernel:
20+
21+
```c
22+
static inline const struct hypervisor_x86 * __init
23+
detect_hypervisor_vendor(void)
24+
{
25+
const struct hypervisor_x86 *h = NULL, * const *p;
26+
uint32_t pri, max_pri = 0;
27+
28+
for (p = hypervisors; p < hypervisors + ARRAY_SIZE(hypervisors); p++) {
29+
if (unlikely(nopv) && !(*p)->ignore_nopv)
30+
continue;
31+
32+
pri = (*p)->detect();
33+
if (pri > max_pri) {
34+
max_pri = pri;
35+
h = *p;
36+
}
37+
}
38+
39+
if (h)
40+
// this line prints the hypervisor in the `/dev/kmsg` file
41+
pr_info("Hypervisor detected: %s\n", h->name);
42+
43+
return h;
44+
}
45+
```
46+
47+
### Checking Linux's pseudo-filesystems
48+
49+
Linux provides a lot of information via a certain type of files (mostly in
50+
`/proc`) that are generated at boot and modified during runtime. A lot of
51+
binaries use this directory like `ps`, `uname`, `lspci` and so on. These
52+
information are really helpful when trying to identify wether or not you are
53+
in a virtualized environment, like UML for instance. UML refers to the
54+
aforementioned way of executing a Linux kernel in user-space. This can easily
55+
be verified by looking for the string "User Mode Linux" in the file
56+
`/proc/cpuinfo` which describes the CPU of the machine.
57+
58+
In the same way, a lot of these virtual *files* can provide information on the
59+
environment, including &ndash; but not limited to &ndash; `/proc/sysinfo` (in
60+
which some distribution expose data about virtual machines),
61+
`/proc/device-tree` (that lists the devices on the machine), `/proc/xen` (a
62+
file created by the *Xen Server*) or `/proc/modules` (that contains information
63+
about the loaded kernel modules, modules that are used by hypervisors to
64+
optimize the guests).
65+
66+
Like *procfs* (mounted in `/proc`), *sysfs* can be useful. Its role is to
67+
provide to the user an access to the devices and their drivers. The file
68+
`/sys/hypervisor/type`, for instance, is sometimes used to store information
69+
about the hypervisor Linux is running on.
70+

‎paper/33_windows.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
\newpage
2+
3+
## Windows
4+
5+
On Windows, most configuration can be done through the *Registry Hive* &ndash;
6+
some kind of database that contains every configuration option about either the
7+
operating system itself, or any software that would like to store information
8+
in it. A lot of indicators of hypervisors can be stored there, especially if
9+
the *guest addons* (small pieces of software that are installed on the guest
10+
to allow interoperability between the guest and the host, permitting shared
11+
clipboard, *drag'n'drop* and so on) are installed.
12+
13+
Most keys will be installed inside the `HKEY_LOCAL_MACHINE` register which
14+
mostly contains information about hardware, security and such. Parsing its
15+
content looking for particular patterns is efficient enough and quite a good
16+
indicator of the presence of an hypervisor if any. Here is an example of keys
17+
that we are looking for:
18+
19+
```golang
20+
virtualBoxKeys := []string{
21+
`HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE*`,
22+
`HKLM\HARDWARE\ACPI\DSDT\VBOX__`,
23+
`HKLM\HARDWARE\ACPI\FADT\VBOX__`,
24+
`HKLM\HARDWARE\ACPI\RSDT\VBOX__`,
25+
`HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions`,
26+
`HKLM\SYSTEM\ControlSet001\Services\VBoxGuest`,
27+
`HKLM\SYSTEM\ControlSet001\Services\VBoxMouse`,
28+
`HKLM\SYSTEM\ControlSet001\Services\VBoxService`,
29+
`HKLM\SYSTEM\ControlSet001\Services\VBoxSF`,
30+
`HKLM\SYSTEM\ControlSet001\Services\VBoxVideo`,
31+
}
32+
```

‎paper/paper.pdf

8.57 KB
Binary file not shown.

0 commit comments

Comments
 (0)