Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Microsoft VirtualPC 2004 (build 528) Detection

Topic created on: September 4, 2006 05:57 CDT by GynvaelColdwind .

Hi ;>

Recently I was codding a disassembler, and found something interesing. Mainly, the way that disassemblers treat REP/REPNE prefixes differs in every disassembler. It looks like it differs also in CPU -emulators- like VirtualPC.

If a real-life CPU executes the following code:
REP REP REP ... (15xREP total) ... REP MOVSB, an "Illegal Instruction" exception is generated. If there are 14xREP total, the exception is not generated. Well. It looks like VirtualPC 2004 does not generate the exception even if there are 15xREP. So this can be used to detect if the application is runned from VPC ;>

Could anyone check this on QEMU or Bochs, or on different build of VirtualPC ? VMWare behaves just like the real CPU.

proof of concept code follows:

binary:
http://www.openrce.org/repositories/users/GynvaelColdwind/vpcredpill.exe

source:

--vpcredpill.asm---
; masm32
; research & code by gynvael.coldwind//vx
; special thx to ReWolf (even more research ;>) & vul7ur3 (testing)
.386
.model flat, stdcall
option casemap :none   ; case sensitive

include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc

includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib

.code

start:
  ; some strings
  jmp @F
    szDlgTitle    db "VirtualPC 2004 RedPill (by gynvael.coldwind//vx)",0
    szMsgOFF      db "VirtualPC was NOT detected",0
    szMsgON       db "VirtualPC DETECTED!",0
  @@:

  ; SEH
  xor eax, eax
  push offset detected
  db 064h ; FS
  push dword ptr [eax]
  db 064h ; FS
  mov dword ptr [eax], esp

  ; teh RedPill
  mov esi, esp
  mov edi, esp
  mov ecx, 1

  ; This is REP REP REP REP ... REP movsb
  ; 15 * REP generate 'Invalid Instruction' exception on real CPU (tested on both Intel and AMD)
  ; Microsoft Virtual PC 2004 does NOT generate this exception.
  db 0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h,0F3h;
  movsb    

  ; was found!
  invoke MessageBox, 0, ADDR szMsgON, ADDR szDlgTitle, MB_OK
  invoke ExitProcess, 0

detected:
  invoke MessageBox, 0, ADDR szMsgOFF, ADDR szDlgTitle, MB_OK
  invoke ExitProcess, 0
  
end start

  GynvaelColdwind     September 4, 2006 16:07.31 CDT
I've just checked it with qemu-0.8.2. Seems that qemu-0.8.2 can also be detected with this method.

  n4v4r4j   September 7, 2006 01:00.33 CDT
vmware not detected (;

  FX     September 7, 2006 09:08.07 CDT
> GynvaelColdwind: Hi ;>
>
> If a real-life CPU executes the following code:
> REP REP REP ... (15xREP total) ... REP MOVSB, an \"Illegal Instruction\" exception is
> generated. If there are 14xREP total, the exception is not generated.

If you look into the Intel IA-32 Manual, it states:

"2.2. INSTRUCTION PREFIXES
The instruction prefixes are divided into four groups, each with a set of allowable prefix codes:
- Group 1 Lock and repeat prefixes:
    - F0 HLOCK.
    - F2 HREPNE/REPNZ (used only with string instructions).
    - F3 HREP or REPE/REPZ (use only with string instructions).
- Group 2 Segment override prefixes:
[... and so on ...]

For each instruction, one prefix may be used from each of these groups and be placed in any order. Using redundant prefixes (more than one prefix from a group) is reserved and may cause unpredictable behavior."

The last bit about the redundant prefixes is the interesting bit. Now, one could think that using anything that the IA-32 Vol2 declares as "unpredictable behavior" is likely to identify virtual machine products. How about this, a few lines below in the same document:

"The branch hint prefixes allow a program to give a hint to the processor about the most likely code path that will be taken at a branch. These prefixes can only be used with the conditional branch instructions (Jcc). Use of these prefixes with other IA-32 instructions is reserved and may cause unpredictable behavior."

FX

  GynvaelColdwind     September 7, 2006 11:29.56 CDT
bochs was not detected

FX
"Now, one could think that using anything that the IA-32 Vol2 declares as "unpredictable behavior" is likely to identify virtual machine products."

That makes sense ;>

Note: Registration is required to post to the forums.

There are 31,016 total registered users.


Recently Created Topics
Ultimate Hacking Cha...
Jun/21
CreateMutex
May/31
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Immunity Debugger Re...
Aug/03


Recent Forum Posts
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
OOP_RE tool available?
van7hu
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack


Recent Blog Entries
nieo
Mar/22
Android Application Reversing

halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit