Hack Forums
[Assembly] Anti Emulator MASM with memory allocation, breaks every emulator - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Coders Lounge (https://hackforums.net/forumdisplay.php?fid=5)
+---- Thread: [Assembly] Anti Emulator MASM with memory allocation, breaks every emulator (/showthread.php?tid=5191261)

Pages: Pages 1 2

* - push r12 - Mar 24, 2016

(Mar 4, 2016 07:07 PM)Masm4ever Wrote:  Depends on the emulator.

There are plenty of reasons why HeapAlloc could fail.

If it doesn't contain that value, the emulator is buggy.

The AV must be incredibly dumb to interpret an access violation as "clean" code.

Here is a shorter version of "your" code. Show me an "emulator" that produces the !=123😎
Code
include \masm32\include\masm32rt.inc
.code
start:
mov ecx, 154720540
push ecx
invoke HeapAlloc, rv(GetProcessHeap), 0, ecx
pop ecx
.if eax
    xchg eax, edi
    push edi
    mov al, 123
    rep stosb
    push 0
    .if [edi-1] != al
        xor esp, esp
    .endif
    call GetProcessHeap
    push eax
    call HeapFree
    invoke MessageBox, 0, chr$("my code"), chr$("it's not emulated:"), MB_OK
.endif
invoke ExitProcess, 0
end start

It's 2016 and OP thinks junk calls do anything for creating an undetected binary.

Flagging systems exist, it's 2016. 👍

* - wong - May 1, 2016

Great man, helped me much, thank you

* - ๖ۣۜDead - May 10, 2016

This method is similar to VirtualAllocExNumA AV bypass but it should work on every Windows

* - Wardow - May 10, 2016

(May 10, 2016 12:20 AM)TheL0rd Wrote:  This method is similar to VirtualAllocExNumA AV bypass but it should work on every Windows

VirtualAllocExNumA is not available on all systems counting on a range from Windows XP to Windows 10, this is likely to decrease execution rate and not a reliable method to base on, I'm sharing this, but there is also regular methods that will always work such as complex anti-emulator loops, they are so easy to make and always works, but obviously delays execution from a bit.

* - ๖ۣۜDead - May 10, 2016

Indeed but there is much shorten code which is unsaturated.
Opcode RDTSC hxxps://en.wikipedia.org/wiki/Time_Stamp_Counter
This opcode may have several variants so CPUID is not bad idea
Just in one proc place RDTSC twice and sub 2 values. If result is higher than ~100, code is emulated.
It may be used inside your code

pseudo:

RDTSC
MOV t0,EAX
RDTSC
MOV t1, EAX
SUB t1,t0
CMP EAX, 100
JG @DETECTED

Emulation have own abnormal features. Eg. you can obtain handle to kernel process from OpenProcess without privileges etc.

* - Wardow - May 10, 2016

(May 10, 2016 01:19 AM)TheL0rd Wrote:  Indeed but there is much shorten code which is unsaturated.
Opcode RDTSC hxxps://en.wikipedia.org/wiki/Time_Stamp_Counter
This opcode may have several variants so CPUID is not bad idea
Just in one proc place RDTSC twice and sub 2 values. If result is higher than ~100, code is emulated.
It may be used inside your code

pseudo:

RDTSC
MOV t0,EAX
RDTSC
MOV t1, EAX
SUB t1,t0
CMP EAX, 100
JG @DETECTED

Emulation have own abnormal features. Eg. you can obtain handle to kernel process from OpenProcess without privileges etc.

Such bugs in emulators are very likely to be fixed easily, here is the Eset's reply about that emulator piece of code:

Spoiler (Click to View)

I prefer limitations than exploits of bugs :)

* - ๖ۣۜDead - May 10, 2016

Well, that only confirming that AVs are made by shitcoders

* - Wardow - May 10, 2016

(May 10, 2016 01:40 AM)TheL0rd Wrote:  Well, that only confirming that AVs are made by shitcoders

We both know that since a while 🤗

* - ng-Coder - May 11, 2016

(May 10, 2016 12:58 PM)Wardow Wrote:  We both know that since a while 🤗

Good of you Wardow, nice share.

This bypass AV's emulation at the moment doesn't mean comodo, kaspersky or esset coders are shit.

trust me, few good AV vendors are having very smart coders but the thing is no AV/code can perform magic.

they'll continue updating their modules and DB while you also continue updating your code.

* - Wardow - May 11, 2016

(May 11, 2016 03:07 AM)ng-Coder Wrote:  Good of you Wardow, nice share.

This bypass AV's emulation at the moment doesn't mean comodo, kaspersky or esset coders are shit.

trust me, few good AV vendors are having very smart coders but the thing is no AV/code can perform magic.

they'll continue updating their modules and DB while you also continue updating your code.

There is still pretty easy way to detect such methods that I posted here, they clearly announced it's a limitation.

* - G0dl1k3 - May 12, 2016

thanks for share :) - ill try to implement for some of my source codes, ill come back with result :)

* - Hoody - Jun 17, 2016

So essentially... you malloc out 147 Mb of ram, and since the AV vm isnt going to complete the request it will stop the virtualization? Is that the theory here? If so its nothing all that new. Also, creating tcp sockets with fake urls is a good method. Havent checked if it works in a while, but my guess is yes?

EDIT: Also, youll want to use 8 (HEAP_ZERO_MEMORY) as the dwFlag for HeapAlloc. If you dont there could already be a 123 byte in the allocation and it would stop early, possibly allowing the antivirus virtual machine to execute the payload

* - Nitai - Jul 9, 2016

The idea is pretty clever, however AVs is capable detecting anti emulation tricks using AI. but you still can break them :)

* - PELock - Sep 8, 2016

I suggest SSE2 instructions :) or hell even AVX at the start. Btw RDTSC will fail on multicore CPUs (it can return false results when used to measure the execution time), use QueryPerformanceCounter and QueryPerformanceFrequency.

* - sepluv - Jun 10, 2017

This seems pretty interesting. Definitely going to test it out. What emulators have you tested it with so far?