Sandbox Detection Using Hardware Side Channels

Lusky, Yehonatan; Mendelson, Avi

doi:10.1109/isqed51717.2021.9424260

Cited by 5 publications

(2 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Furthermore, hardware-based artifacts such as processor's cache actualization [74], scheduling leakage in simultaneous multithreading (SMT) [59], as well as timing side effects [72] of monitoring facilities can be observed by evasive malware.…”

Section: Related Workmentioning

confidence: 99%

HyperDbg: Reinventing Hardware-Assisted Debugging

Karvandi

Gholamrezaei

Monfared

et al. 2022

Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Software analysis, debugging, and reverse engineering have a crucial impact in today's software industry. Efficient and stealthy debuggers are especially relevant for malware analysis. However, existing debugging platforms fail to address a transparent, effective, and high-performance low-level debugger due to their detectable fingerprints, complexity, and implementation restrictions.In this paper, † we present a new hypervisor-assisted debugger for high-performance and stealthy debugging of user and kernel applications. To accomplish this, HyperDbg relies on state-of-theart hardware features available in today's CPUs, such as VT-x and Extended Page Table (EPT). In contrast to other widely used existing debuggers, we design HyperDbg using a custom hypervisor, making it independent of OS functionality or API. We propose hardware-based instruction-level emulation and OS-level API hooking via extended page tables to increase the stealthiness. Our results of the dynamic analysis of 10,853 malware samples show that Hy-perDbg's stealthiness allows debugging on average 22% and 26% more samples than WinDbg and x64dbg, respectively. Moreover, in contrast to existing debuggers, HyperDbg is not detected by any of the 13 tested packers and protectors. We improve the performance over other debuggers by deploying a VMX-compatible script engine, eliminating unnecessary context switches. Our experiment on three concrete debugging scenarios shows that compared to WinDbg as the only kernel debugger, HyperDbg performs step-in, conditional breaks, and syscall recording, 2.98x, 1319x, and 2018x faster, respectively. We finally show real-world applications, such as

show abstract

Section: Related Workmentioning

confidence: 99%

HyperDbg: Reinventing Hardware-Assisted Debugging

Karvandi

Gholamrezaei

Monfared

et al. 2022

Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…Furthermore, hardware-based artifacts such as processor's cache actualization [75], scheduling leakage in simultaneous multithreading (SMT) [62], as well as timing side effects [72] of monitoring facilities can be observed by evasive malware.…”

Section: Related Workmentioning

confidence: 99%

HyperDbg: Reinventing Hardware-Assisted Debugging

Karvandi¹,

Gholamrezaei²,

Monfared³

et al. 2022

Preprint

View full text Add to dashboard Cite

Software analysis, debugging, and reverse engineering have a crucial impact in today’s software industry. Efficient and stealthy debuggers are especially relevant for malware analysis. However, existing debugging platforms fail to address a transparent, effective, and high-performance low-level debugger due to their detectable fingerprints, complexity, and implementation restrictions. In this paper, we present HyperDbg, a new hypervisor-assisted debugger for high-performance and stealthy debugging of user and kernel applications. To accomplish this, HyperDbg relies on state-of-the-art hardware features available in today’s CPUs, such as VT-x and extended page tables. In contrast to other widely used existing debuggers, we design HyperDbg using a custom hypervisor, making it independent of OS functionality or API. We propose hardware-based instruction-level emulation and OS-level API hooking via extended page tables to increase the stealthiness. Our results of the dynamic analysis of 10,853 malware samples show that HyperDbg’s stealthiness allows debugging on average 22% and 26% more samples than WinDbg and x64dbg, respectively. Moreover, in contrast to existing debuggers, HyperDbg is not detected by any of the 13 tested packers and protectors. We improve the performance over other debuggers by deploying a VMX-compatible script engine, eliminating unnecessary context switches. Our experiment on three concrete debugging scenarios shows that compared to WinDbg as the only kernel debugger, HyperDbg performs step-in, conditional breaks, and syscall recording, 2.98x, 1319x, and 2018x faster, respectively. We finally show real-world applications, such as a 0-day analysis, structure reconstruction for reverse engineering, software performance analysis, and code-coverage analysis.

show abstract

Towards Next-Generation Smart Sandboxes: Comprehensive Approach to Mobile Application Security

Gucuyener,

Guvensan

2024

2024 12th International Symposium on Digital Forensics and Security (ISDFS)

View full text Add to dashboard Cite

Sandbox Detection Using Hardware Side Channels

Cited by 5 publications

References 19 publications

HyperDbg: Reinventing Hardware-Assisted Debugging

HyperDbg: Reinventing Hardware-Assisted Debugging

HyperDbg: Reinventing Hardware-Assisted Debugging

Towards Next-Generation Smart Sandboxes: Comprehensive Approach to Mobile Application Security

Contact Info

Product

Resources

About