【攻防技术系列+沙箱】反虚拟机+基于时间的沙箱逃逸

沙箱仿真时间很少超过3-5分钟，恶意软件可以sleep一段时间再运行恶意功能，但是现在沙箱有sleep-skipping技术很快执行完sleep，类似加速器，一次可以检测时间差来判断

#include <windows.h>
#include <stdio.h>

// Definitions for NtDelayExecution
typedef NTSTATUS (WINAPI *fnNtDelayExecution)(
  BOOLEAN Alertable,
  PLARGE_INTEGER DelayInterval
);

// Function to check if the system is a virtual machine
BOOL checkVM() {
  // Get the system uptime before sleeping
  ULONG64 uptimeBeforeSleep = GetTickCount64();

  // Dynamically obtain the address of NtDelayExecution
  HMODULE ntdll = GetModuleHandle("ntdll.dll");
  fnNtDelayExecution myNtDelayExecution = (fnNtDelayExecution)GetProcAddress(ntdll, "NtDelayExecution");

  // Check if the function is successfully obtained
  if (!myNtDelayExecution) {
    printf("Failed to obtain NtDelayExecution function address.\n");
    return FALSE;
  }

  // Set the sleep time (in 100-nanosecond intervals) - adjust as needed
  LARGE_INTEGER sleepInterval;
  sleepInterval.QuadPart = -10000000; // 1 second

  // Call NtDelayExecution to sleep
  myNtDelayExecution(FALSE, &sleepInterval);

  // Get the system uptime after sleeping
  ULONG64 uptimeAfterSleep = GetTickCount64();

  // Calculate the actual sleep time in milliseconds
  ULONG64 actualSleepTime = uptimeAfterSleep - uptimeBeforeSleep;

  // Print the actual sleep time
  printf("Actual sleep time: %llu milliseconds\n", actualSleepTime);

  // Check if the actual sleep time is close to the expected sleep time
  // This is just a basic example, you might want to adjust the threshold based on your specific use case
  if (actualSleepTime < 1000 && actualSleepTime > 800) {
    printf("Likely not a virtual machine.\n");
  } else {
    printf("Possibly a virtual machine.\n");
  }

  return TRUE;
}

int main() {
  if (checkVM()) {
    // Handle virtual machine detected case
    MessageBox(NULL, "Meow!", "=^..^=", MB_OK);
  } else {
    // Handle non-virtual machine case
    MessageBox(NULL, "Squeak!", "=^..^=", MB_OK);
  }
  return 0;
}

编译

x86_64-w64-mingw32-g++ -O2 hack.c -o hack.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive

计算时间差值，判断是不是在沙箱中