bypassing-anti-vm-and-sandbox-checks

Name: bypassing-anti-vm-and-sandbox-checks
Author: meltedinhex

18stars5forks

How to install bypassing-anti-vm-and-sandbox-checks?

meltedinhex/analyst-ai-pack/bypassing-anti-vm-and-sandbox-checks

$npx -y skills add meltedinhex/analyst-ai-pack --skill bypassing-anti-vm-and-sandbox-checks

Installs into the current project.

Summary

Bypasses anti-VM and sandbox checks during analysis by locating the specific detection

Files · 1

View on GitHub

SKILL.md

1	# Bypassing Anti-VM and Sandbox Checks
2
3	## When to Use
4
5	- An evasive sample refuses to detonate under analysis and you need to locate and neutralize its
6	anti-VM/sandbox checks (artifact strings, timing stalls, CPUID hypervisor bit, MAC/registry
7	checks).
8	- You are planning patches or environment hardening to force execution.
9
10	Do not use patching as a shortcut that changes malicious logic — patch only the evasion gate.
11	Run only in an isolated, instrumented VM with snapshots.
12
13	## Prerequisites
14
15	- The sample and a debugger/disassembler on an isolated VM.
16
17	## Safety & Handling
18
19	- The sample executes during bypass work; use a disposable, snapshotted, network-controlled VM.
20
21	## Workflow
22
23	### Step 1: Locate the evasion checks
24
25	```bash
26	python scripts/analyst.py locate sample.bin
27	```
28
29	Reports offsets of anti-VM artifact strings, timing APIs (`GetTickCount`, `rdtsc`), CPUID usage,
30	and environment-fingerprint APIs to point you at the detection routines.
31
32	### Step 2: Plan the bypass
33
34	For each check decide the approach: patch the conditional jump after the check, hook/stub the API
35	to return benign values, or harden the VM (rename adapters, patch registry, add fake processes).
36
37	### Step 3: Apply and verify
38
39	Patch the gate (e.g., force the "not detected" branch) and confirm the sample proceeds past the
40	check.
41
42	### Step 4: Document
43
44	Record each check, its offset, and the bypass applied for reproducibility.
45
46	## Validation
47
48	- Each located check maps to a real detection primitive (string/timing/CPUID/API).
49	- The patched/hooked gate provably lets execution continue.
50	- Only the evasion gate is altered, not the payload logic.
51
52	## Pitfalls
53
54	- Multiple layered checks — bypassing one is not enough.
55	- Timing checks needing instruction-accurate handling (`rdtsc` deltas).
56	- Anti-tamper detecting the patch; prefer hooking returns over byte patches when fragile.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the locator.
61	- ATT&CK T1497 and the CPUID hypervisor bit reference (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

bypassing-anti-vm-and-sandbox-checks

18stars5forks

View on GitHub

How to install bypassing-anti-vm-and-sandbox-checks?

meltedinhex/analyst-ai-pack/bypassing-anti-vm-and-sandbox-checks

$npx -y skills add meltedinhex/analyst-ai-pack --skill bypassing-anti-vm-and-sandbox-checks

Installs into the current project.

Summary

Bypasses anti-VM and sandbox checks during analysis by locating the specific detection

Files · 1

View on GitHub

SKILL.md

1	# Bypassing Anti-VM and Sandbox Checks
2
3	## When to Use
4
5	- An evasive sample refuses to detonate under analysis and you need to locate and neutralize its
6	anti-VM/sandbox checks (artifact strings, timing stalls, CPUID hypervisor bit, MAC/registry
7	checks).
8	- You are planning patches or environment hardening to force execution.
9
10	Do not use patching as a shortcut that changes malicious logic — patch only the evasion gate.
11	Run only in an isolated, instrumented VM with snapshots.
12
13	## Prerequisites
14
15	- The sample and a debugger/disassembler on an isolated VM.
16
17	## Safety & Handling
18
19	- The sample executes during bypass work; use a disposable, snapshotted, network-controlled VM.
20
21	## Workflow
22
23	### Step 1: Locate the evasion checks
24
25	```bash
26	python scripts/analyst.py locate sample.bin
27	```
28
29	Reports offsets of anti-VM artifact strings, timing APIs (`GetTickCount`, `rdtsc`), CPUID usage,
30	and environment-fingerprint APIs to point you at the detection routines.
31
32	### Step 2: Plan the bypass
33
34	For each check decide the approach: patch the conditional jump after the check, hook/stub the API
35	to return benign values, or harden the VM (rename adapters, patch registry, add fake processes).
36
37	### Step 3: Apply and verify
38
39	Patch the gate (e.g., force the "not detected" branch) and confirm the sample proceeds past the
40	check.
41
42	### Step 4: Document
43
44	Record each check, its offset, and the bypass applied for reproducibility.
45
46	## Validation
47
48	- Each located check maps to a real detection primitive (string/timing/CPUID/API).
49	- The patched/hooked gate provably lets execution continue.
50	- Only the evasion gate is altered, not the payload logic.
51
52	## Pitfalls
53
54	- Multiple layered checks — bypassing one is not enough.
55	- Timing checks needing instruction-accurate handling (`rdtsc` deltas).
56	- Anti-tamper detecting the patch; prefer hooking returns over byte patches when fragile.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the locator.
61	- ATT&CK T1497 and the CPUID hypervisor bit reference (linked in frontmatter).

People who liked this also viewed

6 picks

Type