reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/bypassing-anti-vm-and-sandbox-checks/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/bypassing-anti-vm-and-sandbox-checks/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: bypassing-anti-vm-and-sandbox-checks
+description: 'Bypasses anti-VM and sandbox checks during analysis by locating the specific detection
+  routines (artifact strings, timing, CPUID/hypervisor bit) and planning patches or environment
+  hardening so the sample detonates. Activates for requests to bypass anti-VM checks, defeat sandbox
+  detection, or make an evasive sample run for analysis.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - anti-vm
+  - evasion
+  - patching
+  - sandbox
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1497
+  - T1497.001
+  - T1497.003
+d3fend:
+  - D3-DA
+  - D3-SDA
+references:
+  - 'MITRE ATT&CK T1497 Virtualization/Sandbox Evasion — https://attack.mitre.org/techniques/T1497/'
+  - 'Intel SDM CPUID hypervisor-present bit — https://www.intel.com/sdm'
+---
+
+# Bypassing Anti-VM and Sandbox Checks
+
+## When to Use
+
+- An evasive sample refuses to detonate under analysis and you need to locate and neutralize its
+  anti-VM/sandbox checks (artifact strings, timing stalls, CPUID hypervisor bit, MAC/registry
+  checks).
+- You are planning patches or environment hardening to force execution.
+
+**Do not use** patching as a shortcut that changes malicious logic — patch only the evasion gate.
+Run only in an isolated, instrumented VM with snapshots.
+
+## Prerequisites
+
+- The sample and a debugger/disassembler on an isolated VM.
+
+## Safety & Handling
+
+- The sample executes during bypass work; use a disposable, snapshotted, network-controlled VM.
+
+## Workflow
+
+### Step 1: Locate the evasion checks
+
+```bash
+python scripts/analyst.py locate sample.bin
+```
+
+Reports offsets of anti-VM artifact strings, timing APIs (`GetTickCount`, `rdtsc`), CPUID usage,
+and environment-fingerprint APIs to point you at the detection routines.
+
+### Step 2: Plan the bypass
+
+For each check decide the approach: patch the conditional jump after the check, hook/stub the API
+to return benign values, or harden the VM (rename adapters, patch registry, add fake processes).
+
+### Step 3: Apply and verify
+
+Patch the gate (e.g., force the "not detected" branch) and confirm the sample proceeds past the
+check.
+
+### Step 4: Document
+
+Record each check, its offset, and the bypass applied for reproducibility.
+
+## Validation
+
+- Each located check maps to a real detection primitive (string/timing/CPUID/API).
+- The patched/hooked gate provably lets execution continue.
+- Only the evasion gate is altered, not the payload logic.
+
+## Pitfalls
+
+- Multiple layered checks — bypassing one is not enough.
+- Timing checks needing instruction-accurate handling (`rdtsc` deltas).
+- Anti-tamper detecting the patch; prefer hooking returns over byte patches when fragile.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the locator.
+- ATT&CK T1497 and the CPUID hypervisor bit reference (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/bypassing-anti-vm-and-sandbox-checks/references/api-reference.md

@@ -0,0 +1,38 @@
+# API Reference: Bypassing Anti-VM and Sandbox Checks
+
+## Overview
+
+`scripts/analyst.py` locates anti-VM/sandbox detection routines by scanning for artifact strings,
+timing APIs, environment-fingerprint APIs, and CPUID/RDTSC opcodes, reporting offsets to guide
+patching or hooking. It reads bytes statically and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+
+## Core functions
+
+### `locate(path)`
+Returns artifact-string offsets, timing/fingerprint API offsets, CPUID/RDTSC opcode offsets, and an
+evasion-present flag.
+
+## Detection primitives located
+
+- Artifact strings: VMware/VirtualBox/QEMU/Sandboxie/Cuckoo.
+- Timing: `GetTickCount`, `QueryPerformanceCounter`, plus `rdtsc` (`0F 31`).
+- CPUID (`0F A2`) for the hypervisor-present bit.
+- Fingerprint APIs: adapters, computer/user name, memory/system info.
+
+## Usage
+
+```bash
+python scripts/analyst.py locate sample.bin
+```
+
+## Sources
+
+- MITRE ATT&CK T1497 Virtualization/Sandbox Evasion — https://attack.mitre.org/techniques/T1497/
+- Intel SDM: CPUID leaf 1 ECX bit 31 hypervisor-present — https://www.intel.com/sdm
+- RDTSC timing-evasion and VM artifact checks from public anti-analysis research

vendor-new/analyst-ai-pack/skills/bypassing-anti-vm-and-sandbox-checks/scripts/analyst.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Locate anti-VM/sandbox detection routines to plan a bypass.
+
+Scans printable strings and opcode patterns for anti-VM artifacts, timing APIs, CPUID usage, and
+environment-fingerprint APIs, reporting offsets to guide patching/hooking. Reads bytes statically;
+executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+
+ASCII_RE = re.compile(rb"[\x20-\x7e]{4,}")
+
+ARTIFACT_STRINGS = [b"vmware", b"virtualbox", b"vbox", b"qemu", b"xen", b"vmtoolsd",
+                    b"vboxservice", b"sbiedll", b"sandboxie", b"cuckoo", b"prl_", b"hyperv"]
+TIMING_APIS = [b"GetTickCount", b"QueryPerformanceCounter", b"timeGetTime"]
+FINGERPRINT_APIS = [b"GetAdaptersInfo", b"GetComputerName", b"GetUserName",
+                    b"GlobalMemoryStatusEx", b"GetSystemInfo", b"EnumProcesses"]
+# Opcode anchors: CPUID (0F A2), RDTSC (0F 31).
+CPUID = b"\x0f\xa2"
+RDTSC = b"\x0f\x31"
+
+
+def _find(data: bytes, needle: bytes, ci: bool = True, limit: int = 10) -> list[int]:
+    hay = data.lower() if ci else data
+    pin = needle.lower() if ci else needle
+    out = []
+    start = 0
+    while len(out) < limit:
+        idx = hay.find(pin, start)
+        if idx == -1:
+            break
+        out.append(idx)
+        start = idx + 1
+    return out
+
+
+def locate(path: str) -> dict:
+    data = Path(path).read_bytes()
+    artifacts = {}
+    for s in ARTIFACT_STRINGS:
+        hits = _find(data, s)
+        if hits:
+            artifacts[s.decode()] = hits
+    timing = {s.decode(): _find(data, s, ci=False) for s in TIMING_APIS
+              if _find(data, s, ci=False)}
+    fingerprint = {s.decode(): _find(data, s, ci=False) for s in FINGERPRINT_APIS
+                   if _find(data, s, ci=False)}
+    cpuid_hits = _find(data, CPUID, ci=False, limit=20)
+    rdtsc_hits = _find(data, RDTSC, ci=False, limit=20)
+    return {
+        "anti_vm_artifact_strings": artifacts,
+        "timing_apis": timing,
+        "fingerprint_apis": fingerprint,
+        "cpuid_opcode_offsets": cpuid_hits,
+        "rdtsc_opcode_offsets": rdtsc_hits,
+        "evasion_checks_present": bool(artifacts or timing or cpuid_hits or rdtsc_hits),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Locate anti-VM/sandbox checks")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("locate")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(locate(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())