reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/bypassing-anti-vm-and-sandbox-checks/scripts/analyst.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Locate anti-VM/sandbox detection routines to plan a bypass.
+
+Scans printable strings and opcode patterns for anti-VM artifacts, timing APIs, CPUID usage, and
+environment-fingerprint APIs, reporting offsets to guide patching/hooking. Reads bytes statically;
+executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+
+ASCII_RE = re.compile(rb"[\x20-\x7e]{4,}")
+
+ARTIFACT_STRINGS = [b"vmware", b"virtualbox", b"vbox", b"qemu", b"xen", b"vmtoolsd",
+                    b"vboxservice", b"sbiedll", b"sandboxie", b"cuckoo", b"prl_", b"hyperv"]
+TIMING_APIS = [b"GetTickCount", b"QueryPerformanceCounter", b"timeGetTime"]
+FINGERPRINT_APIS = [b"GetAdaptersInfo", b"GetComputerName", b"GetUserName",
+                    b"GlobalMemoryStatusEx", b"GetSystemInfo", b"EnumProcesses"]
+# Opcode anchors: CPUID (0F A2), RDTSC (0F 31).
+CPUID = b"\x0f\xa2"
+RDTSC = b"\x0f\x31"
+
+
+def _find(data: bytes, needle: bytes, ci: bool = True, limit: int = 10) -> list[int]:
+    hay = data.lower() if ci else data
+    pin = needle.lower() if ci else needle
+    out = []
+    start = 0
+    while len(out) < limit:
+        idx = hay.find(pin, start)
+        if idx == -1:
+            break
+        out.append(idx)
+        start = idx + 1
+    return out
+
+
+def locate(path: str) -> dict:
+    data = Path(path).read_bytes()
+    artifacts = {}
+    for s in ARTIFACT_STRINGS:
+        hits = _find(data, s)
+        if hits:
+            artifacts[s.decode()] = hits
+    timing = {s.decode(): _find(data, s, ci=False) for s in TIMING_APIS
+              if _find(data, s, ci=False)}
+    fingerprint = {s.decode(): _find(data, s, ci=False) for s in FINGERPRINT_APIS
+                   if _find(data, s, ci=False)}
+    cpuid_hits = _find(data, CPUID, ci=False, limit=20)
+    rdtsc_hits = _find(data, RDTSC, ci=False, limit=20)
+    return {
+        "anti_vm_artifact_strings": artifacts,
+        "timing_apis": timing,
+        "fingerprint_apis": fingerprint,
+        "cpuid_opcode_offsets": cpuid_hits,
+        "rdtsc_opcode_offsets": rdtsc_hits,
+        "evasion_checks_present": bool(artifacts or timing or cpuid_hits or rdtsc_hits),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Locate anti-VM/sandbox checks")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("locate")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(locate(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())