通过ACPI检测沙箱-反虚拟机

ACPI & ACPI table

ACPI 表示高级配置和电源管理接口（Advanced Configuration and Power Management Interface），对于Windows2000，ACPI定义了Windows2000、BIOS和系统硬件之间的新型工作接口。这些新接口包括允许Windows 2000控制电源管理和设备配置的机制。ACPI table 是填写这些配置的地方。

很好的是，ACPI可以通过R3的 NtQuerySystemInformation 拿得到

https://github.com/classic130/VMProtect-Source/blob/a8433f06ee84fa2546e40bef71183827dc230a3b/runtime/core.cc#L329 这是一个vmp3.x后读Firmware 拿配置。很早之前的技术。

我们本次介绍的是一个新技术，让我们编写代码，获取虚拟机与物理机之间的差异

#include <Windows.h>
#include <stdio.h>
#include <cstdint>
#include <iostream>
struct acpi_table_header {uint32_t signature;uint32_t length;uint8_t revision;uint8_t checksum;char oem_id[6];uint64_t oem_table_id;uint32_t oem_revision;uint32_t creator_id;uint32_t creator_revision;
};
struct hpet_acpi_data {uint32_t hardware_block_id;uint8_t space_id;uint8_t bit_width;uint8_t bit_offset;uint8_t encoded_access_width;uint64_t address;uint8_t sequence_number;uint16_t minimum_clock_ticks;uint8_t flags;
};
static const auto FirmwareTableProviderSignature = 'ACPI';
auto main()->int{printf("acpi sandbox detect by BOSS\n");auto firmwareTableBufferSize=EnumSystemFirmwareTables(FirmwareTableProviderSignature,0,0);char* firmwareTableBuffer = NULL;do {if (firmwareTableBufferSize == 0) {break;}firmwareTableBuffer =reinterpret_cast<char*>(malloc(firmwareTableBufferSize));if (firmwareTableBuffer == nullptr) {break;}firmwareTableBufferSize = EnumSystemFirmwareTables(FirmwareTableProviderSignature, firmwareTableBuffer,firmwareTableBufferSize);if (firmwareTableBufferSize == 0) {break;}bool foundHpet = false;auto index = 0;for (size_t i = 0; i < firmwareTableBufferSize / 4; i++) {const auto tableHeader = reinterpret_cast<acpi_table_header*>(reinterpret_cast<uint64_t>(firmwareTableBuffer) + i);const auto tableID = *firmwareTableBuffer;char tid[6] = {0};char oemid[7] = {0};memcpy(tid, &tableHeader->signature, sizeof(unsigned long));memcpy(oemid, reinterpret_cast<char*>(tableHeader->oem_id),sizeof(tableHeader->oem_id));// printf("tid: %s oemid: %s oem_table_id: %llX oem_table_xd: %llX// \n",//        tid, oemid, tableHeader->oem_table_id,//        (tableHeader->oem_table_id & 0xFFFFFFFF));if (memcmp(oemid, "WAET", 4) == 0) {printf("[detected] Vmware detected by Windows ACPI Emulated""\n");}if (foundHpet == false && memcmp(oemid, "HPET", 4) == 0) {foundHpet = true;}if ((tableHeader->oem_table_id & 0xFFFFFFFF) == 0) {printf("[detected] Cuckoo sandbox detected by oem table id""\n");}index++;}if (index < 8) {printf("[detected] vm-guest detected by table size \n");}if (foundHpet == false) {printf("[detected] HPET not found,Cuckoo detected \n");}} while (false);if (firmwareTableBuffer != nullptr) {free(firmwareTableBuffer);}getchar();return 0;
}

这个POC检测什么？

1. 检测ACPI表内容，如果小于8那么可能是虚拟机
2. 检测ACPI是否有windows的WEATH，如果有则说明windows在虚拟机中
3. 检测ACPI表中是否没有HPET，如果没有，则说明可能在linux下的沙箱中

GitHub - huoji120/ACPI_SANDBOX_DETECT: 通过ACPI检测沙箱

https://download.microsoft.com/download/7/E/7/7E7662CF-CBEA-470B-A97E-CE7CE0D98DC2/WAET.docx