News | Concept | Motivations | Rules | Samples | Environment | Links | FAQ | Contact
Environment
Due to the fact you will be analysing samples of actual malware, it's advisable to setup a dedicated environment for this task, unless you're not worried about becoming part of someones botnet :)
Choosing the right environment for the task at hand is important, malware often behaves differently depending on its environment, your VMWare lab may be handy but will the malware exit as soon as it detects its inside a VM?
Virtual Machines
You may wish to investigate the following virtual machines when setting up your lab environment:
- VMWare
- Microsoft Virtual PC
- Parallels
- Bochs
- Virtual Box
VMware Server is available free of change and allows the operator to revert their operating system to a previously known state. There is a Workstation version also available which allows multiple snapshots in a highly flexible maner.
Microsoft Virtual PC is a virtualization suite for Microsoft Windows operating systems, and an emulation suite for Mac OS X on PowerPC-based systems.
Parallels is hardware emulation virtualization software for Mac based computers
Bochs is a portable x86 and AMD64 PC emulator mostly written in C++ and distributed as free software under GNU Lesser General Public License. It supports emulation of the processor(s) (including protected mode), memory, disks, display, Ethernet, BIOS and common hardware peripherals of PCs.
VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is freely available as Open Source Software under the terms of the GNU General Public License (GPL)
Disk Cloning
Another option for setting up your lab enviornment is disk cloning
- dd
- ddp
- Norton Ghost
- RAID-1
Disk cloning software such as dd allows the analyst to save a clean copy of the lab system's hard disk image and reapply it after completing the analysis.
dd-delta-patch can be used to create a patch from an existing dd image and then re-apply it when you want to run that specific configuration.
Similar to dd, Norton Ghost (General Hardware-Oriented System Transfer) is a commercial disk-cloning software package
A quick and dirty way to restore a disk to its original state is to remove it from its RAID-1 configuration, make your changes and then rejoin it to the mirror
System Snapshot
A final option is to snapshot your system from a known good point without running it inside a virtual machine
- Faronics Deep Freeze
- Windows Steady State
- Returnil Virtual System
- CoreRestore
Deep Freeze lets you "freeze" the system's configuration in its pristine state, automatically reverting to that configuration when necessary after a reboot. It supports Windows 95, 98, ME, 2000, XP and Vista on FAT, FAT32 and NTFS file systems
Windows Steady State for XP provides the ability to clear all changes to the operating system partition whenever you restart the computer. It is available free of change to anyone with a windows geniune license.
Similar to the other snapshot technologies, a reboot of a system running Returnil will return the system to a known good state
CoreRestore is diffent from the other system snapshot tools mentioned in that it is a hardware component, not a software product. It is a card that you need to install between the system's motherboard and the disk drive IDE controller. The card redirects system changes to a "temporary working area, allowing the administrator to revert to a pristine state via a reboot.