LordNoteworthy/al-khaser
Al Khaser
Al-Khaser is a research project focused on the development of anti-analysis and evasion techniques to resist reverse engineering. It provides implementations for detecting and evading virtual machines, sandboxes, and debuggers to prevent software analysis.
The project implements control flow obfuscation through anti-disassembly methods and utilizes dynamic API resolution to bypass static import tables. It further hinders forensic analysis by manipulating memory headers to prevent process dumps and utilizing remote code injection to execute logic in external processes.
The capability surface covers environment scanning via artifact and timing-based detection, memory protection engineering to identify unauthorized code injection, and the use of hardware breakpoints and system flags to identify attached debuggers.
Features
- Anti-Analysis Technique Development - Implements a wide array of techniques to detect and resist virtual machines, sandboxes, and debuggers.
- Anti-Debugging Implementations - Develops mechanisms to identify if a debugger is attached and alters behavior to stop reverse engineering.
- Analysis Tool Detection - Implements detection for debuggers, network sniffers, and system monitoring utilities to identify active analysis.
- Control Flow Obfuscations - Uses impossible jumps and pointer abuse to confuse static analysis tools and hinder reverse engineering.
- Debugger Detection - Checks environment flags, hardware breakpoints, and API indicators to determine if a debugger is attached.
- Debugger Detection Techniques - Checks system flags and hardware breakpoints to determine if a debugger is currently attached to the process.
- Environment Artifact Detection - Searches for specific registry keys, MAC addresses, and firmware strings to identify virtualization and analysis software.
- Malware Evasion Research - Studies and implements methods to hide software activity from system monitoring tools and automated analysis environments.
- Virtualization Detection - Searches for registry keys, MAC addresses, and firmware strings to identify virtual machine environments.
- Control Flow Obfuscation - Applies anti-disassembly methods like impossible jumps and pointer abuse to hinder static analysis.
- Sandbox Detection - Measures execution timing and hardware resource limits to identify automated analysis environments.
- Timing-Based Detection - Measures execution speed and hardware resource limits to distinguish between real hardware and automated analysis environments.
- Remote Code Injections - Implements code execution in external processes via thread creation and asynchronous procedure call queueing to evade analysis.
- Memory Dump Prevention - Modifies image sizes or erases headers in memory to prevent analysts from capturing usable process dumps.
- Memory Protection Engineering - Implements strategies to prevent process memory dumping and detect unauthorized code injection.
- Remote Thread Injection - Executes code in external processes by utilizing thread creation and asynchronous procedure call queueing.
- Injection Detection - Scans memory structures and loaded modules to identify unauthorized third-party code injections.
- Memory Header Manipulation - Modifies image sizes and erases headers in memory to prevent the creation of usable process dumps.
- Code Obfuscation Techniques - Hides program logic and control flow to make static analysis and disassembly more difficult.
- API Export Resolution - Maps function identifiers to library exports at runtime to call system functions while bypassing static import tables.
- Dynamic API Resolution - Maps identifiers to library exports at runtime to call system functions while bypassing static import tables.
- Development Libraries - Proof-of-concept for detecting virtual machines and debuggers.
- Analysis Frameworks - Proof of concept malware to stress anti-malware systems.
- Blue Team Tools - Anti-debugging and anti-VM testing tool.
- Malware Analysis - Collection of public malware detection techniques.
