Virtualization and Sandbox Detection
(Page 1 of 4 )
Being a software developer means always being up to date with the latest trends and technologies. As of the past few years and especially now, virtualization has really garnered the interest of end users. Lots of sandbox environments are also out there. If your piece of software needs to know when it is being run within an abstract or sandbox environment, then we need to implement detection techniques. Let’s see how to do it.
We are going to use Microsoft Visual Studio 2005 IDE, but 2008/2010 also works. The programming language will be C#. Detecting when we're "inside" a virtualized OS or when our software is run within a sandbox relies mostly on knowing the properties of those host applications (such as Virtual PC, VirtualBox, Anubis). After that, detecting those running processes is child's play to any programmer.
Due to the nature of the article, we're feeling compelled to mention that this article is only for educational purposes and what you plan to do after the detection routines is completely up to you. Therefore, please; with all due respect, let's stick to the positive side and think about the ways you can improve your software whenever virtualization is detected-to offer an even better user experience for the users.
Moving on, there is another reason why we may want to implement these detection routines. For example, perhaps the nature of the packets our software may transfer is sensitive and we would not like the user to be able to sniff, intercept, and examine them. Perhaps we don't want the user doing this because we would risk the packets' future validity and integrity, since the user may also manipulate their content -- you name it. The possibilities are endless.
As of late, malware has pretty much evolved and has even begun implementing similar sandbox detection routines. But please do keep in mind, we're focusing on how to improve our software applications, and I'm convinced our readers are all legit. So let's remain ethical-and focus on the beauty of coding.
Now let's get to work.
Next: Prelude to Detection >>
More BrainDump Articles
More By Barzan "Tony" Antal
