Icebox is a Virtual Machine Introspection solution that enable you to stealthily trace and debug any process (kernel or user). It’s based on project Winbagility.
Files which might be helpful:
Project Organization
Also Read – Lst2x64dbg : Extract Labels From IDA .lst or Ghidra .csv File & Export x64dbg Database
Getting Started
Some sample have been written in samples folder.
You can build them with these instructions after you installed the requirements.
If your using a Windows guest you might want to set the environement variable _NT_SYMBOL_PATH to a folder that contains your guest’s pdb. Please note that icebox setup will fail if it does not find your guest’s kernel’s pdb.
vm_resume:
vm_resume just pause then resume your VM.
cd icebox/bin/$ARCH/
./vm_resume <vm_name>
nt_writefile:
nt_writefile breaks when a process calls ntdll!NtWriteFile, and dumps
what’s written in a file on your host in the current directory.
cd icebox/bin/$ARCH/ .
/nt_writefile <vm_name> <process_name>
heapsan:
heapsan breaks ntdll memory allocations from a process and add padding
before & after every pointer. It is still incomplete and doesn’t do
any checks yet.
cd icebox/bin/$ARCH/
./heapsan <vm_name> <process_name>
wireshark:
wireshark breaks when ndis driver reads or sends network packets and
creates a wireshark trace (.pcapng). Each packet sent is associated to a
callstack from kernel land to userland if necessary.
cd icebox/bin/$ARCH/
./wireshark <name> <path_to_capture_file>
Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…
Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…
Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…
If you are working with Linux or writing bash scripts, one of the most common…
What is a bash case statement? A bash case statement is a way to control…
Why Do We Check Files in Bash? When writing a Bash script, you often work…