Icebox – Virtual Machine Introspection, Tracing & Debugging

Icebox is a Virtual Machine Introspection solution that enable you to stealthily trace and debug any process (kernel or user). It’s based on project Winbagility.
Files which might be helpful:

Demo

https://www.youtube.com/embed/uJnxF0gptf8
Project Organisation

  • fdp: Fast Debugging Protocol sources
  • icebox: Icebox sources 
    • icebox: Icebox lib (core, os helpers, plugins…)
    • icebox_cmd: Program that test several features
    • samples: Bunch of examples
  • winbagility: stub to connect WinDBG to FDP
  • virtualbox: VirtualBox sources patched for FDP.

Getting Started
Some sample have been written in samples folder.
You can build them with these instructions after you installed the requirements.
If your using a Windows guest you might want to set the environement variable _NT_SYMBOL_PATH to a folder that contains your guest’s pdb. Please note that icebox setup will fail if it does not find your guest’s kernel’s pdb.
vm_resume:
vm_resume just pause then resume your VM.

cd icebox/bin/$ARCH/
./vm_resume <vm_name>

nt_writefile:
nt_writefile breaks when a process calls ntdll!NtWriteFile, and dumps what’s written in a file on your host in the current directory.

cd icebox/bin/$ARCH/
./nt_writefile <vm_name> <process_name>

heapsan:
heapsan breaks ntdll memory allocations from a process and add padding before & after every pointer. It is still incomplete and doesn’t do any checks yet.

cd icebox/bin/$ARCH/
./heapsan <vm_name> <process_name>

wireshark:
wireshark breaks when ndis driver reads or sends network packets and creates a wireshark trace (.pcapng). Each packet sent is associated to a callstack from kernel land to userland if necessary.

cd icebox/bin/$ARCH/
./wireshark <name> <path_to_capture_file>

Download Icebox

+————————————————-

This is only an educational purposes only I am not responsible for further activities

Join my forum and learn more ethical hacking and penetration testing

https://t.me/whiteHatHacks

Get me at

alex14324.blogspot.com

https://t.me/alex14324

https://github.com/alex14324

https://www.instagram.com/alex_14324

https://discord.gg/6NPtGxZ

——————————————————-+

Leave a Reply

Your email address will not be published. Required fields are marked *