# Pafish沙箱检测技术分析：行为特征与系统配置识别

在网络安全领域，恶意软件分析常依赖于沙箱环境。Pafish作为反沙箱检测工具，通过识别虚拟环境、沙箱行为和系统配置中的异常特征，帮助安全研究人员测试和评估沙箱的有效性。其检测机制涵盖了从用户行为到系统配置的多个层面。

## 沙箱检测的核心逻辑

Pafish采用多层次的检测策略，每种方法针对沙箱环境的不同弱点：

```c

// Pafish检测逻辑框架示例

typedef struct {

BOOL is_virtual_machine; // 虚拟机检测

BOOL is_debugger_present; // 调试器检测

BOOL has_analysis_tools; // 分析工具检测

BOOL abnormal_timing; // 时间异常检测

BOOL missing_human_behavior; // 人类行为缺失检测

} SANDBOX_DETECTION_RESULTS;

BOOL PerformComprehensiveCheck() {

SANDBOX_DETECTION_RESULTS results = {0};

// 多维度检测

results.is_virtual_machine = CheckVirtualization();

results.is_debugger_present = CheckDebugger();

results.has_analysis_tools = CheckAnalysisTools();

results.abnormal_timing = CheckTimingAnomalies();

results.missing_human_behavior = CheckHumanBehavior();

// 综合判断逻辑

int suspicion_score = 0;

if (results.is_virtual_machine) suspicion_score += 30;

if (results.is_debugger_present) suspicion_score += 25;

if (results.has_analysis_tools) suspicion_score += 20;

if (results.abnormal_timing) suspicion_score += 15;

if (results.missing_human_behavior) suspicion_score += 10;

return suspicion_score > 50;

}

```

## 虚拟机与硬件特征检测

Pafish通过检查硬件和固件特征识别虚拟环境：

```c

// 虚拟机检测实现

#include

BOOL CheckVirtualization() {

BOOL is_vm = FALSE;

// 1. 检查CPUID指令

int cpu_info[4];

__cpuid(cpu_info, 1);

// 检查Hypervisor标志位（第31位）

if (cpu_info[2] & (1 << 31)) {

is_vm = TRUE;

}

// 2. 检查特定虚拟机标识

char hypervisor_vendor[13];

memset(hypervisor_vendor, 0, sizeof(hypervisor_vendor));

__cpuid(cpu_info, 0x40000000);

*((int*)hypervisor_vendor) = cpu_info[1];

*((int*)(hypervisor_vendor+4)) = cpu_info[2];

*((int*)(hypervisor_vendor+8)) = cpu_info[3];

// 常见虚拟机厂商标识

if (strstr(hypervisor_vendor, "VMwareVMware") ||

strstr(hypervisor_vendor, "KVMKVMKVM") ||

strstr(hypervisor_vendor, "Microsoft Hv") ||

strstr(hypervisor_vendor, "XenVMMXenVMM")) {

is_vm = TRUE;

}

// 3. 检查MAC地址前缀

// 虚拟机MAC地址通常有特定OUI

char* vm_mac_prefixes[] = {

"00:0C:29", // VMware

"00:50:56", // VMware

"00:1C:42", // Parallels

"00:16:3E", // Xen

"08:00:27" // VirtualBox

};

// 获取MAC地址并检查

IP_ADAPTER_INFO adapter_info[16];

DWORD buffer_size = sizeof(adapter_info);

if (GetAdaptersInfo(adapter_info, &buffer_size) == ERROR_SUCCESS) {

for (PIP_ADAPTER_INFO adapter = adapter_info; adapter != NULL; adapter = adapter->Next) {

char mac_str[18];

snprintf(mac_str, sizeof(mac_str), "%02X:%02X:%02X",

adapter->Address[0], adapter->Address[1], adapter->Address[2]);

for (int i = 0; i < 5; i++) {

if (strncmp(mac_str, vm_mac_prefixes[i], 8) == 0) {

is_vm = TRUE;

break;

}

return is_vm;

}

```

## 用户行为模式分析

沙箱环境通常缺乏真实用户的行为特征：

```c

// 用户行为检测

#include

BOOL CheckHumanBehavior() {

int behavior_score = 0;

// 1. 鼠标移动检测

POINT last_point, current_point;

GetCursorPos(&last_point);

// 模拟短暂延迟

Sleep(1000);

GetCursorPos(¤t_point);

// 检查鼠标是否移动

int distance = abs(current_point.x - last_point.x) +

abs(current_point.y - last_point.y);

if (distance < 5) { // 鼠标基本未移动

behavior_score += 20;

}

// 2. 鼠标点击检测

int click_count = 0;

SYSTEMTIME start_time;

GetSystemTime(&start_time);

// 设置鼠标钩子（简化示例）

// 在实际实现中，会使用SetWindowsHookEx

// 3. 键盘输入多样性检测

BYTE keyboard_state[256];

GetKeyboardState(keyboard_state);

int pressed_keys = 0;

for (int i = 8; i <= 255; i++) { // 跳过控制键

if (keyboard_state[i] & 0x80) {

pressed_keys++;

}

if (pressed_keys < 3) { // 很少的按键被使用

behavior_score += 15;

}

// 4. 运行时间检测

DWORD uptime = GetTickCount();

if (uptime < 300000) { // 运行时间小于5分钟

behavior_score += 25;

}

// 5. 进程数量检查

DWORD processes[1024], bytes_returned, process_count;

if (EnumProcesses(processes, sizeof(processes), &bytes_returned)) {

process_count = bytes_returned / sizeof(DWORD);

if (process_count < 25) { // 进程数量异常少

behavior_score += 20;

}

return behavior_score > 50;

}

```

## 系统配置与软件环境检查

沙箱环境通常有特定的配置模式：

```c

// 系统配置检测

#include

BOOL CheckAnalysisTools() {

BOOL tools_detected = FALSE;

// 1. 检查常见分析工具进程

char* analysis_tools[] = {

"ollydbg.exe",

"x64dbg.exe",

"ida.exe",

"wireshark.exe",

"processhacker.exe",

"procmon.exe",

"tcpview.exe",

"autoruns.exe",

"regshot.exe",

"virusscan.exe"

};

HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

if (snapshot != INVALID_HANDLE_VALUE) {

PROCESSENTRY32 process_entry;

process_entry.dwSize = sizeof(PROCESSENTRY32);

if (Process32First(snapshot, &process_entry)) {

do {

for (int i = 0; i < 10; i++) {

if (_stricmp(process_entry.szExeFile, analysis_tools[i]) == 0) {

tools_detected = TRUE;

break;

}

} while (Process32Next(snapshot, &process_entry) && !tools_detected);

}

CloseHandle(snapshot);

}

// 2. 检查调试器存在

if (IsDebuggerPresent()) {

tools_detected = TRUE;

}

// 3. 检查PEB中的调试标志

BOOL debug_flag = FALSE;

__asm {

mov eax, fs:[0x30] // 指向PEB

mov al, [eax+0x02] // BeingDebugged标志

mov debug_flag, al

}

if (debug_flag) {

tools_detected = TRUE;

}

// 4. 检查NTGlobalFlag

DWORD nt_global_flag = 0;

__asm {

mov eax, fs:[0x30] // 指向PEB

mov eax, [eax+0x68] // NtGlobalFlag

mov nt_global_flag, eax

}

if (nt_global_flag & 0x70) { // FLG_HEAP_ENABLE_TAIL_CHECK等标志

tools_detected = TRUE;

}

return tools_detected;

}

```

## 时间与性能基准测试

沙箱环境的时间和性能特征往往与真实系统不同：

```c

// 时间异常检测

#include

BOOL CheckTimingAnomalies() {

BOOL timing_anomaly = FALSE;

// 1. RDTSC指令检测

unsigned long long start_time, end_time;

// 禁用中断以确保准确性

__asm {

pushfd

cli

rdtsc

mov dword ptr [start_time], eax

mov dword ptr [start_time+4], edx

rdtsc

mov dword ptr [end_time], eax

mov dword ptr [end_time+4], edx

popfd

}

unsigned long long rdtsc_delta = end_time - start_time;

// 真实CPU通常需要几十到几百个周期

// 模拟器或调试器可能更快或更慢

if (rdtsc_delta < 10 || rdtsc_delta > 1000) {

timing_anomaly = TRUE;

}

// 2. Sleep函数精度检测

DWORD sleep_start = GetTickCount();

Sleep(1000); // 睡眠1秒

DWORD sleep_end = GetTickCount();

DWORD actual_sleep = sleep_end - sleep_start;

// 检查Sleep精度，沙箱可能不准确

if (abs((int)actual_sleep - 1000) > 100) { // 误差超过100ms

timing_anomaly = TRUE;

}

// 3. QueryPerformanceCounter检测

LARGE_INTEGER frequency, start_counter, end_counter;

QueryPerformanceFrequency(&frequency);

<"0g.sxyicheng.cn"><"7n.jsnjz.cn"><"1r.csxthr.com">

QueryPerformanceCounter(&start_counter);

// 执行一些CPU密集型操作

volatile int sum = 0;

for (int i = 0; i < 1000000; i++) {

sum += i;

}

QueryPerformanceCounter(&end_counter);

double elapsed = (double)(end_counter.QuadPart - start_counter.QuadPart) /

frequency.QuadPart;

// 在真实硬件上应该有特定耗时范围

if (elapsed < 0.001 || elapsed > 0.1) { // 耗时异常

timing_anomaly = TRUE;

}

return timing_anomaly;

}

```

## 磁盘与文件系统分析

沙箱环境通常在磁盘使用上表现出不同特征：

```c

// 磁盘特征检测

#include

BOOL CheckDiskCharacteristics() {

BOOL suspicious_disk = FALSE;

// 1. 检查磁盘大小

char system_drive[MAX_PATH];

GetSystemDirectory(system_drive, MAX_PATH);

char drive_letter[4] = { system_drive[0], ':', '\\', '\0' };

ULARGE_INTEGER free_bytes, total_bytes, total_free_bytes;

if (GetDiskFreeSpaceEx(drive_letter, &free_bytes, &total_bytes, &total_free_bytes)) {

// 沙箱通常有较小的磁盘空间

if (total_bytes.QuadPart < 20LL * 1024 * 1024 * 1024) { // 小于20GB

suspicious_disk = TRUE;

}

// 2. 检查磁盘类型（物理 vs 虚拟）

char physical_drive_path[MAX_PATH];

snprintf(physical_drive_path, MAX_PATH, "\\\\.\\PhysicalDrive0");

HANDLE h_drive = CreateFile(physical_drive_path, GENERIC_READ,

FILE_SHARE_READ | FILE_SHARE_WRITE,

NULL, OPEN_EXISTING, 0, NULL);

if (h_drive != INVALID_HANDLE_VALUE) {

STORAGE_PROPERTY_QUERY query = {0};

query.PropertyId = StorageDeviceProperty;

query.QueryType = PropertyStandardQuery;

BYTE buffer[1024];

DWORD bytes_returned;

if (DeviceIoControl(h_drive, IOCTL_STORAGE_QUERY_PROPERTY,

&query, sizeof(query),

buffer, sizeof(buffer),

&bytes_returned, NULL)) {

PSTORAGE_DEVICE_DESCRIPTOR descriptor = (PSTORAGE_DEVICE_DESCRIPTOR)buffer;

// 检查产品标识

if (descriptor->ProductIdOffset) {

char* product_id = (char*)buffer + descriptor->ProductIdOffset;

// 常见的虚拟机磁盘标识

if (strstr(product_id, "VMware") ||

strstr(product_id, "Virtual") ||

strstr(product_id, "QEMU") ||

strstr(product_id, "VBOX")) {

suspicious_disk = TRUE;

}

CloseHandle(h_drive);

}

// 3. 检查文件系统时间戳

WIN32_FIND_DATA find_data;

HANDLE find_handle = FindFirstFile("C:\\Windows\\System32\\*.dll", &find_data);

if (find_handle != INVALID_HANDLE_VALUE) {

int recent_files = 0;

SYSTEMTIME current_time;

GetSystemTime(¤t_time);

do {

// 检查文件的修改时间

FILETIME file_time = find_data.ftLastWriteTime;

SYSTEMTIME file_system_time;

FileTimeToSystemTime(&file_time, &file_system_time);

// 计算文件年龄（以天为单位）

int file_age = (current_time.wYear - file_system_time.wYear) * 365 +

(current_time.wMonth - file_system_time.wMonth) * 30 +

(current_time.wDay - file_system_time.wDay);

if (file_age < 30) { // 最近修改的文件

recent_files++;

}

// 沙箱中系统文件通常都有相似的时间戳

// 真实系统中文件时间戳更加多样化

} while (FindNextFile(find_handle, &find_data));

FindClose(find_handle);

if (recent_files > 100) { // 大量文件最近被修改

suspicious_disk = TRUE;

}

return suspicious_disk;

}

```

## 网络环境特征识别

沙箱的网络配置与真实用户环境存在差异：

```c

// 网络环境检测

#include

BOOL CheckNetworkEnvironment() {

BOOL suspicious_network = FALSE;

// 1. 检查DNS服务器设置

FIXED_INFO* fixed_info;

ULONG buffer_size = 0;

if (GetNetworkParams(NULL, &buffer_size) == ERROR_BUFFER_OVERFLOW) {

fixed_info = (FIXED_INFO*)malloc(buffer_size);

if (GetNetworkParams(fixed_info, &buffer_size) == ERROR_SUCCESS) {

IP_ADDR_STRING* dns_server = &fixed_info->DnsServerList;

// 常见的沙箱DNS服务器

char* sandbox_dns[] = {

"8.8.8.8", // Google DNS

"8.8.4.4", // Google DNS

"1.1.1.1", // Cloudflare

"208.67.222.222", // OpenDNS

"208.67.220.220" // OpenDNS

};

while (dns_server) {

for (int i = 0; i < 5; i++) {

if (strcmp(dns_server->IpAddress.String, sandbox_dns[i]) == 0) {

suspicious_network = TRUE;

break;

}

dns_server = dns_server->Next;

}

free(fixed_info);

}

// 2. 检查网络适配器数量

ULONG adapter_info_size = 0;

GetAdaptersInfo(NULL, &adapter_info_size);

IP_ADAPTER_INFO* adapter_info = (IP_ADAPTER_INFO*)malloc(adapter_info_size);

if (GetAdaptersInfo(adapter_info, &adapter_info_size) == ERROR_SUCCESS) {

int adapter_count = 0;

IP_ADAPTER_INFO* current_adapter = adapter_info;

while (current_adapter) {

adapter_count++;

current_adapter = current_adapter->Next;

}

// 沙箱通常只有少量网络适配器

if (adapter_count < 2) {

suspicious_network = TRUE;

}

free(adapter_info);

// 3. 检查网络活动

MIB_TCPTABLE_OWNER_PID* tcp_table;

DWORD tcp_table_size = 0;

// 获取TCP连接表

GetExtendedTcpTable(NULL, &tcp_table_size, FALSE, AF_INET,

TCP_TABLE_OWNER_PID_ALL, 0);

tcp_table = (MIB_TCPTABLE_OWNER_PID*)malloc(tcp_table_size);

if (GetExtendedTcpTable(tcp_table, &tcp_table_size, FALSE, AF_INET,

<"4t.zhaiLimao.com"><"8v.yunruiwater.cn"><"2m.sxyicheng.cn">

TCP_TABLE_OWNER_PID_ALL, 0) == NO_ERROR) {

// 沙箱通常只有很少的活跃网络连接

if (tcp_table->dwNumEntries < 5) {

suspicious_network = TRUE;

}

free(tcp_table);

return suspicious_network;

}

```

## 综合检测与规避策略

Pafish的最终检测结果是多种指标的加权综合：

```c

// 综合检测结果评估

typedef struct {

float vm_detection_weight; // 虚拟机检测权重

float behavior_weight; // 行为检测权重

float timing_weight; // 时间检测权重

float tools_weight; // 工具检测权重

float disk_weight; // 磁盘检测权重

float network_weight; // 网络检测权重

} DETECTION_WEIGHTS;

float CalculateSandboxProbability(DETECTION_WEIGHTS weights) {

float total_score = 0.0;

float max_score = 0.0;

// 执行各项检测并加权

if (CheckVirtualization()) {

total_score += weights.vm_detection_weight;

}

max_score += weights.vm_detection_weight;

if (CheckHumanBehavior()) {

total_score += weights.behavior_weight;

}

max_score += weights.behavior_weight;

if (CheckTimingAnomalies()) {

total_score += weights.timing_weight;

}

max_score += weights.timing_weight;

if (CheckAnalysisTools()) {

total_score += weights.tools_weight;

}

max_score += weights.tools_weight;

if (CheckDiskCharacteristics()) {

total_score += weights.disk_weight;

}

max_score += weights.disk_weight;

if (CheckNetworkEnvironment()) {

total_score += weights.network_weight;

}

max_score += weights.network_weight;

// 计算概率

if (max_score > 0) {

return (total_score / max_score) * 100.0;

}

return 0.0;

}

// 推荐的权重配置（可根据环境调整）

DETECTION_WEIGHTS GetRecommendedWeights() {

DETECTION_WEIGHTS weights = {0};

weights.vm_detection_weight = 30.0;

weights.behavior_weight = 25.0;

weights.timing_weight = 20.0;

weights.tools_weight = 15.0;

weights.disk_weight = 5.0;

weights.network_weight = 5.0;

return weights;

}

```

## 检测结果的处理与响应

根据检测结果采取不同的应对策略：

```c

// 响应策略实现

typedef enum {

RESPONSE_CONTINUE_NORMAL, // 继续正常执行

RESPONSE_DELAYED_EXECUTION, // 延迟执行

RESPONSE_ALTERNATE_BEHAVIOR, // 改变行为

RESPONSE_TERMINATE_PROCESS // 终止进程

} RESPONSE_STRATEGY;

RESPONSE_STRATEGY DetermineResponse(float sandbox_probability) {

if (sandbox_probability < 30.0) {

// 低概率：继续正常执行

return RESPONSE_CONTINUE_NORMAL;

}

else if (sandbox_probability < 60.0) {

// 中等概率：延迟执行以绕过时间检测

Sleep(GetTickCount() % 30000 + 30000); // 随机延迟30-60秒

return RESPONSE_DELAYED_EXECUTION;

}

else if (sandbox_probability < 85.0) {

// 高概率：执行无害的替代行为

return RESPONSE_ALTERNATE_BEHAVIOR;

}

else {

// 极高概率：直接终止

return RESPONSE_TERMINATE_PROCESS;

}

void ExecuteResponse(RESPONSE_STRATEGY strategy) {

switch (strategy) {

case RESPONSE_CONTINUE_NORMAL:

// 执行正常的程序逻辑

ExecuteMainFunctionality();

break;

case RESPONSE_DELAYED_EXECUTION:

// 在延迟后执行

ExecuteMainFunctionality();

break;

case RESPONSE_ALTERNATE_BEHAVIOR:

// 执行替代行为

ExecuteBenignActivity();

break;

case RESPONSE_TERMINATE_PROCESS:

// 安全退出

ExitProcess(0);

break;

}

```

Pafish的沙箱检测机制展现了多层次、多角度的环境识别技术。从硬件特征到用户行为，从时间特性到系统配置，每个检测点都针对沙箱环境的特定弱点。这种综合检测方法不仅对恶意软件分析有参考价值，也为安全研究人员提供了测试和加固沙箱环境的重要视角。理解这些检测原理，有助于构建更隐蔽的分析环境和开发更有效的对抗措施。