A forum for reverse engineering, OS internals and malware analysis 

Forum for announcements and questions about tools and software.
 #29911  by Pilot
 Thu Feb 02, 2017 1:02 am
Well, sorry for my bad English, but I started tune my VM and collided with a some difficulties.
1) First of all I had a mistake when I tried to run hidevm_ahci.cmd. Its running only when I rem 2 lines
rem %vboxman% setextradata "%n1%" "VBoxInternal/Devices/acpi/0/Config/DsdtFilePath" "%vmscfgdir%ACPI-DSDT.bin"
rem %vboxman% setextradata "%n1%" "VBoxInternal/Devices/acpi/0/Config/SsdtFilePath" "%vmscfgdir%ACPI-SSDT1.bin"
everything else were good.
2) Could smbd explaine me what this does cd /d %vmscfgdir%
I dont udrestand
3) When I try to run file install.cmd - I see (picture 1) and get blue screen on 2(!!!!!) PC and 1 laptop. Where is my mistake?
1.jpg
1 picture
1.jpg (51.42 KiB) Viewed 693 times
4) When I try to run file
loader.exe -l
@pause
I get this mistake (2 picture)
2.jpg
2 picture
2.jpg (24.53 KiB) Viewed 693 times
5) When I try to run loader.cmd I see this mistake (picture 3)
3.jpg
3 picture
3.jpg (63.66 KiB) Viewed 693 times
I would really appreciate if someone can help me understand.
 #29913  by EP_X0FF
 Thu Feb 02, 2017 4:54 am
2) Could smbd explaine me what this does cd /d %vmscfgdir%
I dont udrestand
Use the /D switch to change current drive in addition to changing current
directory for a drive.
%vmscfgdir%
rem vmscfgdir is the path to directory that keeps vbox custom configuration data (bioses, tables etc)
Example given. From your screenshot you put Binary folder in D:\1, so open hidevm_ahci.cmd and replace this line

set vmscfgdir=D:\Virtual\VBOX\Settings\
with
set vmscfgdir=D:\1\Binary\
When I try to run file
loader.exe -l
@pause
There is no such command "-l". It was in first versions of this loader and later was removed. But it is still listed in first post of this thread, actual guide always on project github page -> https://github.com/hfiref0x/VBoxHardene ... README.txt Because of that this forum post isn't updated frequently, guess it is time to update it.
3) When I try to run file install.cmd - I see (picture 1) and get blue screen on 2(!!!!!) PC and 1 laptop. Where is my mistake?
Tsugumi.sys is old, corrupted or you have conflicting software (av crap what so ever, anyway minidump required to tell exact source of problem).
 #29926  by sss36103
 Sun Feb 05, 2017 10:03 am
Thanks for all the information on the page,very useful!
And I have a question,where you can view detailed information about changes in the other hardware,BIOS and similar information?On the site virtualbox.org there is only information that you have provided. Also I noticed a lot of traces of the virtual machine in the registry,for example hard disk,CPU, cd drive.Remove course you can,but I sure find it very difficult.
Thank you for any reply,really need to change other information about virtual reality,not just the one shown.
 #29928  by EP_X0FF
 Mon Feb 06, 2017 3:26 am
sss36103 wrote:Thanks for all the information on the page,very useful!
And I have a question,where you can view detailed information about changes in the other hardware,BIOS and similar information?On the site virtualbox.org there is only information that you have provided. Also I noticed a lot of traces of the virtual machine in the registry,for example hard disk,CPU, cd drive.Remove course you can,but I sure find it very difficult.
Thank you for any reply,really need to change other information about virtual reality,not just the one shown.
Do not install VBox Additions - problem solved.
 #29929  by kbe04370
 Mon Feb 06, 2017 3:52 am
EP_X0FF wrote:
sss36103 wrote:Thanks for all the information on the page,very useful!
And I have a question,where you can view detailed information about changes in the other hardware,BIOS and similar information?On the site virtualbox.org there is only information that you have provided. Also I noticed a lot of traces of the virtual machine in the registry,for example hard disk,CPU, cd drive.Remove course you can,but I sure find it very difficult.
Thank you for any reply,really need to change other information about virtual reality,not just the one shown.
Do not install VBox Additions - problem solved.
But some of the data in the registry? I have attached a scan of the registry on different queries,view. How about changing other hardware in virtual reality? you did not answer.
Но как же некоторые данные в реестре? Я приложил скан реестра на разные запросы,посмотрите. Как насчёт смены другого железа в виртуалке? вы не ответили. Я заметил что вы из России,думаю мне легче вам на русском писать)
Attachments
regedit scan
(3.24 KiB) Downloaded 38 times
regedit scan
(12.66 KiB) Downloaded 36 times
regedit scan
(49.31 KiB) Downloaded 37 times
 #29931  by kbe04370
 Mon Feb 06, 2017 4:15 pm
EP_X0FF wrote:And what? Your logs only indicate that patch was not installed or VM not configured or both.
Like what? Vbox guest addon I didn't install, the script hidevm used,but still information in the registry - there!
But I have 3 times asked you about changing other hardware,BIOS,and other information, and you do not answer!!! How all the same to change the video card,sound card,BIOS and other settings,where you can see all of this? Tell me please.
Last edited by EP_X0FF on Wed Feb 08, 2017 4:07 am, edited 1 time in total. Reason: Color and russian language removed
 #29934  by EP_X0FF
 Wed Feb 08, 2017 4:06 am
First of all: This is international forum. Not everyone here understand what you write in Russian. Please post in English only. If you are unable to speak English, please use Google Translate (http://translate.google.com). Thank you. (http://www.kernelmode.info/forum/viewtopic.php?f=8&t=16)
Second: Red texts are not something usual users should use. You could be banned for this and our wonderful discussion will end from this point.
Third: I repeat you again and again -> if you still have VBOX shit in your registry this means you didn't applied patch. Driver is not loaded, nothing is patched. Driver is core of this patch. Unless it loaded DSDT/SSDT cannot be changed and no hardware identificators can be patched, so you can millions time post here your export from registry - this won't help.
 #30017  by newcomer
 Wed Feb 22, 2017 7:54 pm
Good afternoon,

Can you give a short manual how is right way to use kasumi.exe?
When i run get this output
Code: Select all
VirtualBox Patch Generator

Input file not found

VPG: Press Enter to exit
And how to active two way copy-paste from Host to Guest. ISO method is only one way.
I see you mention.
Copy a small ftp client to the VM and use Host-FTP-Server -> Guest->FTP-Client.
Can you give more details on this method?
 #30020  by EP_X0FF
 Thu Feb 23, 2017 3:57 am
Try this
kasumi.exe c:\pathtovboxdd\vboxdd.dll

Since 1.8 it is integrated into loader itself and will generate table automatically each loader start.
And how to active two way copy-paste from Host to Guest. ISO method is only one way.
Setup FTP on host and connect to it from VM. For example LightFtp on host + TotalCommander in VM.
  • 1
  • 18
  • 19
  • 20
  • 21
  • 22
  • 25