<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Sandbox Evasion Analysis — API Reference

## x64dbg + ScyllaHide

### ScyllaHide Options

| Option | Bypasses |
|--------|----------|
| NtQueryInformationProcess | ProcessDebugPort, ProcessDebugObjectHandle |
| IsDebuggerPresent | PEB.BeingDebugged |
| NtQuerySystemInformation | SystemKernelDebuggerInformation |
| GetTickCount | Timing-based detection |
| NtSetInformationThread | ThreadHideFromDebugger |
| BlockInput | Anti-analysis input blocking |

### Manual Anti-Debug Bypass

```
# PEB.BeingDebugged patch
# In x64dbg: dump PEB address, set byte at offset 0x2 to 0

# IsDebuggerPresent bypass
bp IsDebuggerPresent
# On hit: set EAX=0, F9 to continue

# NtQueryInformationProcess bypass
bp NtQueryInformationProcess
# On hit: if RDX==0x7 (ProcessDebugPort), set output buffer to 0
```

## Pafish (Paranoid Fish)

```bash
# Build and run in target environment
git clone https://github.com/a0rtega/pafish
cd pafish && make
./pafish.exe   # Reports detected evasion checks
```

## al-khaser

```bash
# Comprehensive anti-analysis test suite
git clone https://github.com/LordNoteworthy/al-khaser
# Build with Visual Studio
# Run: al-khaser.exe — tests 80+ evasion techniques
```

### Categories Tested

- Anti-debugging (API, timing, exception-based)
- Anti-VM (VMware, VirtualBox, QEMU, Hyper-V, Xen)
- Anti-sandbox (Cuckoo, Any.run, Joe Sandbox)
- Anti-DBI (PIN, DynamoRIO)
- Timing attacks (RDTSC, NtQueryPerformanceCounter)

## CAPE Sandbox — Evasion Monitoring

```python
# CAPE REST API — submit with evasion tracking
import requests
url = "http://cape-server:8000/api/tasks/create/file/"
files = {"file": open("sample.exe", "rb")}
data = {"options": "procmemdump=1,evasion=1"}
r = requests.post(url, files=files, data=data)
task_id = r.json()["data"]["task_ids"][0]
```

## CPUID Checks (Inline Assembly Reference)

```c
// CPUID leaf 0x1 — hypervisor bit
int cpuinfo[4];
__cpuid(cpuinfo, 1);
bool hypervisor = (cpuinfo[2] >> 31) & 1;  // ECX bit 31

// CPUID leaf 0x40000000 — hypervisor vendor string
__cpuid(cpuinfo, 0x40000000);
// EBX+ECX+EDX = "VMwareVMware" / "Microsoft Hv" / "KVMKVMKVM"
```
