virtualization technology is being used more and more frequently as time goes onwhether because of paranoid userscross-platform requirements for office softwareor the concentration of services onto beefier hardware systems in each of these casesif you've compromised host system and you see vms in useit can be handy to climb inside them if you also see vm snapshot files lying aroundthey can be perfect place to implant shell-code as method for persistence if user reverts to snapshot that you've infectedyour shellcode will execute and you'll have fresh shell part of performing code injection into the guest is that we need to find an ideal spot to inject the code if you have the timea perfect place is to find the main service loop in system process because you're guaranteed high level of privilege on the vm and that your shellcode will be called the downside is that if you pick the wrong spotor your shellcode isn' written properlyyou could corrupt the process and get caught by the end user or kill the vm itself we're going to do some simple reverse engineering of the windows calculator application as starting target the first step is to load up calc exe in immunity debugger[ and write simple code coverage script that helps us find the button function the idea is that we can rapidly perform the reverse engineeringtest our code injection methodand easily reproduce the results using this as foundationyou could progress to finding trickier targets and injecting more advanced shellcode thenof coursefind computer that supports firewire and try it out therelet' get started with simple immunity debugger pycommand open new file on your windows xp vm and name it codecoverage py make sure to save the file in the main immunity debugger installation directory under the pycommands folder from immlib import class cc_hook(logbphook)def __init__(self)logbphook __init__(selfself imm debugger(def run(self,regs)self imm log("% xregs['eip'],regs['eip']self imm deletebreakpoint(regs['eip']return def main(args)imm debugger(calc imm getmodule("calc exe"imm analysecode(calc getcodebase()functions imm getallfunctions(calc getcodebase()hooker cc_hook(for function in functionshooker add("% xfunctionfunctionreturn "tracking % functions len(functionsthis is simple script that finds every function in calc exe and for each one sets one-shot