# Bypassing Anti Vm And Sandbox Checks

> Bypasses anti-VM and sandbox checks during analysis by locating the specific detection

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-bypassing-anti-vm-and-sandbox-checks`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/bypassing-anti-vm-and-sandbox-checks
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-bypassing-anti-vm-and-sandbox-checks
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Bypassing Anti-VM and Sandbox Checks

## When to Use

- An evasive sample refuses to detonate under analysis and you need to locate and neutralize its
  anti-VM/sandbox checks (artifact strings, timing stalls, CPUID hypervisor bit, MAC/registry
  checks).
- You are planning patches or environment hardening to force execution.

**Do not use** patching as a shortcut that changes malicious logic — patch only the evasion gate.
Run only in an isolated, instrumented VM with snapshots.

## Prerequisites

- The sample and a debugger/disassembler on an isolated VM.

## Safety & Handling

- The sample executes during bypass work; use a disposable, snapshotted, network-controlled VM.

## Workflow

### Step 1: Locate the evasion checks

```bash
python scripts/analyst.py locate sample.bin
```

Reports offsets of anti-VM artifact strings, timing APIs (`GetTickCount`, `rdtsc`), CPUID usage,
and environment-fingerprint APIs to point you at the detection routines.

### Step 2: Plan the bypass

For each check decide the approach: patch the conditional jump after the check, hook/stub the API
to return benign values, or harden the VM (rename adapters, patch registry, add fake processes).

### Step 3: Apply and verify

Patch the gate (e.g., force the "not detected" branch) and confirm the sample proceeds past the
check.

### Step 4: Document

Record each check, its offset, and the bypass applied for reproducibility.

## Validation

- Each located check maps to a real detection primitive (string/timing/CPUID/API).
- The patched/hooked gate provably lets execution continue.
- Only the evasion gate is altered, not the payload logic.

## Pitfalls

- Multiple layered checks — bypassing one is not enough.
- Timing checks needing instruction-accurate handling (`rdtsc` deltas).
- Anti-tamper detecting the patch; prefer hooking returns over byte patches when fragile.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the locator.
- ATT&CK T1497 and the CPUID hypervisor bit reference (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-bypassing-anti-vm-and-sandbox-checks
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.