{"id":5456,"date":"2018-10-21T00:10:45","date_gmt":"2018-10-21T00:10:45","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=5456"},"modified":"2018-10-21T00:52:19","modified_gmt":"2018-10-21T00:52:19","slug":"possible-anti-sandbox-trick-using-setsystemtimeadjustment-api","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2018\/10\/21\/possible-anti-sandbox-trick-using-setsystemtimeadjustment-api\/","title":{"rendered":"Possible anti-sandbox trick using SetSystemTimeAdjustment API"},"content":{"rendered":"

Update<\/strong><\/p>\n

Just to expand on the forensic side of things – the time adjustment value, if changed, does not survive the reboot; i.e the adjustment value is not stored anywhere (e.g. in Registry).<\/p>\n

Old post<\/strong><\/p>\n

Today I was browsing some of my archives and (re-)discovered a program written by <\/strong>my ex-coworker before Tue Feb 10 20:20:38 2004 (thx PE compilation time ;). The program was written with QA test automation in mind, but when I ran it today on my win7 VM I realized that the very same trick could be used to affect the inner working of the sandbox systems, or even disturb some reversing work…<\/p>\n

The program is simple; it allows the user to modify the ‘adjustment’ value for the Windows Clock.<\/p>\n

What does it mean?<\/p>\n

Googling around I found this post<\/a> that explains the inner workings of this mechanism better than I could ever do myself. The magic API is called SetSystemTimeAdjustment<\/a>;<\/em> it’s good to know that it internally calls NtSetSystemInformation<\/em> with a SystemTimeAdjustmentInformation<\/em> parameter. Sandbox programmers please take a notice.<\/p>\n

As per the MSDN article:<\/p>\n

The GetSystemTimeAdjustment<\/em> and SetSystemTimeAdjustment<\/em> functions support algorithms that synchronize the time-of-day clock, reported via GetSystemTime<\/em> and GetLocalTime<\/em>, with another time source using a periodic time adjustment.<\/p>\n

Okay, enough theory.<\/p>\n

After I ran the program and adjusted the ‘adjustment’ (pun intended) setting to the ‘max’ my clock went completely crazy:<\/p>\n

\"\"<\/a><\/p>\n

(btw. this is tested and recorded on win7; win10 clock is such a ‘paradigm shift’ in the user interface that I can’t even begin to describe my despair…)<\/p>\n

Running timeout 10<\/em> command suddenly doesn’t work as it should. It exits immediately or almost instantly and shows some funny values on the screen (kinda integer overflow ;). Same goes for timeout 100, 1000, 10000…<\/p>\n

\"\"<\/a><\/p>\n

Interestingly, running ping 127.0.0.1<\/em> doesn’t cause any issues.<\/p>\n

And this is because timeout<\/em> is using a _time<\/em> API function that is being checked every 100 ms. If we adjust the clock to run faster the _time<\/em> function will produce the result that is immediately much higher than expected under normal circumstances (so, delta between the start<\/em> value and next<\/em> value is big enough o satisfy the exit condition); as a result, the timeout<\/em> program will quit. Ping is using a call to Sleep (1000)<\/em> API in a loop (between the pings, the number of which is default 3 and can be changed by the -n command line argument), and that’s why it is not affected.<\/p>\n

So, the conclusion can be that if any program ran by a sandbox on the test system is relying on a difference<\/em> between two sequential values returned by any of the time function relying on the adjustment (GetSystemTime , GetLocalTime, _time, etc.) – it will be affected. Sandboxes that don’t run any ‘worker’ programs on the guest system can sleep well, but… don’t they all run auto clickers (for GUI programs) these days? And these must rely on some delays\/time functions. Hmm… As usual, a subject for a further research. I also wonder if changing the settings will affect existing software and potentially introduce some interesting race conditions or at least DoS. The good news is that use of this API requires admin privileges,<\/p>\n","protected":false},"excerpt":{"rendered":"

Update Just to expand on the forensic side of things – the time adjustment value, if changed, does not survive the reboot; i.e the adjustment value is not stored anywhere (e.g. in Registry). Old post Today I was browsing some … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,28,41],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5456"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=5456"}],"version-history":[{"count":10,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5456\/revisions"}],"predecessor-version":[{"id":5468,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5456\/revisions\/5468"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=5456"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=5456"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=5456"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}