Buster Sandbox Analyzer

Discussion in 'sandboxing & virtualization' started by Buster_BSA, May 4, 2020.

  1. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    Hello hello~ Do you know what the problem I described above is going on?
     
  2. Buster_BSA

    Buster_BSA Registered Member

    Joined:
    Nov 29, 2009
    Posts:
    746
    Ok, then for "bsa1" the pipe name will be "BSA100", for "bsa2" will be "BSA200" and for "bsa3" will be "BSA300".

    Now you just miss next steps:

    1) Run BSA.EXE from "[...]\bsa1" folder and at "Program Options > Change Title" introduce "BSA100".

    2) Then go to "Utilities > LOG_API > LOG_API Patcher" and select "logapi64.dll" from "[...] \bsa1" folder.

    Repeat the two steps for "bsa2" and "bsa3" using "BSA200" and "BSA300".

    That's all.
     
  3. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    okay, thank you. Let me try
     
  4. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    Thank you very much for your answer, the modification was successful. But I still get stuck here. After testing multiple bsa before

    upload_2020-12-20_10-58-21.png
     

    Attached Files:

  5. Buster_BSA

    Buster_BSA Registered Member

    Joined:
    Nov 29, 2009
    Posts:
    746
    Did you try already what I told you in message #112?
     
  6. Buster_BSA

    Buster_BSA Registered Member

    Joined:
    Nov 29, 2009
    Posts:
    746
    This screenshot is strange. You analyzed a document file but seems like the extension (.docx) is not associated to anything in the system. I don't understand why Microsoft Word was not launched.
     
  7. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    Hello~ I did everything you said
     
  8. Buster_BSA

    Buster_BSA Registered Member

    Joined:
    Nov 29, 2009
    Posts:
    746
    When you analyzed the microsoft word document, did your PC open it?
     
  9. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    upload_2020-12-20_11-21-20.png


    My analysis of txt can end normally, but the analysis of docx will get stuck
     
  10. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    Word not opened
     
  11. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    upload_2020-12-20_11-26-20.png


    upload_2020-12-20_11-26-36.png


    bmp and word will stop
     
  12. Buster_BSA

    Buster_BSA Registered Member

    Joined:
    Nov 29, 2009
    Posts:
    746
    As soon as possible I'll prepare a special version of BSA that will help me to find the problem. Wait until I have it ready, please.
     
  13. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
  14. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    How to disable PEID?
     
  15. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    I found a problem, as long as the file content is empty it will stop
     
  16. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    upload_2020-12-20_14-30-17.png


    upload_2020-12-20_14-30-53.png



    There is another problem. If the docx is not empty, it will become a zip when opened with BSA
     
  17. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    How does peid work with Bsa?
     
  18. Buster_BSA

    Buster_BSA Registered Member

    Joined:
    Nov 29, 2009
    Posts:
    746
    Options > Report Options > Information

    Disable everything and check if BSA stops.
     
  19. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    ok Thank you ,How about the special version of BSA
     
  20. Buster_BSA

    Buster_BSA Registered Member

    Joined:
    Nov 29, 2009
    Posts:
    746
    First do this:

    Options > Report Options > Information

    Disable everything

    and tell me if BSA stops.
     
  21. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
    upload_2020-12-23_9-53-53.png


    upload_2020-12-23_9-54-28.png






    I disabled all functions, but it still stops if the analysis is empty.
     
  22. Buster_BSA

    Buster_BSA Registered Member

    Joined:
    Nov 29, 2009
    Posts:
    746
    Upload the file somewhere and send me the link,please.

    I'll use it to make tests.
     
  23. steve123455

    steve123455 Registered Member

    Joined:
    Dec 16, 2020
    Posts:
    89
    Location:
    china
  24. Buster_BSA

    Buster_BSA Registered Member

    Joined:
    Nov 29, 2009
    Posts:
    746
  25. Pliskin

    Pliskin Registered Member

    Joined:
    Feb 8, 2009
    Posts:
    431
    anonfiles.com is really simple
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.