VAXD - lightweight PE EXE/DLL disassembler and patch-assistance tool for Windows

[Bicurico]

Forgot to mention that the Download page offers the free VMA 486 Emulator. This can run DOS, Win 3.0, 3.1, 3.11 and 95. It includes a similar machine state analysis as VAXD_VM and even a "trainer" for games to detect the memory locations that store lives, power, etc.

VAXD_VM applies this concept to a VM running Win7 (chosen for compatibility, easy of implementation and reduced resources).

[Bicurico]

Adding the VAXD_VM user guide for those interested.

[Bicurico]

VAXD_VM now has support for Windows 10.



And it has a new feature, that shows the RAM activity for each 4KB page as a heat map. This allows finding memory locations with activity. Double-clicking the page will open it in Disassembler/Hex-Editor view.

[radiolistener]

2) I use ConfuseEx to obfuscate the binary, whicht triggers some heuristic scanners.

Yes, obfuscating .NET code can trigger malware detections because it makes the code significantly harder to analyze and verify as safe. From an antivirus perspective, this lack of transparency can itself be a red flag. The simplest solution is to avoid obfuscation, especially for software that needs to pass security checks.

[Bicurico]

[Bicurico]

VAXD_VM is now a native C++ application.

It currently supports Windows 7, Windows 10 and Linux (tested with Ubuntu).

The main purpose of VAXD_VM is live whole-machine analysis. With an ANALYSER license, the VM can be frozen at any point and its complete state inspected directly from the host. This includes live RAM disassembly, global hex editing, RAM page activity monitoring, breakpoints, STEP execution, register navigation, string/XREF analysis, C#/IL inspection and decompilation, machine-state recording over time, network monitoring and packet inspection, RS232 monitoring/sniffing, and other low-level analysis tools.

Because the analysis takes place from outside the guest, the target software does not need to run under a conventional debugger. The entire virtual machine can be stopped, inspected or modified, and then resumed. This is particularly useful for reverse engineering, malware analysis, debugging, runtime patching and investigating software that reacts badly to normal debuggers.

The VM itself can also be used without a license. In that mode the ANALYSER tab is disabled, but VAXD_VM still works as a lightweight portable Windows/Linux virtual machine. That can be useful for quickly running an unknown executable in an isolated environment and observing its basic behavior or network activity before allowing it anywhere near the host system.

As a general-purpose VM host, VAXD_VM is not intended to replace VMware or VirtualBox. Its advantage is different: it is portable, self-contained and analysis-oriented. There is no installer; unzip it, run the executable, boot a VM, and when deeper inspection is needed, the licensed analysis environment is already built into the same application.

[stj]

i can find no mention of what this software runs on!
i presume it's windowz but is it dependent on a specific version or minimum version?
any dep's like visual c libraries ?

i'm asking because i am thinking of running it in Linux using wine.

[Bicurico]

VAXD is made in .net and VAXD-VM is made in C++.

They are tested under Windows 11. VAXD-VM will currently work only with Intel processors. There is a bug with AMD, which I have not been able to fix, yet. I doubt you will be able to run VAXD-VM under Linux, as it uses Windows Hypervisor Platform.

[stj]

well i'm 100% AMD here,
but VAXD will probably run with MONO so thats o.k.
thanks for the quick reply.

[Bicurico]

There is now a new tool in the VAXD package: VAXD Firmware Tools.

It started mainly as a converter for firmware formats, but has grown into a more general firmware/image analysis utility.

It currently supports conversion/inspection of Binary, Intel HEX, Motorola S-Record, TI-TXT, UF2 and ELF files, including sparse address ranges.

There is also an integrated hex/ASCII editor, file comparison, patching and checksum tools.

The part I find particularly useful is the Image Explorer. It can look inside various firmware and disk images and extract the files contained in them. This is useful when, for example, a firmware update contains a Linux filesystem and what I actually want to analyse is one executable buried inside the image.

It currently understands several filesystem/disk-image types, including embedded flash filesystems and some older computer formats such as DOS floppy images, Amiga ADF, C64 D64 and CP/M DSK.

So the intended workflow is basically:

firmware image → extract file → analyse/disassemble it in VAXD

rather than having to use several unrelated utilities just to get at the executable.

[Bicurico]

Finally found and fixed the bug that prevented VAXD-VM from running on my Lenovo Legion Go Z1E (AMD CPU).



Will publish the new version soon.

Regarding VAXD Firmware Tools, here are some pictures. I find it very useful to be able to open and browse different formats like *.jffs2 to directly extract the required files - no more running Linux in a VM to mount the file...

[Bicurico]

VAXD-VM has reached another milestone: it now supports up to 8 virtual CPUs per VM and up to 8 concurrent virtual machines.

The concurrent VMs can be connected through an integrated virtual Ethernet switch, allowing them to communicate with each other while VAXD-VM monitors the traffic between them. The virtual network can either be completely isolated or connected to the host LAN.

More interesting from the analysis/debugging side is that the complete environment can now be frozen at once. This means I can stop all the VMs while they are communicating and then inspect each machine individually - RAM, processes, CPU state, disassembly, etc. Breakpoints can also be set in the individual VMs before resuming execution.

So VAXD-VM is gradually becoming not just a VM with an external analyser, but a small virtual analysis lab where several machines and their network traffic can be examined from outside the guest operating systems.

Overview of the running VMs:



Individual VM screen and controls:



Analyser tab showing detailed information for VM1:



Virtual switch with captured network packets:

[Bicurico]

Update:

The multi-VM support has now become quite practical to use. I have been testing it with six VMs running concurrently, including Windows 7, Windows 10 and Linux guests.

The OVERVIEW tab shows all running machines at once:



Each preview is live and can be clicked to jump directly to that VM. I also added Ctrl+F11 as a global shortcut back to the overview. This turned out to be surprisingly convenient: click a VM, work with it normally, then Ctrl+F11 releases the mouse and immediately returns to the overview.

The virtual switch has also evolved into a small integrated network analyser:



It now shows source/destination VM, MAC and IP addresses, packet size, EtherType and decoded protocol information. Broadcast, multicast and unicast traffic are distinguished, packets can be selected without the live capture constantly destroying the selection, and the lower pane shows both the raw hex/ASCII packet and decoded details.

The switch can either remain completely isolated between the VMs or be bridged to the physical LAN. For isolated networks there is also an optional built-in DHCP server. Captures can be exported as PCAP for further analysis.

Packet logging can be disabled when it is not needed, to reduce the overhead.

The idea is increasingly to make the multi-VM environment useful for analysing complete systems rather than just individual machines: several guests, their network traffic, and the individual VM analysers can all be observed from the same application.

[Bicurico]

VAXD_VM now includes a dedicated OpenWrt VM mode.

If one of the 9 available VM slots is configured as OpenWrt, VAXD_VM assigns it 9 virtual network adapters: 8 LAN ports, which can be connected to the other 8 VMs, plus a 9th adapter connected to the host LAN and used as WAN.

This effectively allows VAXD_VM to simulate and analyse a complete network, including the router itself.

Some possible applications:

- Freeze the complete network at once - all VMs, the virtual switch and the OpenWrt router - and then inspect what was happening at that exact moment.

- Debug and experiment with OpenWrt while it is actually routing traffic between live virtual machines.

- Build a complete honeypot/honeynet setup on a single physical computer, with OpenWrt providing the firewall/router between the virtual network and the outside world.

- Have much better control over how the virtual network accesses the host LAN, instead of connecting every VM directly to the physical network.

- Analyse traffic both at the individual VM interfaces and at the router/WAN side.

The OpenWrt tab also provides the internal serial console and shows the individual virtual NICs, their connection to the other VMs, and RX/TX activity.

The interesting part for me is not simply that OpenWrt runs as another VM. The router is now part of the environment being analysed, so the complete network can be stopped, inspected and later resumed as one system.

[0xdeadbeef]

Sorry, I need to ask: considering the insane speed at which you implement new, complex features I wonder how much of this is actually manually coded and how much is AI created.

Also, I wonder what kind of test concepts you have to ensure that all these new features are actually working correctly.

And how large is the user base to actually use these features (approximately)? Are there only a few users or is the user base large enough to be somewhat confident that all of this is really working reliably?

[Bicurico]

I don't disclose my way of working. I can tell you that I work a lot on this, often day and night.

You are welcome to request a test license, so you can try it yourself.

[PA0PBZ]

Well...  https://www.eevblog.com/forum/chatgptai/it-is-unbelievable-what-you-can-program-with-ai-in-2026!

[Bicurico]

So what?

[Bicurico]

VAXD-VM networking has received another fairly major update.

Each VM can now have up to 9 virtual network adapters, and the 9 available VM slots can independently run Windows 7, Windows 10, Linux, or generic appliances such as OpenWrt, TrueNAS, etc.

I removed the previous special OpenWrt mode and replaced it with a generic Appliance mode. This makes the networking much less restrictive and allows considerably more complex virtual networks to be built.

For example, an appliance VM can have several NICs connected to different virtual switches, other VMs, and the host LAN. OpenWrt can therefore be used as the router/firewall for the complete virtual network, but it is no longer treated as a special case.

The complete setup of up to 9 machines can be frozen at any moment and analyzed. Depending on the guest and configuration, this includes the disassembler, hex editor, network analyzer, RS232 console (physical or emulated), and WinUSB devices.

The complete frozen machine state can also be saved, loaded and resumed later.

One part I am particularly pleased with is the new Network Setup form.

Instead of configuring network connections through a collection of settings, the user can now simply connect the VM NICs using virtual patch cables.

The topology can contain:

up to 9 NICs per VM
up to 9 simultaneous VMs
a virtual router providing access to the host LAN
three additional virtual switches
direct VM-to-VM connections
disconnected/isolated networks

The first screenshot shows a relatively simple setup:



The second shows why having up to 9 NICs per VM becomes useful. VM1 is configured as an appliance and connects several different machines/networks:



All virtual LAN traffic can of course be monitored in real time using the integrated network analyzer, and captured traffic can be exported as PCAP for further analysis in Wireshark.

For me, the interesting part is that VAXD-VM is gradually becoming more than a collection of individual VMs. It is possible to construct an entire small virtual network - including its router and even a NAS (for instance) - run it, monitor the traffic, freeze the whole environment at an interesting moment, inspect the individual machines, and subsequently resume it.

One limitation remains with hardware passthrough: I can support WinUSB devices and RS232, but generic USB and PCI passthrough cannot reasonably be included because the required Windows kernel-side support would need appropriately signed drivers.

[zepto]

Why does this advertisement need a thread here?

Not useful for 99% of members. Not free. Not some service to the community.

[Bicurico]

Spectrum analyzers, oscilloscopes, development tools and plenty of commercial software discussed on this forum aren't free either.

VAXD/VAXD_VM is a technical project, and I post development updates because some members here are interested in this kind of low-level virtualization, debugging and analysis work. Some even contribute with suggestions.

Nobody is required to buy it, or even read the thread. If it isn't useful or interesting to you, simply move on.

[Bicurico]

Whole virtual network running inside VAXD_VM:

VM1 = OpenWrt appliance with 8 LAN ports + 1 WAN port
VM2 = Windows 7
VM3 = Windows 7
VM4 = Windows 10
VM5 = Ubuntu Linux
VM6 = TrueNAS





All six machines are connected through the virtual network topology and can communicate through the virtual switches/router just like a small physical lab network.

The interesting part is that the complete environment can be treated as one analysis target: traffic can be monitored in real time, individual machines can be inspected, and the whole network can be frozen at the same instant for further analysis.

That means the router, Windows systems, Linux systems and storage appliance can all be stopped together at one precise point in time, examined, and then resumed.

For me, this is where the multi-VM support becomes particularly useful: instead of analyzing an isolated VM, VAXD-VM can now reproduce and inspect the behavior of an entire heterogeneous network.