Skip to content

Troubleshooting: Oracle VirtualBox

If the appliance is deployed but isn't behaving as expected, work through the issues below. If it boots but never connects, or the tunnel drops right after it establishes, the cause is usually firewall L7/TLS inspection or NAC, not this platform: see Connectivity troubleshooting.

VirtualBox refuses to start the VM with a VERR_SUP_VP_FOUND_EXEC_MEMORY error

The dialog is titled Error In supR3HardenedWinReSpawn and reports NtCreateFile(\Device\VBoxDrvStub) failed with VERR_SUP_VP_FOUND_EXEC_MEMORY and "Found executable memory allocated in the process". This is VirtualBox's own Windows process-hardening check and has nothing to do with the appliance image: before the VM starts, VirtualBox scans its process for executable memory that is not backed by a mapped image file, and aborts if it finds any. Something on the host is injecting code into the VirtualBox process.

The usual causes, most common first:

  1. Host endpoint security (antivirus or EDR) that hooks user-mode processes.
  2. Overlay or capture utilities that load a DLL into every process: screen recorders, GPU tuning tools, input remappers, chat and game overlays.
  3. Windows Exploit Protection mitigations applied to VirtualBox.exe.

Identify the injector instead of guessing. VirtualBox logs every module it scans:

%USERPROFILE%\VirtualBox VMs\Sophos-RTA\Logs\VBoxHardening.log

Search that file for VERR_SUP_VP_FOUND_EXEC_MEMORY or supHardNtVpScanVirtualMemory. The modules listed immediately before the failure name the offending DLL; anything that is not a Microsoft or Oracle module is your culprit.

Then work through the fixes, cheapest first:

  • Close overlay and capture utilities, then start the VM again to confirm.
  • Add exclusions in the host endpoint product for the VirtualBox install directory and the VirtualBox machine folder, plus process exclusions for VirtualBox.exe, VBoxHeadless.exe and VBoxSVC.exe. On a managed corporate build these normally have to be pushed centrally by whoever administers that product; a local exclusion is often not enough.
  • Remove any override on VirtualBox.exe under Windows Security → App & browser control → Exploit protection settings → Program settings.
  • Repair or reinstall VirtualBox, and make sure the Extension Pack version matches the VirtualBox version exactly. Confirm the driver is running with sc query VBoxDrv from an elevated prompt.

If the host is a managed build and you cannot get the exclusions applied, do not fight it: deploy the appliance on VMware Workstation instead, which performs no such check and takes the same OVA. Ask your engagement lead if you need the image in a different format.

The VM shows a black screen or drops to an EFI shell

EFI firmware is not enabled. Power off the VM, go to Settings → System → Motherboard and tick Enable EFI (special OSes only), then start again. If you used the CLI, confirm VBoxManage modifyvm "Sophos-RTA" --firmware efi ran without error and the VM was fully powered off before you ran it.

The VM boots but cannot reach targets on the LAN

The network adapter is probably set to NAT. Power off the VM, change Settings → Network → Adapter 1 to Bridged Adapter and select the host NIC connected to the engagement LAN, then restart. For the CLI, use VBoxManage modifyvm "Sophos-RTA" --nic1 bridged --bridge-adapter1 "<HOST_NIC>".

How do I check the appliance's status?

This image is customized for your engagement and boots already registered. Open the VM console window in VirtualBox Manager to see the live status and troubleshooting dashboard (network interface, VPN tunnel, connectivity health). If the VM is running headless, use VBoxManage startvm "Sophos-RTA" --type gui or relaunch with the GUI type to view the console.

Import fails with a disk size or format error

Ensure you have at least 40 GB of free space on the VirtualBox default machine folder drive. If the OVA was corrupted during transfer, request a fresh copy from your engagement lead.

The OVA sets fewer than 4 vCPU or less than 8 GB RAM

Override at import time with --vsys 0 --cpus 4 --memory 8192 (CLI), or adjust the values in Settings → System → Processor and Settings → System → Motherboard after import.