What are the best solutions for sandboxing and debugging?

Malware analysis involves sandboxing, debugging, and analysis tools. I'm hoping you guys can help me figure out the finer details in setting up my malware analysis rig.

I think I want to do nested VMs (like Qemu running within Virtualbox running within VMware, or something like that) for added security against VM breakout 0 days, but I want to know what you think. I have 32GB of RAM so I can afford to be inefficient.

I won't give the VMs network access just in case they have some self-propagating Cryptolocker-esque shit that tries to infect my network drives. Or maybe I should just set up a separate VLAN and make ACL rules so that my test rig can't interact with any other private addresses, meaning it can't touch my other local stuff. Then I could still monitor shit in Wireshark even if I can't into proper debugging forensics.

As far as debuggers go, I've heard that Ollydbg is good, but I have no experience with such things so I'm not sure if that's true or not.
Also how can I make a VM not appear to be a VM? And how can I get around some malware's anti-debugging features?

Also, aside from Wireshark and Process Explorer, what are some other good tools for analyzing what's happening within an OS? Windows or GNU/Linux, doesn't matter, since I'll be doing tests for malware and exploits for all kinds of systems.

Thanks in advance, cuties.

>>10
If you use a dedicated PC as opposed to virtualization you run the risk of getting hard drive or even BIOS level rootkits which will persist even after reformats. Hell, there has even been a GPU rootkit proof-of-concept recently. No antivirus programs scan VRAM or check graphics card firmware. It's actually a pretty genius concept if you think about it.
But yeah, I don't want to infect my actual hardware. I'd rather just run a virtual machine and reload the snapshot whenever I want to start off fresh. Reflashing a BIOS constantly isn't someone I'd want to do. And I have no idea how I'd go about resetting hard drive firmware.