Code Engn, profile picture
Uploaded byCode Engn
PDF, PPTX1,464 views

[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹

This document contains information about various techniques for hooking functions in the Windows kernel, including kernel hooks, SSDT hooking, IDT hooking, one-byte hooking, and blind hooking using debug registers. It discusses the motivations, concepts, and demonstrations of each technique. The document also contains information on kernel structures like EPROCESS, ETHREAD, KPCR, TEB, and PEB. It provides code samples and explanations for techniques like modifying the SSDT, hooking interrupts, and using debug registers to dynamically hook functions without directly patching memory or tables.

Embed presentation

Download as PDF, PPTX
www.CodeEngn.com July 21, 2007 Sammuel koo dual5651@hotmail.com Null @ Root Hook the Planet
www.CodeEngn.com 1) What is a kernel hook used for? 2) Get into the Ring0! 3) Review 4) Hook the planet! 5) Hook me, If you can! 6) ?
www.CodeEngn.com 1) Kernel hooks are global (relatively speaking). 2) Rootkit / Protection / Detection software are both in Ring Zero. 3) By using kernel hook, We can study the behavior of the system. 4) By using kernel hook, we can get performance data for specific tasks and generating statics.
www.CodeEngn.com How to make code run on Ring0? - Call gate : CPL change 3 from to 0 - Software Interrupt : API Call, Exception, .. - Device Driver : It doesn`t mean Usermode driver but Kernelmode drvier, because Kernelmode driver run on Level0, however, Usermode driver run on Level3.
www.CodeEngn.com □ Code of exe file is located into Paged Memory, In contrast, Code of sys file is located into NonPaged Memory. □ Both exe file and sys file has PE(Portable Executable) file format. □ DPL of CS in sys file has value 0, however, DPL of CS in exe file has value 3. It means CS of sys file can access all of instructions and memorys, In contrast, CS of exe file has limited access right. Header of 1stDriver.sys : Header of cmd.exe :
www.CodeEngn.com 1. Compile C code by DDK 2. Assemble Asm code by KmdKit
www.CodeEngn.com You can link DDK to Visual Studio. If you use Visual Studio.net as IDE, You can use this way. 1. Download ddkbuild.bat from http://www.hollistech.com/Resources/ddkbuild/ddkbuild.htm 2. Copied it at c:progra~microsoft visu~vc7bin 3. Edit ddkbuild.bat set WNETBASE= C:WinDDK (Directory that DDK installed) 4. Making Project 1. Select makefile project. 2. Build cmdline : ddkbuild -WNET checked . 3. output / arrangement cmd skip 4. Build cmdline : ddkbuild -WNET chekced . -cZ
www.CodeEngn.com If you use Visual Studio 6.0 as IDE, You can use this way. 1) Download easysys from this url : http://sourceforge.net/projects/easysys/ 2) Easysys : It`s So easy!!
www.CodeEngn.com Simple Device Driver :
www.CodeEngn.com 1. Using SCM API 2. Using Undocumented API Pro : By using this way, you can load a Driver into the kernel without having to create registry key. Con : 1) The problem with this approach is That the driver will be pageable. Sometimes when memory is paged out, it cannot be accessed; It will occur BSOD(Blue Screen Of Death) with system crash. 2) Once it is loaded, it cannot be Unloaded until reboot. 1) When a driver is loaded using the SCM, it is non-pageable. This means your callback functions, IRP-handling functions, and other Important code will not vanish from Memory. 2) You can select start mode of Driver. SERVICE_BOOT_START(0x0) : Driver will be loaded by system loader. SERVICE_SYSTEM_START(0x1) : Load Driver when IoInitSystem is called. SERVICE_AUTO_START(0x2) : Load by SCM SERVICE_DEMAND_START(0x3) : Load by calling StartService() API. SERVICE_DISABLED(0x4) : Makes driver can not be loaded.
www.CodeEngn.com I/O Request Packets (IRP) Return Create UserMDL request(IRP) Address of UserMDL Communicate by UserMDL Create Named Event & Regist it Event Signal □ Communicate by IRP □ Communicate by IRP & UserMDL □ Communicate by IRP & Event Reset Event
www.CodeEngn.com
www.CodeEngn.com 1) KPCR (Kernel`s Processor Control Region) 2) EPROCESS (Executable Process) 3) TEB (Thread Environment Block) 4) ETHREAD (Executable Thread)
www.CodeEngn.com ETHREAD KTHREAD ETHREAD KTHREADKPROCESS (PCB) ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ThreadListHead Handle Table ObjectTable Vad Vad Vad VadRoot Vad SDT ServiceTable KERNEL ADDRESS SPACE 2G (0x80000000 ~ 0xFFFFFFFF) ActiveProcessLink EPROCESS of Another Process KPCR KPCRB
www.CodeEngn.com In Kernel Level, FS:0 = KPCR = 0xFFDFF000KPCR ( Kernel`s Processor Control Region )
www.CodeEngn.com
www.CodeEngn.com □ In Windows Kernel, Each process is represented as an EPROCESS into Kernel Memory. □ List of active processes is obtained by traversing a doubly linked list referenced in the EPROCESS Structure of each process. □ We can access EPROCESS by CurrentThread of KPRCB structure. □ The Windows scheduling algorithm is not executed at process.
www.CodeEngn.com ETHREAD: KTHREAD:
www.CodeEngn.com USER ADDRESS SPACE 2G (0x00000000 ~ 0x7FFFFFFF) TEB(0x7FFDEOOO) TIB TEB(0x7FFDEOOO) TIB DLL DLL DLL DLL LDR_MODULE LDR_MODULE LDR_MODULE LDR_MODULE PEB_LDR_DATA Process Image Stack Heap 0x40000000 ~ 0x7FFFFFFF 0x00000000 ~ 0x3FFFFFFF
www.CodeEngn.com TEB ( Thread Environment Block ) In UserLevel, FS:0 = TEB = 0x7ffde000 (1st Process) □ UserMode Application can access this structure directly. □ GetCurrentProcessId() function use this structure for getting PID. □ We can get PEB address from this structure.
www.CodeEngn.com PEB ( Process Environment Block ) □ UserMode Application can access this structure directly. □ This structure have loaded modules list. □ This structure have ProcessParameters information. □ IsDebuggerPresent() function use this structure.
www.CodeEngn.com
www.CodeEngn.com 1) Win32 UserLevel API Global Hooking 2) SSDT(System Service Distpach Table) hooking 3) IDT(Interrupt Descriptor Table) hooking 4) 0ne byte hooking 5) Blind hooking by using DRx
www.CodeEngn.com Win32 UserLevel API Global Hooking Motivation □ Is there no way to Dll Injection without read/write process memory, and CreateRemoteThread() API? □ Is there no way to hook Win32 API globaly?
www.CodeEngn.com Concept □ In Windows, DLL memory and mapped memory are shared. □ If we can modify memory of DLL without PageFault(Copy-On-Write), It will be applied to all processes. □ If we have chance to execute our code by victim process self, We don`t need CreateRemoteThread() anymore. □ In Windows, There is a region that will get mapped into every process address space, The name of this area is KUSER_SHARED_DATA.
www.CodeEngn.com 1. Get the EPROCESS of explorer.exe 2. Attach to explorer.exe 3. Get the PEB from EPROCESS 4. Find Kernel32.dll address from Ldr in PEB. 5. Find IsDebuggerPresent() address from IMAGE_EXPORT_DIRECTORY of kernel32.dll 6. Modify IsDebuggerPresent() code to jmp KUSER_SHARED_DATA+0x8 with CR0 trick. 7. Now just waiting for victim process call IsDebuggerPresent() Process
www.CodeEngn.com MOV EAX,DWORD PTR FS:[18] MOV EAX,DWORD PTR DS:[EAX+30] MOVZX EAX,BYTE PTR DS:[EAX+2] Original IsDebuggerPresent() code: Modifed IsDebuggerPresent() code: MOV EAX , KUSER_SHARED_DATA+0x8 JMP EAX
www.CodeEngn.com PAYLOAD: DLL loading code : pushad pushfd push KSD + 0x8 + sizeof(DLL load code) call [KUSER_SHARED_DATA] popfd popad jmp [KUSER_SHARED_DATA+0x4]
www.CodeEngn.com Demonstration
www.CodeEngn.com SSDT(System Service Distpach Table) hooking Motivation □ Is there no way to hook Native API as easier as IAT hook? □ Is there no way to hook Native API globaly?
www.CodeEngn.com Concept □ Native system services`s addresses are listed in SSDT. □ KeServiceDescriptorTable is exported by the ntoskrnl.exe □ Windows XP later versions of the OS make the SSDT read-only, but we can bypass this protection with CR0 trick or MDL. □ We can get index number of Native API that we want to hook from ntdll.dll
www.CodeEngn.com 1. Build the function that has same prototype with Native API to hook. 2. Get the index number of Native API. 3. Get address of SSDT by referencing KeServiceDescriptorTable. 4. Make SSDT memory area writeable. 5. KeServiceDescriptorTable->ServiceTableBase[index] = HookFunction; Process
www.CodeEngn.com □ The KeServiceDescriptorTable is a table exported by the kernel, This table contains the core system services implemented in ntoskrnl.exe. □ There is another table in Windows Kernel, called KeServiceDescriptorTableShadow, that contains the address of USER & GDI services implemented in win32k.sys. This table is not exported. □ ServiceTable pointer of ETHREAD is not always have same value with KSDT.
www.CodeEngn.com
www.CodeEngn.com □ A system service dispatch is triggered when an INT 2E or SYSENTER instruction is called. □ Lower version than Windows 2000, Windows use INT 2E for service dispatch, Higher than Windows XP, Windows use SYSENTER for service dispatch. □ Normally, System call from UserLevel through ntdll.dll, but direct system call is possible. □ In Windows XP, we can use INT 2E instruction. □ System call number is contained in the EAX register.
www.CodeEngn.com What is the CR0 trick? □ The WP bit controls whether the processor will allow writes to memory pages marked as read-only. □ Setting WP(Write Protection) to zero disables memory protection.
www.CodeEngn.com What is the MDL? MDL (Memory Descriptor List): 1) Create the memory into our domain. - MmCreateMdl() 2) MDL build for NonPage - MmBuildMdlForNonPagedPool() 3) Change the flags of the MDL - MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA 4) Lock that page - MmMapLockedPages()
www.CodeEngn.com How to get index number? ZwWriteFile in Ntdll.dll : InvalidateRect in user32.dll :
www.CodeEngn.com Demonstration
www.CodeEngn.com IDT(Interrupt Descriptor Table) hooking Motivation □ IDT is used to handle interrupts, so there are many tasty things. □ IDT hooking is more powerful than SDT hooking.
www.CodeEngn.com Concept □ We can use sidt,lidt instruction for getting and saving IDT information.
www.CodeEngn.com □ Handler Address = MAKELONG(LowOffset,HiOffset); □ If DPL value of gate is 3, It can be called from both User and Kernel level. □ There are 3 types of gate. - Interrupt Gate (X 1 1 0) - Trap Gate (X 1 1 1) - Task Gate (0 1 0 1)
www.CodeEngn.com □ The SIDT instruction is used to find the IDT in memory, It returns the address of the IDTINFO structure. The LIDT instruction is used for saving information into IDT. □ The IDT specifies how to process interrupts such as those fired when a key pressed, when a page fault occurs. □ The Total number of IDT gates is 256.
www.CodeEngn.com Selector : #define KGDT_NULL 0 #define KGDT_R0_CODE 8 #define KGDT_R0_DATA 16 #define KGDT_R3_CODE 24 #define KGDT_R3_DATA 32 #define KGDT_TSS 40 #define KGDT_R0_PCR 48 #define KGDT_R3_TEB 56 #define KGDT_VDM_TILE 64 #define KGDT_LDT 72 #define KGDT_DF_TSS 80 #define KGDT_NMI_TSS 88
www.CodeEngn.com There are so many interrupts :
www.CodeEngn.com Demonstration
www.CodeEngn.com 0ne byte hooking Motivation □ I`m so lazy person to restore original codes of hooked function J □ Inline hooking is so static.
www.CodeEngn.com Concept □ Some functions in Windows XP later versions of the OS have MOV EDI, EDI instruction. □ MOV EDI,EDI doesn`t take the effect to code flow. □ MOV EDI,EDI (=0x8B,0xFF) -> INT 0xFF (=0xCD,0xFF) □ We can set handler at INT 0xFF manually.
www.CodeEngn.com 1. Get address of function. 2. Hook IDT (INT 0xFF) for all processors. 3. Make memory region of function to hook writeable. 4. Overwrite MOV EDI,EDI with 0xCD, the 'int' opcode making INT 0xFF. Process
www.CodeEngn.com Demonstration
www.CodeEngn.com Blind hooking by using DRx Motivation □ I want to hook function without memory or table patching. □ Are there no way to hook dinamically?
www.CodeEngn.com Concept □ We can use DR0 ~ DR3 for set addresses to hook. □ We can set handler at INT 0x01 (Debug Exception).
www.CodeEngn.com 1. Get address of function. 2. Hook IDT (INT 0x01) for all processors. 3. Set addresses at DR0 ~ DR3. 4. Set hook type(E/W/RW) at DR7. Process
www.CodeEngn.com typedef struct tagDebugReg7 { unsigned L0 :1; // unsigned G0 :1; // unsigned L1 :1; // unsigned G1 :1; // unsigned L2 :1; // unsigned G2 :1; // unsigned L3 :1; // unsigned G3 :1; // unsigned GL :1; // unsigned GE :1; // unsigned undefined1 :3; // 001 unsigned GD :1; // unsigned undefined2 :2; // 00 unsigned RW0 :2; unsigned LEN0 :2; unsigned RW1 :2; unsigned LEN1 :2; unsigned RW2 :2; unsigned LEN2 :2; unsigned RW3 :2; unsigned LEN3 :2; } DebugReg7; ADDRESS 1 DR0: ADDRESS 2 DR1: ADDRESS 3 DR2: ADDRESS 4 DR3:
www.CodeEngn.com Lx? Gx? GD? RWx? 00(execute), 01(write), 11(read & write). LENx? 00(byte), 01(word), 11(dword).
www.CodeEngn.com typedef struct DebugReg6 { unsigned B0 :1; unsigned B1 :1; unsigned B2 :1; unsigned B3 :1; unsigned undefined1 :9; unsigned BD :1; unsigned BS :1; unsigned BT :1; unsigned undefined2 :16; } DebugReg6; When Interrupt1 was occurred by DR0 ~ DR3. When Interrupt1 was occurred by Gd bit. When Interrupt1 was occurred by TF bit.
www.CodeEngn.com Demonstration
www.CodeEngn.com
www.CodeEngn.com 1) SDT Restore 2) SDT Relocation 3) KiFastCallEntry imitation 4) Bypassing Sysenter hook
www.CodeEngn.com SDT Restore Motivation □ I want to be free from SDT hooking! □ Is there no way to restore SDT?
www.CodeEngn.com Concept □ We can write to Kernel memory from User space by writing directly to devicephysicalmemory □ We can get original copy of the ServiceTable by loading ntoskrnl.exe into memory.
www.CodeEngn.com 1. Use NtOpenSection to get a handle devicePhysicalmemory with SECTION_MAP_READ | SECTION_MAP_WRITE access. 2. Load ntoskrnl.exe into memory. 3. Use NtMapViewOfSection to map in the physical memory page. 4. Get the address of ServiceTable from the page. 5. Use the address of ServiceTable to offset into the loaded ntoskrnl.exe 6. comparing the copy in the kernel memory with the copy in the loaded ntoskrnl.exe Process
www.CodeEngn.com Demonstration
www.CodeEngn.com SDT Relocation Motivation □ How about change SDT as new thing? □ Is there no way to make SDT hook localy?
www.CodeEngn.com Concept □ Windows doesn`t use KeServiceDescriptorTable for getting address of ServiceTable. Actually, Windows use ETHREAD->ServiceTable to get address of ServiceTable. □ When new thread is created, we can know this by using PsSetCreateThreadNotifyRoutine()
www.CodeEngn.com 1. Copy the SerivceTable from ntoskrnl.exe 2. Tracing threads of seleted process, and make NewSDT at each thread. 3. Regist PsSetCreateThreadNotifyRoutine() Process
www.CodeEngn.com Process A Thread 1 Thread 1 Thread 1 Thread 1 Ntoskrnl.exe KeServiceDescriptorTable Win32k.sys KeServiceDescriptorTableShadow Process B Thread 1 Thread 1 Thread 1 Thread 1
www.CodeEngn.com Process A Thread 1 Thread 1 Thread 1 Thread 1 Ntoskrnl.exe KeServiceDescriptorTable Win32k.sys KeServiceDescriptorTableShadow Process B Thread 1 Thread 1 Thread 1 Thread 1 MyDriver.sys New SDT 1 New SDT 1New SDT 1 New SDT 1 New SDT 1
www.CodeEngn.com □ When UserThread is maded, ETHREAD->ServiceTable of that UserThread doesn`t have KeServiceDescriptorTableShadow. What is the problem? Where does problem come from? □ This problem is caused by PsConvertToGuiThread() that called by KiFastCallEntry().
www.CodeEngn.com PsConvertToGuiThread():
www.CodeEngn.com Demonstration
www.CodeEngn.com KiFastCallEntry Imitation Motivation □ Is there no way to bypass SDT hooking by hooking? □ Is there no way to handle syscall by myself?
www.CodeEngn.com Concept □ The SYSENTER instruction passes control to the address specified in one of the Model-Specific Registers(MSRs). The Name of this register is IA32_SYSENTER_EIP, We can read and write to this register, By using RDMSR , WRMSR instruction.
www.CodeEngn.com 1. Copy the KeServiceDescriptorTable from ntoskrnl.exe, Copy the KeServiceDescriptorTableShadow from Win32k.sys 2. Change IA32_SYSENTER_EIP for all processors. 3. Hadling system call J Process
www.CodeEngn.com How we can do it?
www.CodeEngn.com What is the thing that I did?
www.CodeEngn.com Demonstration
www.CodeEngn.com Bypassing sysenter hook Motivation □ Is there no way to bypass sysenter hook? □ Is there more way to bypass SDT hook?
www.CodeEngn.com Concept □ In Windows XP, Defaultly, Windows use sysenter to handle system call, but using int 0x2e is possible. □ We can modify the code of KiFastSystemCall() in the ntdll.dll by using Win32 UserLevel API global hook.
www.CodeEngn.com 1. Hook IDT (INT 0x2E) for all processors. 2. Modify the code of KiFastSystemCall() 3. Hadling system call J Process
www.CodeEngn.com Before: After:
www.CodeEngn.com How we can do it?
www.CodeEngn.com
www.CodeEngn.com What is the thing that I did?
www.CodeEngn.com ? http://dualpage.muz.ro

More Related Content

PDF
Advanced Evasion Techniques by Win32/Gapz
byAlex Matrosov
 
PDF
How to Make Android's Bootable Recovery Work For You by Drew Suarez
byShakacon
 
PDF
44CON London - Attacking VxWorks: from Stone Age to Interstellar
by44CON
 
PDF
Advanced cfg bypass on adobe flash player 18 defcon russia 23
byDefconRussia
 
PPTX
Linux Timer device driver
by艾思程式教育
 
PPTX
Linux PCI device driver
by艾思程式教育
 
PDF
[2009 CodeEngn Conference 03] koheung - 윈도우 커널 악성코드에 대한 분석 및 방법
byCode Engn
 
PDF
Reconstructing Gapz: Position-Independent Code Analysis Problem
byAlex Matrosov
 
Advanced Evasion Techniques by Win32/Gapz
byAlex Matrosov
 
How to Make Android's Bootable Recovery Work For You by Drew Suarez
byShakacon
 
44CON London - Attacking VxWorks: from Stone Age to Interstellar
by44CON
 
Advanced cfg bypass on adobe flash player 18 defcon russia 23
byDefconRussia
 
Linux Timer device driver
by艾思程式教育
 
Linux PCI device driver
by艾思程式教育
 
[2009 CodeEngn Conference 03] koheung - 윈도우 커널 악성코드에 대한 분석 및 방법
byCode Engn
 
Reconstructing Gapz: Position-Independent Code Analysis Problem
byAlex Matrosov
 

What's hot

PDF
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
byCanSecWest
 
PPTX
Cisco IOS shellcode: All-in-one
byDefconRussia
 
PDF
Digging for Android Kernel Bugs
byJiahong Fang
 
PDF
Unix executable buffer overflow
byAmmarit Thongthua ,CISSP CISM GXPN CSSLP CCNP
 
PDF
Zn task - defcon russia 20
byDefconRussia
 
PDF
Codetainer: a Docker-based browser code 'sandbox'
byJen Andre
 
PDF
Metasploitable
bySri Manakula Vinayagar Engineering College
 
PDF
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...
by44CON
 
PDF
Hacking the swisscom modem
byCyber Security Alliance
 
PPTX
Applying Memory Forensics to Rootkit Detection
byIgor Korkin
 
PDF
Pledge in OpenBSD
byGiovanni Bechis
 
PDF
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
byCODE BLUE
 
ODP
Debugging linux
byAndrea Righi
 
PDF
iCloud keychain
byAlexey Troshichev
 
PPTX
Linux watchdog timer
byRajKumar Rampelli
 
PDF
Book
byluis_lmro
 
PPTX
Проведение криминалистической экспертизы и анализа руткит-программ на примере...
byAlex Matrosov
 
PDF
MyShell - English
byJohnnatan Messias
 
PPTX
Accelerating Incident Response To Production Outages
byTier1 app
 
PDF
The origin: Init (compact version)
byTzung-Bi Shih
 
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
byCanSecWest
 
Cisco IOS shellcode: All-in-one
byDefconRussia
 
Digging for Android Kernel Bugs
byJiahong Fang
 
Unix executable buffer overflow
byAmmarit Thongthua ,CISSP CISM GXPN CSSLP CCNP
 
Zn task - defcon russia 20
byDefconRussia
 
Codetainer: a Docker-based browser code 'sandbox'
byJen Andre
 
Metasploitable
bySri Manakula Vinayagar Engineering College
 
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...
by44CON
 
Hacking the swisscom modem
byCyber Security Alliance
 
Applying Memory Forensics to Rootkit Detection
byIgor Korkin
 
Pledge in OpenBSD
byGiovanni Bechis
 
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
byCODE BLUE
 
Debugging linux
byAndrea Righi
 
iCloud keychain
byAlexey Troshichev
 
Linux watchdog timer
byRajKumar Rampelli
 
Book
byluis_lmro
 
Проведение криминалистической экспертизы и анализа руткит-программ на примере...
byAlex Matrosov
 
MyShell - English
byJohnnatan Messias
 
Accelerating Incident Response To Production Outages
byTier1 app
 
The origin: Init (compact version)
byTzung-Bi Shih
 

Viewers also liked

PDF
Dynamic Linker
bySanjiv Malik
 
PDF
Rootkit 101
byhackstuff
 
PDF
Codeigniter : the security and the magic of hook
byAbdul Malik Ikhsan
 
PDF
Codeigniter : Custom Routing - Manipulate Uri
byAbdul Malik Ikhsan
 
PDF
Introduce to Linux command line
byWen Liao
 
KEY
Theme API
byrolfvandekrol
 
Dynamic Linker
bySanjiv Malik
 
Rootkit 101
byhackstuff
 
Codeigniter : the security and the magic of hook
byAbdul Malik Ikhsan
 
Codeigniter : Custom Routing - Manipulate Uri
byAbdul Malik Ikhsan
 
Introduce to Linux command line
byWen Liao
 
Theme API
byrolfvandekrol
 

Similar to [2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹

PDF
Hunting and Exploiting Bugs in Kernel Drivers - DefCamp 2012
byDefCamp
 
PDF
CNIT 126: 10: Kernel Debugging with WinDbg
bySam Bowne
 
PDF
CNIT 126: 10: Kernel Debugging with WinDbg
bySam Bowne
 
PDF
Captain Hook: Pirating AVs to Bypass Exploit Mitigations
byenSilo
 
PDF
Linux kernel-rootkit-dev - Wonokaerun
byidsecconf
 
PDF
Windows internals Essentials
byJohn Ombagi
 
PPT
Reverse engineering20151112
byBordeaux I
 
PDF
CNIT 126 12: Covert Malware Launching
bySam Bowne
 
PDF
Userland Hooking in Windows
byHigh-Tech Bridge SA (HTBridge)
 
PDF
Practical Malware Analysis Ch12
bySam Bowne
 
PPTX
Vxcon 2016
byKelvin Chan
 
PDF
Bh Usa 07 Butler And Kendall
byKarlFrank99
 
PPTX
Deep hooks
byYarden Shafir
 
PDF
Piratng Avs to bypass exploit mitigation
byPriyanka Aash
 
PPTX
Rootkit internales
byn|u - The Open Security Community
 
PDF
Rootkit on Linux X86 v2.6
byfisher.w.y
 
TXT
Exploit techniques - a quick review
byCe.Se.N.A. Security
 
PDF
Recon2013 alex ionescu-i got 99 problems but a kernel pointer ain't one
byArtem I. Baranov
 
PDF
Rootkit on linux_x86_v2.6
byscuhurricane
 
PDF
44CON London 2015 - Jtagsploitation: 5 wires, 5 ways to root
by44CON
 
Hunting and Exploiting Bugs in Kernel Drivers - DefCamp 2012
byDefCamp
 
CNIT 126: 10: Kernel Debugging with WinDbg
bySam Bowne
 
CNIT 126: 10: Kernel Debugging with WinDbg
bySam Bowne
 
Captain Hook: Pirating AVs to Bypass Exploit Mitigations
byenSilo
 
Linux kernel-rootkit-dev - Wonokaerun
byidsecconf
 
Windows internals Essentials
byJohn Ombagi
 
Reverse engineering20151112
byBordeaux I
 
CNIT 126 12: Covert Malware Launching
bySam Bowne
 
Userland Hooking in Windows
byHigh-Tech Bridge SA (HTBridge)
 
Practical Malware Analysis Ch12
bySam Bowne
 
Vxcon 2016
byKelvin Chan
 
Bh Usa 07 Butler And Kendall
byKarlFrank99
 
Deep hooks
byYarden Shafir
 
Piratng Avs to bypass exploit mitigation
byPriyanka Aash
 
Rootkit internales
byn|u - The Open Security Community
 
Rootkit on Linux X86 v2.6
byfisher.w.y
 
Exploit techniques - a quick review
byCe.Se.N.A. Security
 
Recon2013 alex ionescu-i got 99 problems but a kernel pointer ain't one
byArtem I. Baranov
 
Rootkit on linux_x86_v2.6
byscuhurricane
 
44CON London 2015 - Jtagsploitation: 5 wires, 5 ways to root
by44CON
 

More from Code Engn

PDF
[2014 CodeEngn Conference 11] 정든품바 - 웹성코드
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study EN
byCode Engn
 
PDF
[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis EN
byCode Engn
 
PDF
[2013 CodeEngn Conference 09] Park.Sam - 게임 해킹툴의 변칙적 공격 기법 분석
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 이경식 - 동적 추적 프레임워크를 이용한 OS X 바이너리 분석
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO
byCode Engn
 
PDF
[2014 CodeEngn Conference 10] 노용환 - 디버거 개발, 삽질기
byCode Engn
 
PDF
[2013 CodeEngn Conference 09] wh1ant - various tricks for linux remote exploits
byCode Engn
 
PDF
[2013 CodeEngn Conference 09] 제갈공맹 - MS 원데이 취약점 분석 방법론
byCode Engn
 
PDF
[2014 CodeEngn Conference 10] 심준보 - 급전이 필요합니다
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO
byCode Engn
 
PDF
[2013 CodeEngn Conference 09] x15kangx - MS Office 2010 문서 암호화 방식 분석 결과
byCode Engn
 
PDF
[2013 CodeEngn Conference 09] 김홍진 - 보안컨설팅 이해 및 BoB 보안컨설팅 인턴쉽
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 남대현 - iOS MobileSafari Fuzzer 제작 및 Fuzzing
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 박한범 - 가상화 기술과 보안
byCode Engn
 
PDF
[2013 CodeEngn Conference 09] BlueH4G - hooking and visualization
byCode Engn
 
PDF
[2013 CodeEngn Conference 09] proneer - Malware Tracker
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 김기홍 - 빅데이터 기반 악성코드 자동 분석 플랫폼
byCode Engn
 
[2014 CodeEngn Conference 11] 정든품바 - 웹성코드
byCode Engn
 
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study EN
byCode Engn
 
[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)
byCode Engn
 
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis EN
byCode Engn
 
[2013 CodeEngn Conference 09] Park.Sam - 게임 해킹툴의 변칙적 공격 기법 분석
byCode Engn
 
[2014 CodeEngn Conference 11] 이경식 - 동적 추적 프레임워크를 이용한 OS X 바이너리 분석
byCode Engn
 
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO
byCode Engn
 
[2014 CodeEngn Conference 10] 노용환 - 디버거 개발, 삽질기
byCode Engn
 
[2013 CodeEngn Conference 09] wh1ant - various tricks for linux remote exploits
byCode Engn
 
[2013 CodeEngn Conference 09] 제갈공맹 - MS 원데이 취약점 분석 방법론
byCode Engn
 
[2014 CodeEngn Conference 10] 심준보 - 급전이 필요합니다
byCode Engn
 
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO
byCode Engn
 
[2013 CodeEngn Conference 09] x15kangx - MS Office 2010 문서 암호화 방식 분석 결과
byCode Engn
 
[2013 CodeEngn Conference 09] 김홍진 - 보안컨설팅 이해 및 BoB 보안컨설팅 인턴쉽
byCode Engn
 
[2014 CodeEngn Conference 11] 남대현 - iOS MobileSafari Fuzzer 제작 및 Fuzzing
byCode Engn
 
[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?
byCode Engn
 
[2014 CodeEngn Conference 11] 박한범 - 가상화 기술과 보안
byCode Engn
 
[2013 CodeEngn Conference 09] BlueH4G - hooking and visualization
byCode Engn
 
[2013 CodeEngn Conference 09] proneer - Malware Tracker
byCode Engn
 
[2014 CodeEngn Conference 11] 김기홍 - 빅데이터 기반 악성코드 자동 분석 플랫폼
byCode Engn
 

Recently uploaded

PDF
UiPath Coded Agents - A Developer Driven Agentic Automation Era
byUiPathCommunity
 
PDF
Adding Copilot+ PCs with Snapdragon to your HP fleet won’t require IT deploym...
byPrincipled Technologies
 
PDF
January Patch Tuesday
byIvanti
 
PPTX
Webinar: EVerest for Production: Accelerating EV Charger Development w/ Indus...
byDanBrown980551
 
PDF
Mercury Computer Systems & The Cell Broadband Engine
bySlide_N
 
PDF
Top 10 Dedicated Server Providers in Stockholm (Updated Edition).pdf
byAtal Networks
 
PPTX
CodeMash 2026 - Optimizing Azure App Services
byBrian McKeiver
 
PDF
Best 10 Dedicated Servers in Amsterdam, Netherlands (2026 Enterprise Edition)...
byAtal Networks
 
PPTX
Apache Kafka 101 for Techies in IT dep.pptx
byamulyareddyk97
 
PDF
MINDCTI Revenue Release Quarter 3 2025 - Financial Presentation
byMIND CTI
 
PDF
Why Are Cloud Migration Services Essential for Modern Business Growth?
byGeoPITS Global Pvt Ltd
 
PDF
6 Insights from the Patron Saint of AI Failure
byScott M. Graffius
 
PDF
Computer Science Conferences 2026 | Research by SAI Conference
byHealth Conference 2026
 
PPTX
AI Meets DBA Transforming Database Administration with Intelligence
byGeoPITS Global Pvt Ltd
 
PDF
TopMate ES11 3-Wheel Electric Scooter: Comfortable, Stable Mobility for Every...
byTopmate
 
PPTX
Robot Vacuums are Cleaning Up. The global robot vacuum segment has high marke...
byRobert March
 
PDF
TopMate ES11 3-Wheel Electric Scooter: Comfort, Stability, and Independence f...
byTopmate
 
PPTX
Fortify Your Digital Defenses with ServiceNow Security Operations by Suma Soft
byGavin Ellis
 
PDF
Presentation of Cybersecurity and data protection
bytarikaityahya2
 
PPTX
Single Cell Protein from Methane or Methanol - Process development research c...
byJohn Downs
 
UiPath Coded Agents - A Developer Driven Agentic Automation Era
byUiPathCommunity
 
Adding Copilot+ PCs with Snapdragon to your HP fleet won’t require IT deploym...
byPrincipled Technologies
 
January Patch Tuesday
byIvanti
 
Webinar: EVerest for Production: Accelerating EV Charger Development w/ Indus...
byDanBrown980551
 
Mercury Computer Systems & The Cell Broadband Engine
bySlide_N
 
Top 10 Dedicated Server Providers in Stockholm (Updated Edition).pdf
byAtal Networks
 
CodeMash 2026 - Optimizing Azure App Services
byBrian McKeiver
 
Best 10 Dedicated Servers in Amsterdam, Netherlands (2026 Enterprise Edition)...
byAtal Networks
 
Apache Kafka 101 for Techies in IT dep.pptx
byamulyareddyk97
 
MINDCTI Revenue Release Quarter 3 2025 - Financial Presentation
byMIND CTI
 
Why Are Cloud Migration Services Essential for Modern Business Growth?
byGeoPITS Global Pvt Ltd
 
6 Insights from the Patron Saint of AI Failure
byScott M. Graffius
 
Computer Science Conferences 2026 | Research by SAI Conference
byHealth Conference 2026
 
AI Meets DBA Transforming Database Administration with Intelligence
byGeoPITS Global Pvt Ltd
 
TopMate ES11 3-Wheel Electric Scooter: Comfortable, Stable Mobility for Every...
byTopmate
 
Robot Vacuums are Cleaning Up. The global robot vacuum segment has high marke...
byRobert March
 
TopMate ES11 3-Wheel Electric Scooter: Comfort, Stability, and Independence f...
byTopmate
 
Fortify Your Digital Defenses with ServiceNow Security Operations by Suma Soft
byGavin Ellis
 
Presentation of Cybersecurity and data protection
bytarikaityahya2
 
Single Cell Protein from Methane or Methanol - Process development research c...
byJohn Downs
 

[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹

  • 1.
    www.CodeEngn.com July 21, 2007 Sammuelkoo dual5651@hotmail.com Null @ Root Hook the Planet
  • 2.
    www.CodeEngn.com 1) What isa kernel hook used for? 2) Get into the Ring0! 3) Review 4) Hook the planet! 5) Hook me, If you can! 6) ?
  • 3.
    www.CodeEngn.com 1) Kernel hooksare global (relatively speaking). 2) Rootkit / Protection / Detection software are both in Ring Zero. 3) By using kernel hook, We can study the behavior of the system. 4) By using kernel hook, we can get performance data for specific tasks and generating statics.
  • 4.
    www.CodeEngn.com How to makecode run on Ring0? - Call gate : CPL change 3 from to 0 - Software Interrupt : API Call, Exception, .. - Device Driver : It doesn`t mean Usermode driver but Kernelmode drvier, because Kernelmode driver run on Level0, however, Usermode driver run on Level3.
  • 5.
    www.CodeEngn.com □ Code ofexe file is located into Paged Memory, In contrast, Code of sys file is located into NonPaged Memory. □ Both exe file and sys file has PE(Portable Executable) file format. □ DPL of CS in sys file has value 0, however, DPL of CS in exe file has value 3. It means CS of sys file can access all of instructions and memorys, In contrast, CS of exe file has limited access right. Header of 1stDriver.sys : Header of cmd.exe :
  • 6.
    www.CodeEngn.com 1. Compile Ccode by DDK 2. Assemble Asm code by KmdKit
  • 7.
    www.CodeEngn.com You can linkDDK to Visual Studio. If you use Visual Studio.net as IDE, You can use this way. 1. Download ddkbuild.bat from http://www.hollistech.com/Resources/ddkbuild/ddkbuild.htm 2. Copied it at c:progra~microsoft visu~vc7bin 3. Edit ddkbuild.bat set WNETBASE= C:WinDDK (Directory that DDK installed) 4. Making Project 1. Select makefile project. 2. Build cmdline : ddkbuild -WNET checked . 3. output / arrangement cmd skip 4. Build cmdline : ddkbuild -WNET chekced . -cZ
  • 8.
    www.CodeEngn.com If you useVisual Studio 6.0 as IDE, You can use this way. 1) Download easysys from this url : http://sourceforge.net/projects/easysys/ 2) Easysys : It`s So easy!!
  • 9.
  • 10.
    www.CodeEngn.com 1. Using SCMAPI 2. Using Undocumented API Pro : By using this way, you can load a Driver into the kernel without having to create registry key. Con : 1) The problem with this approach is That the driver will be pageable. Sometimes when memory is paged out, it cannot be accessed; It will occur BSOD(Blue Screen Of Death) with system crash. 2) Once it is loaded, it cannot be Unloaded until reboot. 1) When a driver is loaded using the SCM, it is non-pageable. This means your callback functions, IRP-handling functions, and other Important code will not vanish from Memory. 2) You can select start mode of Driver. SERVICE_BOOT_START(0x0) : Driver will be loaded by system loader. SERVICE_SYSTEM_START(0x1) : Load Driver when IoInitSystem is called. SERVICE_AUTO_START(0x2) : Load by SCM SERVICE_DEMAND_START(0x3) : Load by calling StartService() API. SERVICE_DISABLED(0x4) : Makes driver can not be loaded.
  • 11.
    www.CodeEngn.com I/O Request Packets(IRP) Return Create UserMDL request(IRP) Address of UserMDL Communicate by UserMDL Create Named Event & Regist it Event Signal □ Communicate by IRP □ Communicate by IRP & UserMDL □ Communicate by IRP & Event Reset Event
  • 12.
  • 13.
    www.CodeEngn.com 1) KPCR (Kernel`sProcessor Control Region) 2) EPROCESS (Executable Process) 3) TEB (Thread Environment Block) 4) ETHREAD (Executable Thread)
  • 14.
  • 15.
    www.CodeEngn.com In Kernel Level,FS:0 = KPCR = 0xFFDFF000KPCR ( Kernel`s Processor Control Region )
  • 16.
  • 17.
    www.CodeEngn.com □ In WindowsKernel, Each process is represented as an EPROCESS into Kernel Memory. □ List of active processes is obtained by traversing a doubly linked list referenced in the EPROCESS Structure of each process. □ We can access EPROCESS by CurrentThread of KPRCB structure. □ The Windows scheduling algorithm is not executed at process.
  • 18.
  • 19.
    www.CodeEngn.com USER ADDRESS SPACE2G (0x00000000 ~ 0x7FFFFFFF) TEB(0x7FFDEOOO) TIB TEB(0x7FFDEOOO) TIB DLL DLL DLL DLL LDR_MODULE LDR_MODULE LDR_MODULE LDR_MODULE PEB_LDR_DATA Process Image Stack Heap 0x40000000 ~ 0x7FFFFFFF 0x00000000 ~ 0x3FFFFFFF
  • 20.
    www.CodeEngn.com TEB ( ThreadEnvironment Block ) In UserLevel, FS:0 = TEB = 0x7ffde000 (1st Process) □ UserMode Application can access this structure directly. □ GetCurrentProcessId() function use this structure for getting PID. □ We can get PEB address from this structure.
  • 21.
    www.CodeEngn.com PEB ( ProcessEnvironment Block ) □ UserMode Application can access this structure directly. □ This structure have loaded modules list. □ This structure have ProcessParameters information. □ IsDebuggerPresent() function use this structure.
  • 22.
  • 23.
    www.CodeEngn.com 1) Win32 UserLevelAPI Global Hooking 2) SSDT(System Service Distpach Table) hooking 3) IDT(Interrupt Descriptor Table) hooking 4) 0ne byte hooking 5) Blind hooking by using DRx
  • 24.
    www.CodeEngn.com Win32 UserLevel APIGlobal Hooking Motivation □ Is there no way to Dll Injection without read/write process memory, and CreateRemoteThread() API? □ Is there no way to hook Win32 API globaly?
  • 25.
    www.CodeEngn.com Concept □ In Windows,DLL memory and mapped memory are shared. □ If we can modify memory of DLL without PageFault(Copy-On-Write), It will be applied to all processes. □ If we have chance to execute our code by victim process self, We don`t need CreateRemoteThread() anymore. □ In Windows, There is a region that will get mapped into every process address space, The name of this area is KUSER_SHARED_DATA.
  • 26.
    www.CodeEngn.com 1. Get theEPROCESS of explorer.exe 2. Attach to explorer.exe 3. Get the PEB from EPROCESS 4. Find Kernel32.dll address from Ldr in PEB. 5. Find IsDebuggerPresent() address from IMAGE_EXPORT_DIRECTORY of kernel32.dll 6. Modify IsDebuggerPresent() code to jmp KUSER_SHARED_DATA+0x8 with CR0 trick. 7. Now just waiting for victim process call IsDebuggerPresent() Process
  • 27.
    www.CodeEngn.com MOV EAX,DWORD PTRFS:[18] MOV EAX,DWORD PTR DS:[EAX+30] MOVZX EAX,BYTE PTR DS:[EAX+2] Original IsDebuggerPresent() code: Modifed IsDebuggerPresent() code: MOV EAX , KUSER_SHARED_DATA+0x8 JMP EAX
  • 28.
    www.CodeEngn.com PAYLOAD: DLL loading code: pushad pushfd push KSD + 0x8 + sizeof(DLL load code) call [KUSER_SHARED_DATA] popfd popad jmp [KUSER_SHARED_DATA+0x4]
  • 29.
  • 30.
    www.CodeEngn.com SSDT(System Service DistpachTable) hooking Motivation □ Is there no way to hook Native API as easier as IAT hook? □ Is there no way to hook Native API globaly?
  • 31.
    www.CodeEngn.com Concept □ Native systemservices`s addresses are listed in SSDT. □ KeServiceDescriptorTable is exported by the ntoskrnl.exe □ Windows XP later versions of the OS make the SSDT read-only, but we can bypass this protection with CR0 trick or MDL. □ We can get index number of Native API that we want to hook from ntdll.dll
  • 32.
    www.CodeEngn.com 1. Build thefunction that has same prototype with Native API to hook. 2. Get the index number of Native API. 3. Get address of SSDT by referencing KeServiceDescriptorTable. 4. Make SSDT memory area writeable. 5. KeServiceDescriptorTable->ServiceTableBase[index] = HookFunction; Process
  • 33.
    www.CodeEngn.com □ The KeServiceDescriptorTableis a table exported by the kernel, This table contains the core system services implemented in ntoskrnl.exe. □ There is another table in Windows Kernel, called KeServiceDescriptorTableShadow, that contains the address of USER & GDI services implemented in win32k.sys. This table is not exported. □ ServiceTable pointer of ETHREAD is not always have same value with KSDT.
  • 34.
  • 35.
    www.CodeEngn.com □ A systemservice dispatch is triggered when an INT 2E or SYSENTER instruction is called. □ Lower version than Windows 2000, Windows use INT 2E for service dispatch, Higher than Windows XP, Windows use SYSENTER for service dispatch. □ Normally, System call from UserLevel through ntdll.dll, but direct system call is possible. □ In Windows XP, we can use INT 2E instruction. □ System call number is contained in the EAX register.
  • 36.
    www.CodeEngn.com What is theCR0 trick? □ The WP bit controls whether the processor will allow writes to memory pages marked as read-only. □ Setting WP(Write Protection) to zero disables memory protection.
  • 37.
    www.CodeEngn.com What is theMDL? MDL (Memory Descriptor List): 1) Create the memory into our domain. - MmCreateMdl() 2) MDL build for NonPage - MmBuildMdlForNonPagedPool() 3) Change the flags of the MDL - MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA 4) Lock that page - MmMapLockedPages()
  • 38.
    www.CodeEngn.com How to getindex number? ZwWriteFile in Ntdll.dll : InvalidateRect in user32.dll :
  • 39.
  • 40.
    www.CodeEngn.com IDT(Interrupt Descriptor Table)hooking Motivation □ IDT is used to handle interrupts, so there are many tasty things. □ IDT hooking is more powerful than SDT hooking.
  • 41.
    www.CodeEngn.com Concept □ We canuse sidt,lidt instruction for getting and saving IDT information.
  • 42.
    www.CodeEngn.com □ Handler Address= MAKELONG(LowOffset,HiOffset); □ If DPL value of gate is 3, It can be called from both User and Kernel level. □ There are 3 types of gate. - Interrupt Gate (X 1 1 0) - Trap Gate (X 1 1 1) - Task Gate (0 1 0 1)
  • 43.
    www.CodeEngn.com □ The SIDTinstruction is used to find the IDT in memory, It returns the address of the IDTINFO structure. The LIDT instruction is used for saving information into IDT. □ The IDT specifies how to process interrupts such as those fired when a key pressed, when a page fault occurs. □ The Total number of IDT gates is 256.
  • 44.
    www.CodeEngn.com Selector : #define KGDT_NULL0 #define KGDT_R0_CODE 8 #define KGDT_R0_DATA 16 #define KGDT_R3_CODE 24 #define KGDT_R3_DATA 32 #define KGDT_TSS 40 #define KGDT_R0_PCR 48 #define KGDT_R3_TEB 56 #define KGDT_VDM_TILE 64 #define KGDT_LDT 72 #define KGDT_DF_TSS 80 #define KGDT_NMI_TSS 88
  • 45.
  • 46.
  • 47.
    www.CodeEngn.com 0ne byte hookingMotivation □ I`m so lazy person to restore original codes of hooked function J □ Inline hooking is so static.
  • 48.
    www.CodeEngn.com Concept □ Some functionsin Windows XP later versions of the OS have MOV EDI, EDI instruction. □ MOV EDI,EDI doesn`t take the effect to code flow. □ MOV EDI,EDI (=0x8B,0xFF) -> INT 0xFF (=0xCD,0xFF) □ We can set handler at INT 0xFF manually.
  • 49.
    www.CodeEngn.com 1. Get addressof function. 2. Hook IDT (INT 0xFF) for all processors. 3. Make memory region of function to hook writeable. 4. Overwrite MOV EDI,EDI with 0xCD, the 'int' opcode making INT 0xFF. Process
  • 50.
  • 51.
    www.CodeEngn.com Blind hooking byusing DRx Motivation □ I want to hook function without memory or table patching. □ Are there no way to hook dinamically?
  • 52.
    www.CodeEngn.com Concept □ We canuse DR0 ~ DR3 for set addresses to hook. □ We can set handler at INT 0x01 (Debug Exception).
  • 53.
    www.CodeEngn.com 1. Get addressof function. 2. Hook IDT (INT 0x01) for all processors. 3. Set addresses at DR0 ~ DR3. 4. Set hook type(E/W/RW) at DR7. Process
  • 54.
    www.CodeEngn.com typedef struct tagDebugReg7 { unsignedL0 :1; // unsigned G0 :1; // unsigned L1 :1; // unsigned G1 :1; // unsigned L2 :1; // unsigned G2 :1; // unsigned L3 :1; // unsigned G3 :1; // unsigned GL :1; // unsigned GE :1; // unsigned undefined1 :3; // 001 unsigned GD :1; // unsigned undefined2 :2; // 00 unsigned RW0 :2; unsigned LEN0 :2; unsigned RW1 :2; unsigned LEN1 :2; unsigned RW2 :2; unsigned LEN2 :2; unsigned RW3 :2; unsigned LEN3 :2; } DebugReg7; ADDRESS 1 DR0: ADDRESS 2 DR1: ADDRESS 3 DR2: ADDRESS 4 DR3:
  • 55.
    www.CodeEngn.com Lx? Gx? GD? RWx? 00(execute), 01(write),11(read & write). LENx? 00(byte), 01(word), 11(dword).
  • 56.
    www.CodeEngn.com typedef struct DebugReg6 { unsigned B0:1; unsigned B1 :1; unsigned B2 :1; unsigned B3 :1; unsigned undefined1 :9; unsigned BD :1; unsigned BS :1; unsigned BT :1; unsigned undefined2 :16; } DebugReg6; When Interrupt1 was occurred by DR0 ~ DR3. When Interrupt1 was occurred by Gd bit. When Interrupt1 was occurred by TF bit.
  • 57.
  • 58.
  • 59.
    www.CodeEngn.com 1) SDT Restore 2)SDT Relocation 3) KiFastCallEntry imitation 4) Bypassing Sysenter hook
  • 60.
    www.CodeEngn.com SDT Restore Motivation □I want to be free from SDT hooking! □ Is there no way to restore SDT?
  • 61.
    www.CodeEngn.com Concept □ We canwrite to Kernel memory from User space by writing directly to devicephysicalmemory □ We can get original copy of the ServiceTable by loading ntoskrnl.exe into memory.
  • 62.
    www.CodeEngn.com 1. Use NtOpenSectionto get a handle devicePhysicalmemory with SECTION_MAP_READ | SECTION_MAP_WRITE access. 2. Load ntoskrnl.exe into memory. 3. Use NtMapViewOfSection to map in the physical memory page. 4. Get the address of ServiceTable from the page. 5. Use the address of ServiceTable to offset into the loaded ntoskrnl.exe 6. comparing the copy in the kernel memory with the copy in the loaded ntoskrnl.exe Process
  • 63.
  • 64.
    www.CodeEngn.com SDT Relocation Motivation □How about change SDT as new thing? □ Is there no way to make SDT hook localy?
  • 65.
    www.CodeEngn.com Concept □ Windows doesn`tuse KeServiceDescriptorTable for getting address of ServiceTable. Actually, Windows use ETHREAD->ServiceTable to get address of ServiceTable. □ When new thread is created, we can know this by using PsSetCreateThreadNotifyRoutine()
  • 66.
    www.CodeEngn.com 1. Copy theSerivceTable from ntoskrnl.exe 2. Tracing threads of seleted process, and make NewSDT at each thread. 3. Regist PsSetCreateThreadNotifyRoutine() Process
  • 67.
    www.CodeEngn.com Process A Thread 1 Thread1 Thread 1 Thread 1 Ntoskrnl.exe KeServiceDescriptorTable Win32k.sys KeServiceDescriptorTableShadow Process B Thread 1 Thread 1 Thread 1 Thread 1
  • 68.
    www.CodeEngn.com Process A Thread 1 Thread1 Thread 1 Thread 1 Ntoskrnl.exe KeServiceDescriptorTable Win32k.sys KeServiceDescriptorTableShadow Process B Thread 1 Thread 1 Thread 1 Thread 1 MyDriver.sys New SDT 1 New SDT 1New SDT 1 New SDT 1 New SDT 1
  • 69.
    www.CodeEngn.com □ When UserThreadis maded, ETHREAD->ServiceTable of that UserThread doesn`t have KeServiceDescriptorTableShadow. What is the problem? Where does problem come from? □ This problem is caused by PsConvertToGuiThread() that called by KiFastCallEntry().
  • 70.
  • 71.
  • 72.
    www.CodeEngn.com KiFastCallEntry Imitation Motivation □Is there no way to bypass SDT hooking by hooking? □ Is there no way to handle syscall by myself?
  • 73.
    www.CodeEngn.com Concept □ The SYSENTERinstruction passes control to the address specified in one of the Model-Specific Registers(MSRs). The Name of this register is IA32_SYSENTER_EIP, We can read and write to this register, By using RDMSR , WRMSR instruction.
  • 74.
    www.CodeEngn.com 1. Copy theKeServiceDescriptorTable from ntoskrnl.exe, Copy the KeServiceDescriptorTableShadow from Win32k.sys 2. Change IA32_SYSENTER_EIP for all processors. 3. Hadling system call J Process
  • 75.
  • 76.
  • 77.
  • 78.
    www.CodeEngn.com Bypassing sysenter hookMotivation □ Is there no way to bypass sysenter hook? □ Is there more way to bypass SDT hook?
  • 79.
    www.CodeEngn.com Concept □ In WindowsXP, Defaultly, Windows use sysenter to handle system call, but using int 0x2e is possible. □ We can modify the code of KiFastSystemCall() in the ntdll.dll by using Win32 UserLevel API global hook.
  • 80.
    www.CodeEngn.com 1. Hook IDT(INT 0x2E) for all processors. 2. Modify the code of KiFastSystemCall() 3. Hadling system call J Process
  • 81.
  • 82.
  • 83.
  • 84.
  • 85.