Kick the Heuristic Anti-virus out of the Rootkit

现在的位置: 首页 > 综合 > 正文

Kick the Heuristic Anti-virus out of the Rootkit

2013年06月10日 ⁄ 综合 ⁄ 共 7054字 ⁄ 字号小中大 ⁄ 评论关闭

Recently, Some friend complained to me that their rootkit driver had been killed by anti-virus software like McAfee and Nod32.So I began to find why.
I found that these "heuristic anti-virus" based on the export function mentioned in one of Jonna's article(BTW:Give my respect to Jonna).
First I take a look at McAfee, It has a strange heuristic strategy. if it found an export symbol "KeServiceDescriptorTable" ,while it didn`t found some normal driver function like "IoCreateDevice", It report the virus. So I think the first method is to find the KeServiceDescriptorTable dynamically.
With 90210's article "A more stable way to locate real KiServiceTable"(http://www.rootkit.com/newsread.php?newsid=176) and his help, I can find the KeServiceDescriptorTable's ServiceTableBase, it is enough.(Thank you 90210).
But I find NOD32 is more restrice, it will detect ZW* function and reported your driver as virus. So I must find a more common ways to locate export functions and symbols. Fortunately I found some pieces in from SVEN B. SCHREIBER. This book is cool!! The code is here:

代码

PVOID SpyMemoryCreate (DWORD dSize)
    { 
    return ExAllocatePoolWithTag (PagedPool, max (dSize, 1),
                                  SPY_TAG);
    }
 
// -----------------------------------------------------------------
PVOID SpyMemoryDestroy (PVOID pData)
    { 
    if (pData != NULL) ExFreePool (pData);
    return NULL;
    }
// ==============================================================
// MODULE INFO MANAGEMENT
// =================================================================
PMODULE_LIST SpyModuleList (PDWORD    pdData,
                            PNTSTATUS pns)
    { 
    DWORD        dSize;
    DWORD        dData = 0;
    NTSTATUS     ns    = STATUS_INVALID_PARAMETER;
    PMODULE_LIST pml   = NULL;
    for (dSize = PAGE_SIZE; (pml == NULL) && dSize; dSize <<= 1)
        { 
        if ((pml = SpyMemoryCreate (dSize)) == NULL)
            { 
            ns = STATUS_NO_MEMORY;
            break;
            }
        ns = ZwQuerySystemInformation (SystemModuleInformation,
                                       pml, dSize, &dData);
        if (ns != STATUS_SUCCESS)
            { 
            pml   = SpyMemoryDestroy (pml);
            dData = 0;
            if (ns != STATUS_INFO_LENGTH_MISMATCH) break;
            }
        }
    if (pdData != NULL) *pdData = dData;
    if (pns    != NULL) *pns    = ns;
    return pml;
    }
// -----------------------------------------------------------------
PMODULE_LIST SpyModuleFind (PBYTE     pbModule,
                            PDWORD    pdIndex,
                            PNTSTATUS pns)
    { 
    DWORD        i;
    DWORD        dIndex = -1;
    NTSTATUS     ns     = STATUS_INVALID_PARAMETER;
    PMODULE_LIST pml    = NULL;
    if ((pml = SpyModuleList (NULL, &ns)) != NULL)
        { 
        for (i = 0; i < pml->dModules; i++)
            { 
            if (!_stricmp (pml->aModules [i].abPath +
                           pml->aModules [i].wNameOffset,
                           pbModule))
                { 
                dIndex = i;
                break;
                }
            }
        if (dIndex == -1)
            { 
            pml = SpyMemoryDestroy (pml);
            ns  = STATUS_NO_SUCH_FILE;
            }
        }
    if (pdIndex != NULL) *pdIndex = dIndex;
    if (pns     != NULL) *pns     = ns;
    return pml;
    }
// -----------------------------------------------------------------
PVOID SpyModuleBase (PBYTE     pbModule,
                     PNTSTATUS pns)
    { 
    PMODULE_LIST pml;
    DWORD        dIndex;
    NTSTATUS     ns    = STATUS_INVALID_PARAMETER;
    PVOID        pBase = NULL;
    if ((pml = SpyModuleFind (pbModule, &dIndex, &ns)) != NULL)
        { 
        pBase = pml->aModules [dIndex].pBase;
        SpyMemoryDestroy (pml);
        }
    if (pns != NULL) *pns = ns;
    return pBase;
    }
// -----------------------------------------------------------------
PIMAGE_NT_HEADERS SpyModuleHeader (PBYTE     pbModule,
                                   PVOID    *ppBase,
                                   PNTSTATUS pns)
    { 
    PVOID             pBase = NULL;
    NTSTATUS          ns    = STATUS_INVALID_PARAMETER;
    PIMAGE_NT_HEADERS pinh  = NULL;
    if (((pBase = SpyModuleBase (pbModule, &ns)) != NULL) &&
        ((pinh  = RtlImageNtHeader (pBase))      == NULL))
        { 
        ns = STATUS_INVALID_IMAGE_FORMAT;
        }
    if (ppBase != NULL) *ppBase = pBase;
    if (pns    != NULL) *pns    = ns;
    return pinh;
    }
// -----------------------------------------------------------------
PIMAGE_EXPORT_DIRECTORY SpyModuleExport (PBYTE     pbModule,
                                         PVOID    *ppBase,
                                         PNTSTATUS pns)
    { 
    PIMAGE_NT_HEADERS       pinh;
    PIMAGE_DATA_DIRECTORY   pidd;
    PVOID                   pBase = NULL;
    NTSTATUS                ns    = STATUS_INVALID_PARAMETER;
    PIMAGE_EXPORT_DIRECTORY pied  = NULL;
    if ((pinh = SpyModuleHeader (pbModule, &pBase, &ns)) != NULL)
        { 
        pidd = pinh->OptionalHeader.DataDirectory
               + IMAGE_DIRECTORY_ENTRY_EXPORT;
        if (pidd->VirtualAddress &&
            (pidd->Size >= IMAGE_EXPORT_DIRECTORY_))
            { 
            pied = PTR_ADD (pBase, pidd->VirtualAddress);
            }
        else
            { 
            ns = STATUS_DATA_ERROR;
            }
        }
    if (ppBase != NULL) *ppBase = pBase;
    if (pns    != NULL) *pns    = ns;
    return pied;
    }
// -----------------------------------------------------------------
PVOID SpyModuleSymbol (PBYTE     pbModule,
                       PBYTE     pbName,
                       PVOID     *ppBase,
                       PNTSTATUS pns)
    { 
    PIMAGE_EXPORT_DIRECTORY pied;
    PDWORD                  pdNames, pdFunctions;
    WORD                    *pwOrdinals;
    DWORD                   i, j;
    PVOID                   pBase    = NULL;
    NTSTATUS                ns       = STATUS_INVALID_PARAMETER;
    PVOID                   pAddress = NULL;
    if ((pied = SpyModuleExport (pbModule, &pBase, &ns)) != NULL)
        { 
        pdNames     = PTR_ADD (pBase, pied->AddressOfNames);
        pdFunctions = PTR_ADD (pBase, pied->AddressOfFunctions);
        pwOrdinals  = PTR_ADD (pBase, pied->AddressOfNameOrdinals);
        for (i = 0; i < pied->NumberOfNames; i++)
            { 
            j = pwOrdinals [i];
            if (!strcmp (PTR_ADD (pBase, pdNames [i]), pbName))
                { 
                if (j < pied->NumberOfFunctions)
                    { 
                    pAddress = PTR_ADD (pBase, pdFunctions [j]);
                    }
                break;
                }
            }
        if (pAddress == NULL)
            { 
            ns = STATUS_PROCEDURE_NOT_FOUND;
            }
        }
    if (ppBase != NULL) *ppBase = pBase;
    if (pns    != NULL) *pns    = ns;
    return pAddress;
    }
// -----------------------------------------------------------------
PVOID SpyModuleSymbolEx (PBYTE     pbSymbol,
                         PVOID     *ppBase,
                         PNTSTATUS pns)
{ 
    DWORD    i;
    BYTE     abModule [MAXIMUM_FILENAME_LENGTH] = "ntoskrnl.exe";
    PBYTE    pbName   = pbSymbol;
    PVOID    pBase    = NULL;
    NTSTATUS ns       = STATUS_INVALID_PARAMETER;
    PVOID    pAddress = NULL;
    
    for (i = 0; pbSymbol [i] && (pbSymbol [i] != '!'); i++);
    
    if (pbSymbol [i++])
    { 
        if (i <= MAXIMUM_FILENAME_LENGTH)
        { 
            memcpy (abModule, pbSymbol, i);
            pbName = pbSymbol + i;
        }
        else
        { 
            pbName = NULL;
        }
    }
    if (pbName != NULL)
    { 
        pAddress = SpyModuleSymbol (abModule, pbName, &pBase, &ns);
    }
    if (ppBase != NULL) *ppBase = pBase;
    if (pns    != NULL) *pns    = ns;
    return pAddress;
}
 

So Now we can get symbol like this:

pKeServiceDescriptorTable = SpyModuleSymbolEx("KeServiceDescriptorTable", NULL, &ns);

【上篇】事务（进程 ID ）与另一个进程已被死锁在 lock 资源上
【下篇】Android 中的拿来主义(编译，反编译，AXMLPrinter2,smali,baksmali)!

作者: zhangyf1234

该日志由 zhangyf1234 于11年前发表在综合分类下，最后更新于 2013年06月10日.
转载请注明: Kick the Heuristic Anti-virus out of the Rootkit | 学步园 +复制链接

抱歉!评论已关闭.

学步园

Kick the Heuristic Anti-virus out of the Rootkit

作者: zhangyf1234

书签

最新文章New

本站推荐

返回首页