SlideShare une entreprise Scribd logo

[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹

•
•
GangSeok Lee
GangSeok Lee

This document contains information about various techniques for hooking functions in the Windows kernel, including kernel hooks, SSDT hooking, IDT hooking, one-byte hooking, and blind hooking using debug registers. It discusses the motivations, concepts, and demonstrations of each technique. The document also contains information on kernel structures like EPROCESS, ETHREAD, KPCR, TEB, and PEB. It provides code samples and explanations for techniques like modifying the SSDT, hooking interrupts, and using debug registers to dynamically hook functions without directly patching memory or tables.

Technologie
1  sur  85
Télécharger pour lire hors ligne
www.CodeEngn.com July 21, 2007 Sammuel koo dual5651@hotmail.com Null @ Root Hook the Planet
www.CodeEngn.com 1) What is a kernel hook used for? 2) Get into the Ring0! 3) Review 4) Hook the planet! 5) Hook me, If you can! 6) ?
www.CodeEngn.com 1) Kernel hooks are global (relatively speaking). 2) Rootkit / Protection / Detection software are both in Ring Zero. 3) By using kernel hook, We can study the behavior of the system. 4) By using kernel hook, we can get performance data for specific tasks and generating statics.
www.CodeEngn.com How to make code run on Ring0? - Call gate : CPL change 3 from to 0 - Software Interrupt : API Call, Exception, .. - Device Driver : It doesn`t mean Usermode driver but Kernelmode drvier, because Kernelmode driver run on Level0, however, Usermode driver run on Level3.
www.CodeEngn.com □ Code of exe file is located into Paged Memory, In contrast, Code of sys file is located into NonPaged Memory. □ Both exe file and sys file has PE(Portable Executable) file format. □ DPL of CS in sys file has value 0, however, DPL of CS in exe file has value 3. It means CS of sys file can access all of instructions and memorys, In contrast, CS of exe file has limited access right. Header of 1stDriver.sys : Header of cmd.exe :
www.CodeEngn.com 1. Compile C code by DDK 2. Assemble Asm code by KmdKit
www.CodeEngn.com You can link DDK to Visual Studio. If you use Visual Studio.net as IDE, You can use this way. 1. Download ddkbuild.bat from http://www.hollistech.com/Resources/ddkbuild/ddkbuild.htm 2. Copied it at c:progra~microsoft visu~vc7bin 3. Edit ddkbuild.bat set WNETBASE= C:WinDDK (Directory that DDK installed) 4. Making Project 1. Select makefile project. 2. Build cmdline : ddkbuild -WNET checked . 3. output / arrangement cmd skip 4. Build cmdline : ddkbuild -WNET chekced . -cZ
www.CodeEngn.com If you use Visual Studio 6.0 as IDE, You can use this way. 1) Download easysys from this url : http://sourceforge.net/projects/easysys/ 2) Easysys : It`s So easy!!
www.CodeEngn.com Simple Device Driver :
www.CodeEngn.com 1. Using SCM API 2. Using Undocumented API Pro : By using this way, you can load a Driver into the kernel without having to create registry key. Con : 1) The problem with this approach is That the driver will be pageable. Sometimes when memory is paged out, it cannot be accessed; It will occur BSOD(Blue Screen Of Death) with system crash. 2) Once it is loaded, it cannot be Unloaded until reboot. 1) When a driver is loaded using the SCM, it is non-pageable. This means your callback functions, IRP-handling functions, and other Important code will not vanish from Memory. 2) You can select start mode of Driver. SERVICE_BOOT_START(0x0) : Driver will be loaded by system loader. SERVICE_SYSTEM_START(0x1) : Load Driver when IoInitSystem is called. SERVICE_AUTO_START(0x2) : Load by SCM SERVICE_DEMAND_START(0x3) : Load by calling StartService() API. SERVICE_DISABLED(0x4) : Makes driver can not be loaded.
www.CodeEngn.com I/O Request Packets (IRP) Return Create UserMDL request(IRP) Address of UserMDL Communicate by UserMDL Create Named Event & Regist it Event Signal □ Communicate by IRP □ Communicate by IRP & UserMDL □ Communicate by IRP & Event Reset Event
www.CodeEngn.com
www.CodeEngn.com 1) KPCR (Kernel`s Processor Control Region) 2) EPROCESS (Executable Process) 3) TEB (Thread Environment Block) 4) ETHREAD (Executable Thread)
www.CodeEngn.com ETHREAD KTHREAD ETHREAD KTHREADKPROCESS (PCB) ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ETHREAD KTHREAD ThreadListHead Handle Table ObjectTable Vad Vad Vad VadRoot Vad SDT ServiceTable KERNEL ADDRESS SPACE 2G (0x80000000 ~ 0xFFFFFFFF) ActiveProcessLink EPROCESS of Another Process KPCR KPCRB
www.CodeEngn.com In Kernel Level, FS:0 = KPCR = 0xFFDFF000KPCR ( Kernel`s Processor Control Region )
www.CodeEngn.com
www.CodeEngn.com □ In Windows Kernel, Each process is represented as an EPROCESS into Kernel Memory. □ List of active processes is obtained by traversing a doubly linked list referenced in the EPROCESS Structure of each process. □ We can access EPROCESS by CurrentThread of KPRCB structure. □ The Windows scheduling algorithm is not executed at process.
www.CodeEngn.com ETHREAD: KTHREAD:
www.CodeEngn.com USER ADDRESS SPACE 2G (0x00000000 ~ 0x7FFFFFFF) TEB(0x7FFDEOOO) TIB TEB(0x7FFDEOOO) TIB DLL DLL DLL DLL LDR_MODULE LDR_MODULE LDR_MODULE LDR_MODULE PEB_LDR_DATA Process Image Stack Heap 0x40000000 ~ 0x7FFFFFFF 0x00000000 ~ 0x3FFFFFFF
www.CodeEngn.com TEB ( Thread Environment Block ) In UserLevel, FS:0 = TEB = 0x7ffde000 (1st Process) □ UserMode Application can access this structure directly. □ GetCurrentProcessId() function use this structure for getting PID. □ We can get PEB address from this structure.
www.CodeEngn.com PEB ( Process Environment Block ) □ UserMode Application can access this structure directly. □ This structure have loaded modules list. □ This structure have ProcessParameters information. □ IsDebuggerPresent() function use this structure.
www.CodeEngn.com
www.CodeEngn.com 1) Win32 UserLevel API Global Hooking 2) SSDT(System Service Distpach Table) hooking 3) IDT(Interrupt Descriptor Table) hooking 4) 0ne byte hooking 5) Blind hooking by using DRx
www.CodeEngn.com Win32 UserLevel API Global Hooking Motivation □ Is there no way to Dll Injection without read/write process memory, and CreateRemoteThread() API? □ Is there no way to hook Win32 API globaly?
www.CodeEngn.com Concept □ In Windows, DLL memory and mapped memory are shared. □ If we can modify memory of DLL without PageFault(Copy-On-Write), It will be applied to all processes. □ If we have chance to execute our code by victim process self, We don`t need CreateRemoteThread() anymore. □ In Windows, There is a region that will get mapped into every process address space, The name of this area is KUSER_SHARED_DATA.
www.CodeEngn.com 1. Get the EPROCESS of explorer.exe 2. Attach to explorer.exe 3. Get the PEB from EPROCESS 4. Find Kernel32.dll address from Ldr in PEB. 5. Find IsDebuggerPresent() address from IMAGE_EXPORT_DIRECTORY of kernel32.dll 6. Modify IsDebuggerPresent() code to jmp KUSER_SHARED_DATA+0x8 with CR0 trick. 7. Now just waiting for victim process call IsDebuggerPresent() Process
www.CodeEngn.com MOV EAX,DWORD PTR FS:[18] MOV EAX,DWORD PTR DS:[EAX+30] MOVZX EAX,BYTE PTR DS:[EAX+2] Original IsDebuggerPresent() code: Modifed IsDebuggerPresent() code: MOV EAX , KUSER_SHARED_DATA+0x8 JMP EAX
www.CodeEngn.com PAYLOAD: DLL loading code : pushad pushfd push KSD + 0x8 + sizeof(DLL load code) call [KUSER_SHARED_DATA] popfd popad jmp [KUSER_SHARED_DATA+0x4]
www.CodeEngn.com Demonstration
www.CodeEngn.com SSDT(System Service Distpach Table) hooking Motivation □ Is there no way to hook Native API as easier as IAT hook? □ Is there no way to hook Native API globaly?
www.CodeEngn.com Concept □ Native system services`s addresses are listed in SSDT. □ KeServiceDescriptorTable is exported by the ntoskrnl.exe □ Windows XP later versions of the OS make the SSDT read-only, but we can bypass this protection with CR0 trick or MDL. □ We can get index number of Native API that we want to hook from ntdll.dll
www.CodeEngn.com 1. Build the function that has same prototype with Native API to hook. 2. Get the index number of Native API. 3. Get address of SSDT by referencing KeServiceDescriptorTable. 4. Make SSDT memory area writeable. 5. KeServiceDescriptorTable->ServiceTableBase[index] = HookFunction; Process
www.CodeEngn.com □ The KeServiceDescriptorTable is a table exported by the kernel, This table contains the core system services implemented in ntoskrnl.exe. □ There is another table in Windows Kernel, called KeServiceDescriptorTableShadow, that contains the address of USER & GDI services implemented in win32k.sys. This table is not exported. □ ServiceTable pointer of ETHREAD is not always have same value with KSDT.
www.CodeEngn.com
www.CodeEngn.com □ A system service dispatch is triggered when an INT 2E or SYSENTER instruction is called. □ Lower version than Windows 2000, Windows use INT 2E for service dispatch, Higher than Windows XP, Windows use SYSENTER for service dispatch. □ Normally, System call from UserLevel through ntdll.dll, but direct system call is possible. □ In Windows XP, we can use INT 2E instruction. □ System call number is contained in the EAX register.
www.CodeEngn.com What is the CR0 trick? □ The WP bit controls whether the processor will allow writes to memory pages marked as read-only. □ Setting WP(Write Protection) to zero disables memory protection.
www.CodeEngn.com What is the MDL? MDL (Memory Descriptor List): 1) Create the memory into our domain. - MmCreateMdl() 2) MDL build for NonPage - MmBuildMdlForNonPagedPool() 3) Change the flags of the MDL - MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA 4) Lock that page - MmMapLockedPages()
www.CodeEngn.com How to get index number? ZwWriteFile in Ntdll.dll : InvalidateRect in user32.dll :
www.CodeEngn.com Demonstration
www.CodeEngn.com IDT(Interrupt Descriptor Table) hooking Motivation □ IDT is used to handle interrupts, so there are many tasty things. □ IDT hooking is more powerful than SDT hooking.
www.CodeEngn.com Concept □ We can use sidt,lidt instruction for getting and saving IDT information.
www.CodeEngn.com □ Handler Address = MAKELONG(LowOffset,HiOffset); □ If DPL value of gate is 3, It can be called from both User and Kernel level. □ There are 3 types of gate. - Interrupt Gate (X 1 1 0) - Trap Gate (X 1 1 1) - Task Gate (0 1 0 1)
www.CodeEngn.com □ The SIDT instruction is used to find the IDT in memory, It returns the address of the IDTINFO structure. The LIDT instruction is used for saving information into IDT. □ The IDT specifies how to process interrupts such as those fired when a key pressed, when a page fault occurs. □ The Total number of IDT gates is 256.
www.CodeEngn.com Selector : #define KGDT_NULL 0 #define KGDT_R0_CODE 8 #define KGDT_R0_DATA 16 #define KGDT_R3_CODE 24 #define KGDT_R3_DATA 32 #define KGDT_TSS 40 #define KGDT_R0_PCR 48 #define KGDT_R3_TEB 56 #define KGDT_VDM_TILE 64 #define KGDT_LDT 72 #define KGDT_DF_TSS 80 #define KGDT_NMI_TSS 88
www.CodeEngn.com There are so many interrupts :
www.CodeEngn.com Demonstration
www.CodeEngn.com 0ne byte hooking Motivation □ I`m so lazy person to restore original codes of hooked function J □ Inline hooking is so static.
www.CodeEngn.com Concept □ Some functions in Windows XP later versions of the OS have MOV EDI, EDI instruction. □ MOV EDI,EDI doesn`t take the effect to code flow. □ MOV EDI,EDI (=0x8B,0xFF) -> INT 0xFF (=0xCD,0xFF) □ We can set handler at INT 0xFF manually.
www.CodeEngn.com 1. Get address of function. 2. Hook IDT (INT 0xFF) for all processors. 3. Make memory region of function to hook writeable. 4. Overwrite MOV EDI,EDI with 0xCD, the 'int' opcode making INT 0xFF. Process
www.CodeEngn.com Demonstration
www.CodeEngn.com Blind hooking by using DRx Motivation □ I want to hook function without memory or table patching. □ Are there no way to hook dinamically?
www.CodeEngn.com Concept □ We can use DR0 ~ DR3 for set addresses to hook. □ We can set handler at INT 0x01 (Debug Exception).
www.CodeEngn.com 1. Get address of function. 2. Hook IDT (INT 0x01) for all processors. 3. Set addresses at DR0 ~ DR3. 4. Set hook type(E/W/RW) at DR7. Process
www.CodeEngn.com typedef struct tagDebugReg7 { unsigned L0 :1; // unsigned G0 :1; // unsigned L1 :1; // unsigned G1 :1; // unsigned L2 :1; // unsigned G2 :1; // unsigned L3 :1; // unsigned G3 :1; // unsigned GL :1; // unsigned GE :1; // unsigned undefined1 :3; // 001 unsigned GD :1; // unsigned undefined2 :2; // 00 unsigned RW0 :2; unsigned LEN0 :2; unsigned RW1 :2; unsigned LEN1 :2; unsigned RW2 :2; unsigned LEN2 :2; unsigned RW3 :2; unsigned LEN3 :2; } DebugReg7; ADDRESS 1 DR0: ADDRESS 2 DR1: ADDRESS 3 DR2: ADDRESS 4 DR3:
www.CodeEngn.com Lx? Gx? GD? RWx? 00(execute), 01(write), 11(read & write). LENx? 00(byte), 01(word), 11(dword).
www.CodeEngn.com typedef struct DebugReg6 { unsigned B0 :1; unsigned B1 :1; unsigned B2 :1; unsigned B3 :1; unsigned undefined1 :9; unsigned BD :1; unsigned BS :1; unsigned BT :1; unsigned undefined2 :16; } DebugReg6; When Interrupt1 was occurred by DR0 ~ DR3. When Interrupt1 was occurred by Gd bit. When Interrupt1 was occurred by TF bit.
www.CodeEngn.com Demonstration
www.CodeEngn.com
www.CodeEngn.com 1) SDT Restore 2) SDT Relocation 3) KiFastCallEntry imitation 4) Bypassing Sysenter hook
www.CodeEngn.com SDT Restore Motivation □ I want to be free from SDT hooking! □ Is there no way to restore SDT?
www.CodeEngn.com Concept □ We can write to Kernel memory from User space by writing directly to devicephysicalmemory □ We can get original copy of the ServiceTable by loading ntoskrnl.exe into memory.
www.CodeEngn.com 1. Use NtOpenSection to get a handle devicePhysicalmemory with SECTION_MAP_READ | SECTION_MAP_WRITE access. 2. Load ntoskrnl.exe into memory. 3. Use NtMapViewOfSection to map in the physical memory page. 4. Get the address of ServiceTable from the page. 5. Use the address of ServiceTable to offset into the loaded ntoskrnl.exe 6. comparing the copy in the kernel memory with the copy in the loaded ntoskrnl.exe Process
www.CodeEngn.com Demonstration
www.CodeEngn.com SDT Relocation Motivation □ How about change SDT as new thing? □ Is there no way to make SDT hook localy?
www.CodeEngn.com Concept □ Windows doesn`t use KeServiceDescriptorTable for getting address of ServiceTable. Actually, Windows use ETHREAD->ServiceTable to get address of ServiceTable. □ When new thread is created, we can know this by using PsSetCreateThreadNotifyRoutine()
www.CodeEngn.com 1. Copy the SerivceTable from ntoskrnl.exe 2. Tracing threads of seleted process, and make NewSDT at each thread. 3. Regist PsSetCreateThreadNotifyRoutine() Process
www.CodeEngn.com Process A Thread 1 Thread 1 Thread 1 Thread 1 Ntoskrnl.exe KeServiceDescriptorTable Win32k.sys KeServiceDescriptorTableShadow Process B Thread 1 Thread 1 Thread 1 Thread 1
www.CodeEngn.com Process A Thread 1 Thread 1 Thread 1 Thread 1 Ntoskrnl.exe KeServiceDescriptorTable Win32k.sys KeServiceDescriptorTableShadow Process B Thread 1 Thread 1 Thread 1 Thread 1 MyDriver.sys New SDT 1 New SDT 1New SDT 1 New SDT 1 New SDT 1
www.CodeEngn.com □ When UserThread is maded, ETHREAD->ServiceTable of that UserThread doesn`t have KeServiceDescriptorTableShadow. What is the problem? Where does problem come from? □ This problem is caused by PsConvertToGuiThread() that called by KiFastCallEntry().
www.CodeEngn.com PsConvertToGuiThread():
www.CodeEngn.com Demonstration
www.CodeEngn.com KiFastCallEntry Imitation Motivation □ Is there no way to bypass SDT hooking by hooking? □ Is there no way to handle syscall by myself?
www.CodeEngn.com Concept □ The SYSENTER instruction passes control to the address specified in one of the Model-Specific Registers(MSRs). The Name of this register is IA32_SYSENTER_EIP, We can read and write to this register, By using RDMSR , WRMSR instruction.
www.CodeEngn.com 1. Copy the KeServiceDescriptorTable from ntoskrnl.exe, Copy the KeServiceDescriptorTableShadow from Win32k.sys 2. Change IA32_SYSENTER_EIP for all processors. 3. Hadling system call J Process
www.CodeEngn.com How we can do it?
www.CodeEngn.com What is the thing that I did?
www.CodeEngn.com Demonstration
www.CodeEngn.com Bypassing sysenter hook Motivation □ Is there no way to bypass sysenter hook? □ Is there more way to bypass SDT hook?
www.CodeEngn.com Concept □ In Windows XP, Defaultly, Windows use sysenter to handle system call, but using int 0x2e is possible. □ We can modify the code of KiFastSystemCall() in the ntdll.dll by using Win32 UserLevel API global hook.
www.CodeEngn.com 1. Hook IDT (INT 0x2E) for all processors. 2. Modify the code of KiFastSystemCall() 3. Hadling system call J Process
www.CodeEngn.com Before: After:
www.CodeEngn.com How we can do it?
www.CodeEngn.com
www.CodeEngn.com What is the thing that I did?
www.CodeEngn.com ? http://dualpage.muz.ro

Recommandé

Reconstructing Gapz: Position-Independent Code Analysis Problem
Reconstructing Gapz: Position-Independent Code Analysis ProblemReconstructing Gapz: Position-Independent Code Analysis Problem
Reconstructing Gapz: Position-Independent Code Analysis ProblemAlex Matrosov
 
[2009 CodeEngn Conference 03] koheung - 윈도우 커널 악성코드에 대한 분석 및 방법
[2009 CodeEngn Conference 03] koheung - 윈도우 커널 악성코드에 대한 분석 및 방법[2009 CodeEngn Conference 03] koheung - 윈도우 커널 악성코드에 대한 분석 및 방법
[2009 CodeEngn Conference 03] koheung - 윈도우 커널 악성코드에 대한 분석 및 방법GangSeok Lee
 
Linux Timer device driver
Linux Timer device driverLinux Timer device driver
Linux Timer device driver艾鍗科技
 
Advanced Evasion Techniques by Win32/Gapz
Advanced Evasion Techniques by Win32/GapzAdvanced Evasion Techniques by Win32/Gapz
Advanced Evasion Techniques by Win32/GapzAlex Matrosov
 
44CON London - Attacking VxWorks: from Stone Age to Interstellar
44CON London - Attacking VxWorks: from Stone Age to Interstellar44CON London - Attacking VxWorks: from Stone Age to Interstellar
44CON London - Attacking VxWorks: from Stone Age to Interstellar44CON
 
Linux PCI device driver
Linux PCI device driverLinux PCI device driver
Linux PCI device driver艾鍗科技
 
Advanced cfg bypass on adobe flash player 18 defcon russia 23
Advanced cfg bypass on adobe flash player 18 defcon russia 23Advanced cfg bypass on adobe flash player 18 defcon russia 23
Advanced cfg bypass on adobe flash player 18 defcon russia 23DefconRussia
 
How to Make Android's Bootable Recovery Work For You by Drew Suarez
How to Make Android's Bootable Recovery Work For You by Drew SuarezHow to Make Android's Bootable Recovery Work For You by Drew Suarez
How to Make Android's Bootable Recovery Work For You by Drew SuarezShakacon
 

Recommandé

Reconstructing Gapz: Position-Independent Code Analysis Problem
Reconstructing Gapz: Position-Independent Code Analysis ProblemReconstructing Gapz: Position-Independent Code Analysis Problem
Reconstructing Gapz: Position-Independent Code Analysis ProblemAlex Matrosov
 
[2009 CodeEngn Conference 03] koheung - 윈도우 커널 악성코드에 대한 분석 및 방법
[2009 CodeEngn Conference 03] koheung - 윈도우 커널 악성코드에 대한 분석 및 방법[2009 CodeEngn Conference 03] koheung - 윈도우 커널 악성코드에 대한 분석 및 방법
[2009 CodeEngn Conference 03] koheung - 윈도우 커널 악성코드에 대한 분석 및 방법GangSeok Lee
 
Linux Timer device driver
Linux Timer device driverLinux Timer device driver
Linux Timer device driver艾鍗科技
 
Advanced Evasion Techniques by Win32/Gapz
Advanced Evasion Techniques by Win32/GapzAdvanced Evasion Techniques by Win32/Gapz
Advanced Evasion Techniques by Win32/GapzAlex Matrosov
 
44CON London - Attacking VxWorks: from Stone Age to Interstellar
44CON London - Attacking VxWorks: from Stone Age to Interstellar44CON London - Attacking VxWorks: from Stone Age to Interstellar
44CON London - Attacking VxWorks: from Stone Age to Interstellar44CON
 
Linux PCI device driver
Linux PCI device driverLinux PCI device driver
Linux PCI device driver艾鍗科技
 
Advanced cfg bypass on adobe flash player 18 defcon russia 23
Advanced cfg bypass on adobe flash player 18 defcon russia 23Advanced cfg bypass on adobe flash player 18 defcon russia 23
Advanced cfg bypass on adobe flash player 18 defcon russia 23DefconRussia
 
How to Make Android's Bootable Recovery Work For You by Drew Suarez
How to Make Android's Bootable Recovery Work For You by Drew SuarezHow to Make Android's Bootable Recovery Work For You by Drew Suarez
How to Make Android's Bootable Recovery Work For You by Drew SuarezShakacon
 
Cisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-oneCisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-oneDefconRussia
 
Zn task - defcon russia 20
Zn task - defcon russia 20Zn task - defcon russia 20
Zn task - defcon russia 20DefconRussia
 
iCloud keychain
iCloud keychainiCloud keychain
iCloud keychainAlexey Troshichev
 
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...44CON
 
Applying Memory Forensics to Rootkit Detection
Applying Memory Forensics to Rootkit DetectionApplying Memory Forensics to Rootkit Detection
Applying Memory Forensics to Rootkit DetectionIgor Korkin
 
MyShell - English
MyShell - EnglishMyShell - English
MyShell - EnglishJohnnatan Messias
 
Accelerating Incident Response To Production Outages
Accelerating Incident Response To Production OutagesAccelerating Incident Response To Production Outages
Accelerating Incident Response To Production OutagesTier1 app
 
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershellCSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershellCanSecWest
 
Metasploitable
MetasploitableMetasploitable
MetasploitableSri Manakula Vinayagar Engineering College
 
Codetainer: a Docker-based browser code 'sandbox'
Codetainer: a Docker-based browser code 'sandbox'Codetainer: a Docker-based browser code 'sandbox'
Codetainer: a Docker-based browser code 'sandbox'Jen Andre
 
Debugging linux
Debugging linuxDebugging linux
Debugging linuxAndrea Righi
 
Book
BookBook
Bookluis_lmro
 
Digging for Android Kernel Bugs
Digging for Android Kernel BugsDigging for Android Kernel Bugs
Digging for Android Kernel BugsJiahong Fang
 
The origin: Init (compact version)
The origin: Init (compact version)The origin: Init (compact version)
The origin: Init (compact version)Tzung-Bi Shih
 
Unix executable buffer overflow
Unix executable buffer overflowUnix executable buffer overflow
Unix executable buffer overflowAmmarit Thongthua ,CISSP CISM GXPN CSSLP CCNP
 
Проведение криминалистической экспертизы и анализа руткит-программ на примере...
Проведение криминалистической экспертизы и анализа руткит-программ на примере...Проведение криминалистической экспертизы и анализа руткит-программ на примере...
Проведение криминалистической экспертизы и анализа руткит-программ на примере...Alex Matrosov
 
Linux watchdog timer
Linux watchdog timerLinux watchdog timer
Linux watchdog timerRajKumar Rampelli
 
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...CODE BLUE
 
Pledge in OpenBSD
Pledge in OpenBSDPledge in OpenBSD
Pledge in OpenBSDGiovanni Bechis
 
Hacking the swisscom modem
Hacking the swisscom modemHacking the swisscom modem
Hacking the swisscom modemCyber Security Alliance
 
Theme API
Theme APITheme API
Theme APIrolfvandekrol
 
Codeigniter : Custom Routing - Manipulate Uri
Codeigniter : Custom Routing - Manipulate UriCodeigniter : Custom Routing - Manipulate Uri
Codeigniter : Custom Routing - Manipulate UriAbdul Malik Ikhsan
 

Contenu connexe

Tendances

Cisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-oneCisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-oneDefconRussia
 
Zn task - defcon russia 20
Zn task - defcon russia 20Zn task - defcon russia 20
Zn task - defcon russia 20DefconRussia
 
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...44CON
 
Applying Memory Forensics to Rootkit Detection
Applying Memory Forensics to Rootkit DetectionApplying Memory Forensics to Rootkit Detection
Applying Memory Forensics to Rootkit DetectionIgor Korkin
 
Accelerating Incident Response To Production Outages
Accelerating Incident Response To Production OutagesAccelerating Incident Response To Production Outages
Accelerating Incident Response To Production OutagesTier1 app
 
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershellCSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershellCanSecWest
 
Codetainer: a Docker-based browser code 'sandbox'
Codetainer: a Docker-based browser code 'sandbox'Codetainer: a Docker-based browser code 'sandbox'
Codetainer: a Docker-based browser code 'sandbox'Jen Andre
 
Digging for Android Kernel Bugs
Digging for Android Kernel BugsDigging for Android Kernel Bugs
Digging for Android Kernel BugsJiahong Fang
 
The origin: Init (compact version)
The origin: Init (compact version)The origin: Init (compact version)
The origin: Init (compact version)Tzung-Bi Shih
 
Проведение криминалистической экспертизы и анализа руткит-программ на примере...
Проведение криминалистической экспертизы и анализа руткит-программ на примере...Проведение криминалистической экспертизы и анализа руткит-программ на примере...
Проведение криминалистической экспертизы и анализа руткит-программ на примере...Alex Matrosov
 
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...CODE BLUE
 

Tendances (20)

Cisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-oneCisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-one
 
Zn task - defcon russia 20
Zn task - defcon russia 20Zn task - defcon russia 20
Zn task - defcon russia 20
 
iCloud keychain
iCloud keychainiCloud keychain
iCloud keychain
 
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...
44CON London 2015 - Reverse engineering and exploiting font rasterizers: the ...
 
Applying Memory Forensics to Rootkit Detection
Applying Memory Forensics to Rootkit DetectionApplying Memory Forensics to Rootkit Detection
Applying Memory Forensics to Rootkit Detection
 
MyShell - English
MyShell - EnglishMyShell - English
MyShell - English
 
Accelerating Incident Response To Production Outages
Accelerating Incident Response To Production OutagesAccelerating Incident Response To Production Outages
Accelerating Incident Response To Production Outages
 
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershellCSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
CSW2017 Amanda rousseau cansecwest2017_net_hijacking_powershell
 
Metasploitable
MetasploitableMetasploitable
Metasploitable
 
Codetainer: a Docker-based browser code 'sandbox'
Codetainer: a Docker-based browser code 'sandbox'Codetainer: a Docker-based browser code 'sandbox'
Codetainer: a Docker-based browser code 'sandbox'
 
Debugging linux
Debugging linuxDebugging linux
Debugging linux
 
Book
BookBook
Book
 
Digging for Android Kernel Bugs
Digging for Android Kernel BugsDigging for Android Kernel Bugs
Digging for Android Kernel Bugs
 
The origin: Init (compact version)
The origin: Init (compact version)The origin: Init (compact version)
The origin: Init (compact version)
 
Unix executable buffer overflow
Unix executable buffer overflowUnix executable buffer overflow
Unix executable buffer overflow
 
Проведение криминалистической экспертизы и анализа руткит-программ на примере...
Проведение криминалистической экспертизы и анализа руткит-программ на примере...Проведение криминалистической экспертизы и анализа руткит-программ на примере...
Проведение криминалистической экспертизы и анализа руткит-программ на примере...
 
Linux watchdog timer
Linux watchdog timerLinux watchdog timer
Linux watchdog timer
 
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
 
Pledge in OpenBSD
Pledge in OpenBSDPledge in OpenBSD
Pledge in OpenBSD
 
Hacking the swisscom modem
Hacking the swisscom modemHacking the swisscom modem
Hacking the swisscom modem
 

En vedette

Codeigniter : Custom Routing - Manipulate Uri
Codeigniter : Custom Routing - Manipulate UriCodeigniter : Custom Routing - Manipulate Uri
Codeigniter : Custom Routing - Manipulate UriAbdul Malik Ikhsan
 
Codeigniter : the security and the magic of hook
Codeigniter : the security and the magic of hookCodeigniter : the security and the magic of hook
Codeigniter : the security and the magic of hookAbdul Malik Ikhsan
 
Introduce to Linux command line
Introduce to Linux command lineIntroduce to Linux command line
Introduce to Linux command lineWen Liao
 

En vedette (6)

Theme API
Theme APITheme API
Theme API
 
Codeigniter : Custom Routing - Manipulate Uri
Codeigniter : Custom Routing - Manipulate UriCodeigniter : Custom Routing - Manipulate Uri
Codeigniter : Custom Routing - Manipulate Uri
 
Codeigniter : the security and the magic of hook
Codeigniter : the security and the magic of hookCodeigniter : the security and the magic of hook
Codeigniter : the security and the magic of hook
 
Introduce to Linux command line
Introduce to Linux command lineIntroduce to Linux command line
Introduce to Linux command line
 
Dynamic Linker
Dynamic LinkerDynamic Linker
Dynamic Linker
 
Rootkit 101
Rootkit 101Rootkit 101
Rootkit 101
 

Similaire à [2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹

Hunting and Exploiting Bugs in Kernel Drivers - DefCamp 2012
Hunting and Exploiting Bugs in Kernel Drivers - DefCamp 2012Hunting and Exploiting Bugs in Kernel Drivers - DefCamp 2012
Hunting and Exploiting Bugs in Kernel Drivers - DefCamp 2012DefCamp
 
Exploiting Llinux Environment
Exploiting Llinux EnvironmentExploiting Llinux Environment
Exploiting Llinux EnvironmentEnrico Scapin
 
Formbook - In-depth malware analysis (Botconf 2018)
Formbook - In-depth malware analysis (Botconf 2018)Formbook - In-depth malware analysis (Botconf 2018)
Formbook - In-depth malware analysis (Botconf 2018)Rémi Jullian
 
Skiron - Experiments in CPU Design in D
Skiron - Experiments in CPU Design in DSkiron - Experiments in CPU Design in D
Skiron - Experiments in CPU Design in DMithun Hunsur
 
Typhoon Managed Execution Toolkit
Typhoon Managed Execution ToolkitTyphoon Managed Execution Toolkit
Typhoon Managed Execution ToolkitDimitry Snezhkov
 
Buffer overflow – Smashing The Stack
Buffer overflow – Smashing The StackBuffer overflow – Smashing The Stack
Buffer overflow – Smashing The StackTomer Zait
 
Accelerated .NET Memory Dump Analysis training public slides
Accelerated .NET Memory Dump Analysis training public slidesAccelerated .NET Memory Dump Analysis training public slides
Accelerated .NET Memory Dump Analysis training public slidesDmitry Vostokov
 
How to drive a malware analyst crazy
How to drive a malware analyst crazyHow to drive a malware analyst crazy
How to drive a malware analyst crazyMichael Boman
 
44CON London 2015 - How to drive a malware analyst crazy
44CON London 2015 - How to drive a malware analyst crazy44CON London 2015 - How to drive a malware analyst crazy
44CON London 2015 - How to drive a malware analyst crazy44CON
 
Comp 129 final exam 100% correct answers
Comp 129 final exam 100% correct answersComp 129 final exam 100% correct answers
Comp 129 final exam 100% correct answersProfessorLance
 
Comp 129 final exam 100% correct answers
Comp 129 final exam 100% correct answersComp 129 final exam 100% correct answers
Comp 129 final exam 100% correct answersProfessorLance
 
用Raspberry Pi 學Linux I2C Driver
用Raspberry Pi 學Linux I2C Driver用Raspberry Pi 學Linux I2C Driver
用Raspberry Pi 學Linux I2C Driver艾鍗科技
 
Buffer Overflow - Smashing the Stack
Buffer Overflow - Smashing the StackBuffer Overflow - Smashing the Stack
Buffer Overflow - Smashing the StackironSource
 
Android crash debugging
Android crash debuggingAndroid crash debugging
Android crash debuggingAshish Agrawal
 
Windows内核技术介绍
Windows内核技术介绍Windows内核技术介绍
Windows内核技术介绍jeffz
 
Roll your own toy unix clone os
Roll your own toy unix clone osRoll your own toy unix clone os
Roll your own toy unix clone oseramax
 
Inter-process communication of Android
Inter-process communication of AndroidInter-process communication of Android
Inter-process communication of AndroidTetsuyuki Kobayashi
 
Joanna Rutkowska Subverting Vista Kernel
Joanna Rutkowska Subverting Vista KernelJoanna Rutkowska Subverting Vista Kernel
Joanna Rutkowska Subverting Vista Kernelguestf1a032
 

Similaire à [2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹 (20)

Hunting and Exploiting Bugs in Kernel Drivers - DefCamp 2012
Hunting and Exploiting Bugs in Kernel Drivers - DefCamp 2012Hunting and Exploiting Bugs in Kernel Drivers - DefCamp 2012
Hunting and Exploiting Bugs in Kernel Drivers - DefCamp 2012
 
Exploiting Llinux Environment
Exploiting Llinux EnvironmentExploiting Llinux Environment
Exploiting Llinux Environment
 
Formbook - In-depth malware analysis (Botconf 2018)
Formbook - In-depth malware analysis (Botconf 2018)Formbook - In-depth malware analysis (Botconf 2018)
Formbook - In-depth malware analysis (Botconf 2018)
 
Skiron - Experiments in CPU Design in D
Skiron - Experiments in CPU Design in DSkiron - Experiments in CPU Design in D
Skiron - Experiments in CPU Design in D
 
Typhoon Managed Execution Toolkit
Typhoon Managed Execution ToolkitTyphoon Managed Execution Toolkit
Typhoon Managed Execution Toolkit
 
Buffer overflow – Smashing The Stack
Buffer overflow – Smashing The StackBuffer overflow – Smashing The Stack
Buffer overflow – Smashing The Stack
 
Accelerated .NET Memory Dump Analysis training public slides
Accelerated .NET Memory Dump Analysis training public slidesAccelerated .NET Memory Dump Analysis training public slides
Accelerated .NET Memory Dump Analysis training public slides
 
How to drive a malware analyst crazy
How to drive a malware analyst crazyHow to drive a malware analyst crazy
How to drive a malware analyst crazy
 
44CON London 2015 - How to drive a malware analyst crazy
44CON London 2015 - How to drive a malware analyst crazy44CON London 2015 - How to drive a malware analyst crazy
44CON London 2015 - How to drive a malware analyst crazy
 
Comp 129 final exam 100% correct answers
Comp 129 final exam 100% correct answersComp 129 final exam 100% correct answers
Comp 129 final exam 100% correct answers
 
Vxcon 2016
Vxcon 2016Vxcon 2016
Vxcon 2016
 
Comp 129 final exam 100% correct answers
Comp 129 final exam 100% correct answersComp 129 final exam 100% correct answers
Comp 129 final exam 100% correct answers
 
用Raspberry Pi 學Linux I2C Driver
用Raspberry Pi 學Linux I2C Driver用Raspberry Pi 學Linux I2C Driver
用Raspberry Pi 學Linux I2C Driver
 
Buffer Overflow - Smashing the Stack
Buffer Overflow - Smashing the StackBuffer Overflow - Smashing the Stack
Buffer Overflow - Smashing the Stack
 
Android crash debugging
Android crash debuggingAndroid crash debugging
Android crash debugging
 
Windows内核技术介绍
Windows内核技术介绍Windows内核技术介绍
Windows内核技术介绍
 
Roll your own toy unix clone os
Roll your own toy unix clone osRoll your own toy unix clone os
Roll your own toy unix clone os
 
Genode Architecture
Genode ArchitectureGenode Architecture
Genode Architecture
 
Inter-process communication of Android
Inter-process communication of AndroidInter-process communication of Android
Inter-process communication of Android
 
Joanna Rutkowska Subverting Vista Kernel
Joanna Rutkowska Subverting Vista KernelJoanna Rutkowska Subverting Vista Kernel
Joanna Rutkowska Subverting Vista Kernel
 

Plus de GangSeok Lee

[2014 CodeEngn Conference 11] 박한범 - 가상화 기술과 보안
[2014 CodeEngn Conference 11] 박한범 - 가상화 기술과 보안[2014 CodeEngn Conference 11] 박한범 - 가상화 기술과 보안
[2014 CodeEngn Conference 11] 박한범 - 가상화 기술과 보안GangSeok Lee
 
[2014 CodeEngn Conference 11] 이경식 - 동적 추적 프레임워크를 이용한 OS X 바이너리 분석
[2014 CodeEngn Conference 11] 이경식 - 동적 추적 프레임워크를 이용한 OS X 바이너리 분석[2014 CodeEngn Conference 11] 이경식 - 동적 추적 프레임워크를 이용한 OS X 바이너리 분석
[2014 CodeEngn Conference 11] 이경식 - 동적 추적 프레임워크를 이용한 OS X 바이너리 분석GangSeok Lee
 
[2014 CodeEngn Conference 11] 남대현 - iOS MobileSafari Fuzzer 제작 및 Fuzzing
[2014 CodeEngn Conference 11] 남대현 - iOS MobileSafari Fuzzer 제작 및 Fuzzing[2014 CodeEngn Conference 11] 남대현 - iOS MobileSafari Fuzzer 제작 및 Fuzzing
[2014 CodeEngn Conference 11] 남대현 - iOS MobileSafari Fuzzer 제작 및 FuzzingGangSeok Lee
 
[2014 CodeEngn Conference 11] 김기홍 - 빅데이터 기반 악성코드 자동 분석 플랫폼
[2014 CodeEngn Conference 11] 김기홍 - 빅데이터 기반 악성코드 자동 분석 플랫폼[2014 CodeEngn Conference 11] 김기홍 - 빅데이터 기반 악성코드 자동 분석 플랫폼
[2014 CodeEngn Conference 11] 김기홍 - 빅데이터 기반 악성코드 자동 분석 플랫폼GangSeok Lee
 
[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?
[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?
[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?GangSeok Lee
 
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KOGangSeok Lee
 
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study EN
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study EN[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study EN
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study ENGangSeok Lee
 
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KOGangSeok Lee
 
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis EN
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis EN[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis EN
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis ENGangSeok Lee
 
[2014 CodeEngn Conference 11] 정든품바 - 웹성코드
[2014 CodeEngn Conference 11] 정든품바 - 웹성코드[2014 CodeEngn Conference 11] 정든품바 - 웹성코드
[2014 CodeEngn Conference 11] 정든품바 - 웹성코드GangSeok Lee
 
[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)
[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)
[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)GangSeok Lee
 
[2014 CodeEngn Conference 10] 노용환 - 디버거 개발, 삽질기
[2014 CodeEngn Conference 10] 노용환 - 디버거 개발, 삽질기[2014 CodeEngn Conference 10] 노용환 - 디버거 개발, 삽질기
[2014 CodeEngn Conference 10] 노용환 - 디버거 개발, 삽질기GangSeok Lee
 
[2014 CodeEngn Conference 10] 심준보 - 급전이 필요합니다
[2014 CodeEngn Conference 10] 심준보 - 급전이 필요합니다[2014 CodeEngn Conference 10] 심준보 - 급전이 필요합니다
[2014 CodeEngn Conference 10] 심준보 - 급전이 필요합니다GangSeok Lee
 
[2013 CodeEngn Conference 09] x15kangx - MS Office 2010 문서 암호화 방식 분석 결과
[2013 CodeEngn Conference 09] x15kangx - MS Office 2010 문서 암호화 방식 분석 결과[2013 CodeEngn Conference 09] x15kangx - MS Office 2010 문서 암호화 방식 분석 결과
[2013 CodeEngn Conference 09] x15kangx - MS Office 2010 문서 암호화 방식 분석 결과GangSeok Lee
 
[2013 CodeEngn Conference 09] proneer - Malware Tracker
[2013 CodeEngn Conference 09] proneer - Malware Tracker[2013 CodeEngn Conference 09] proneer - Malware Tracker
[2013 CodeEngn Conference 09] proneer - Malware TrackerGangSeok Lee
 
[2013 CodeEngn Conference 09] BlueH4G - hooking and visualization
[2013 CodeEngn Conference 09] BlueH4G - hooking and visualization[2013 CodeEngn Conference 09] BlueH4G - hooking and visualization
[2013 CodeEngn Conference 09] BlueH4G - hooking and visualizationGangSeok Lee
 
[2013 CodeEngn Conference 09] wh1ant - various tricks for linux remote exploits
[2013 CodeEngn Conference 09] wh1ant - various tricks for linux remote exploits[2013 CodeEngn Conference 09] wh1ant - various tricks for linux remote exploits
[2013 CodeEngn Conference 09] wh1ant - various tricks for linux remote exploitsGangSeok Lee
 
[2013 CodeEngn Conference 09] 제갈공맹 - MS 원데이 취약점 분석 방법론
[2013 CodeEngn Conference 09] 제갈공맹 - MS 원데이 취약점 분석 방법론[2013 CodeEngn Conference 09] 제갈공맹 - MS 원데이 취약점 분석 방법론
[2013 CodeEngn Conference 09] 제갈공맹 - MS 원데이 취약점 분석 방법론GangSeok Lee
 
[2013 CodeEngn Conference 09] Park.Sam - 게임 해킹툴의 변칙적 공격 기법 분석
[2013 CodeEngn Conference 09] Park.Sam - 게임 해킹툴의 변칙적 공격 기법 분석[2013 CodeEngn Conference 09] Park.Sam - 게임 해킹툴의 변칙적 공격 기법 분석
[2013 CodeEngn Conference 09] Park.Sam - 게임 해킹툴의 변칙적 공격 기법 분석GangSeok Lee
 
[2013 CodeEngn Conference 09] 김홍진 - 보안컨설팅 이해 및 BoB 보안컨설팅 인턴쉽
[2013 CodeEngn Conference 09] 김홍진 - 보안컨설팅 이해 및 BoB 보안컨설팅 인턴쉽[2013 CodeEngn Conference 09] 김홍진 - 보안컨설팅 이해 및 BoB 보안컨설팅 인턴쉽
[2013 CodeEngn Conference 09] 김홍진 - 보안컨설팅 이해 및 BoB 보안컨설팅 인턴쉽GangSeok Lee
 

Plus de GangSeok Lee (20)

[2014 CodeEngn Conference 11] 박한범 - 가상화 기술과 보안
[2014 CodeEngn Conference 11] 박한범 - 가상화 기술과 보안[2014 CodeEngn Conference 11] 박한범 - 가상화 기술과 보안
[2014 CodeEngn Conference 11] 박한범 - 가상화 기술과 보안
 
[2014 CodeEngn Conference 11] 이경식 - 동적 추적 프레임워크를 이용한 OS X 바이너리 분석
[2014 CodeEngn Conference 11] 이경식 - 동적 추적 프레임워크를 이용한 OS X 바이너리 분석[2014 CodeEngn Conference 11] 이경식 - 동적 추적 프레임워크를 이용한 OS X 바이너리 분석
[2014 CodeEngn Conference 11] 이경식 - 동적 추적 프레임워크를 이용한 OS X 바이너리 분석
 
[2014 CodeEngn Conference 11] 남대현 - iOS MobileSafari Fuzzer 제작 및 Fuzzing
[2014 CodeEngn Conference 11] 남대현 - iOS MobileSafari Fuzzer 제작 및 Fuzzing[2014 CodeEngn Conference 11] 남대현 - iOS MobileSafari Fuzzer 제작 및 Fuzzing
[2014 CodeEngn Conference 11] 남대현 - iOS MobileSafari Fuzzer 제작 및 Fuzzing
 
[2014 CodeEngn Conference 11] 김기홍 - 빅데이터 기반 악성코드 자동 분석 플랫폼
[2014 CodeEngn Conference 11] 김기홍 - 빅데이터 기반 악성코드 자동 분석 플랫폼[2014 CodeEngn Conference 11] 김기홍 - 빅데이터 기반 악성코드 자동 분석 플랫폼
[2014 CodeEngn Conference 11] 김기홍 - 빅데이터 기반 악성코드 자동 분석 플랫폼
 
[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?
[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?
[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?
 
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO
 
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study EN
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study EN[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study EN
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study EN
 
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO
 
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis EN
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis EN[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis EN
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis EN
 
[2014 CodeEngn Conference 11] 정든품바 - 웹성코드
[2014 CodeEngn Conference 11] 정든품바 - 웹성코드[2014 CodeEngn Conference 11] 정든품바 - 웹성코드
[2014 CodeEngn Conference 11] 정든품바 - 웹성코드
 
[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)
[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)
[2014 CodeEngn Conference 10] 정광운 - 안드로이드에서도 한번 후킹을 해볼까 (Hooking on Android)
 
[2014 CodeEngn Conference 10] 노용환 - 디버거 개발, 삽질기
[2014 CodeEngn Conference 10] 노용환 - 디버거 개발, 삽질기[2014 CodeEngn Conference 10] 노용환 - 디버거 개발, 삽질기
[2014 CodeEngn Conference 10] 노용환 - 디버거 개발, 삽질기
 
[2014 CodeEngn Conference 10] 심준보 - 급전이 필요합니다
[2014 CodeEngn Conference 10] 심준보 - 급전이 필요합니다[2014 CodeEngn Conference 10] 심준보 - 급전이 필요합니다
[2014 CodeEngn Conference 10] 심준보 - 급전이 필요합니다
 
[2013 CodeEngn Conference 09] x15kangx - MS Office 2010 문서 암호화 방식 분석 결과
[2013 CodeEngn Conference 09] x15kangx - MS Office 2010 문서 암호화 방식 분석 결과[2013 CodeEngn Conference 09] x15kangx - MS Office 2010 문서 암호화 방식 분석 결과
[2013 CodeEngn Conference 09] x15kangx - MS Office 2010 문서 암호화 방식 분석 결과
 
[2013 CodeEngn Conference 09] proneer - Malware Tracker
[2013 CodeEngn Conference 09] proneer - Malware Tracker[2013 CodeEngn Conference 09] proneer - Malware Tracker
[2013 CodeEngn Conference 09] proneer - Malware Tracker
 
[2013 CodeEngn Conference 09] BlueH4G - hooking and visualization
[2013 CodeEngn Conference 09] BlueH4G - hooking and visualization[2013 CodeEngn Conference 09] BlueH4G - hooking and visualization
[2013 CodeEngn Conference 09] BlueH4G - hooking and visualization
 
[2013 CodeEngn Conference 09] wh1ant - various tricks for linux remote exploits
[2013 CodeEngn Conference 09] wh1ant - various tricks for linux remote exploits[2013 CodeEngn Conference 09] wh1ant - various tricks for linux remote exploits
[2013 CodeEngn Conference 09] wh1ant - various tricks for linux remote exploits
 
[2013 CodeEngn Conference 09] 제갈공맹 - MS 원데이 취약점 분석 방법론
[2013 CodeEngn Conference 09] 제갈공맹 - MS 원데이 취약점 분석 방법론[2013 CodeEngn Conference 09] 제갈공맹 - MS 원데이 취약점 분석 방법론
[2013 CodeEngn Conference 09] 제갈공맹 - MS 원데이 취약점 분석 방법론
 
[2013 CodeEngn Conference 09] Park.Sam - 게임 해킹툴의 변칙적 공격 기법 분석
[2013 CodeEngn Conference 09] Park.Sam - 게임 해킹툴의 변칙적 공격 기법 분석[2013 CodeEngn Conference 09] Park.Sam - 게임 해킹툴의 변칙적 공격 기법 분석
[2013 CodeEngn Conference 09] Park.Sam - 게임 해킹툴의 변칙적 공격 기법 분석
 
[2013 CodeEngn Conference 09] 김홍진 - 보안컨설팅 이해 및 BoB 보안컨설팅 인턴쉽
[2013 CodeEngn Conference 09] 김홍진 - 보안컨설팅 이해 및 BoB 보안컨설팅 인턴쉽[2013 CodeEngn Conference 09] 김홍진 - 보안컨설팅 이해 및 BoB 보안컨설팅 인턴쉽
[2013 CodeEngn Conference 09] 김홍진 - 보안컨설팅 이해 및 BoB 보안컨설팅 인턴쉽
 

Dernier

Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Enterprise Knowledge
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilV3cube
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Scriptwesley chun
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUK Journal
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?Igalia
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationRadu Cotescu
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century educationjfdjdjcjdnsjd
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘RTylerCroy
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?Antenna Manufacturer Coco
 

Dernier (20)

Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 

[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹

  • 1. www.CodeEngn.com July 21, 2007 Sammuel koo dual5651@hotmail.com Null @ Root Hook the Planet
  • 2. www.CodeEngn.com 1) What is a kernel hook used for? 2) Get into the Ring0! 3) Review 4) Hook the planet! 5) Hook me, If you can! 6) ?
  • 3. www.CodeEngn.com 1) Kernel hooks are global (relatively speaking). 2) Rootkit / Protection / Detection software are both in Ring Zero. 3) By using kernel hook, We can study the behavior of the system. 4) By using kernel hook, we can get performance data for specific tasks and generating statics.
  • 4. www.CodeEngn.com How to make code run on Ring0? - Call gate : CPL change 3 from to 0 - Software Interrupt : API Call, Exception, .. - Device Driver : It doesn`t mean Usermode driver but Kernelmode drvier, because Kernelmode driver run on Level0, however, Usermode driver run on Level3.
  • 5. www.CodeEngn.com □ Code of exe file is located into Paged Memory, In contrast, Code of sys file is located into NonPaged Memory. □ Both exe file and sys file has PE(Portable Executable) file format. □ DPL of CS in sys file has value 0, however, DPL of CS in exe file has value 3. It means CS of sys file can access all of instructions and memorys, In contrast, CS of exe file has limited access right. Header of 1stDriver.sys : Header of cmd.exe :
  • 6. www.CodeEngn.com 1. Compile C code by DDK 2. Assemble Asm code by KmdKit
  • 7. www.CodeEngn.com You can link DDK to Visual Studio. If you use Visual Studio.net as IDE, You can use this way. 1. Download ddkbuild.bat from http://www.hollistech.com/Resources/ddkbuild/ddkbuild.htm 2. Copied it at c:progra~microsoft visu~vc7bin 3. Edit ddkbuild.bat set WNETBASE= C:WinDDK (Directory that DDK installed) 4. Making Project 1. Select makefile project. 2. Build cmdline : ddkbuild -WNET checked . 3. output / arrangement cmd skip 4. Build cmdline : ddkbuild -WNET chekced . -cZ
  • 8. www.CodeEngn.com If you use Visual Studio 6.0 as IDE, You can use this way. 1) Download easysys from this url : http://sourceforge.net/projects/easysys/ 2) Easysys : It`s So easy!!
  • 10. www.CodeEngn.com 1. Using SCM API 2. Using Undocumented API Pro : By using this way, you can load a Driver into the kernel without having to create registry key. Con : 1) The problem with this approach is That the driver will be pageable. Sometimes when memory is paged out, it cannot be accessed; It will occur BSOD(Blue Screen Of Death) with system crash. 2) Once it is loaded, it cannot be Unloaded until reboot. 1) When a driver is loaded using the SCM, it is non-pageable. This means your callback functions, IRP-handling functions, and other Important code will not vanish from Memory. 2) You can select start mode of Driver. SERVICE_BOOT_START(0x0) : Driver will be loaded by system loader. SERVICE_SYSTEM_START(0x1) : Load Driver when IoInitSystem is called. SERVICE_AUTO_START(0x2) : Load by SCM SERVICE_DEMAND_START(0x3) : Load by calling StartService() API. SERVICE_DISABLED(0x4) : Makes driver can not be loaded.
  • 11. www.CodeEngn.com I/O Request Packets (IRP) Return Create UserMDL request(IRP) Address of UserMDL Communicate by UserMDL Create Named Event & Regist it Event Signal □ Communicate by IRP □ Communicate by IRP & UserMDL □ Communicate by IRP & Event Reset Event
  • 13. www.CodeEngn.com 1) KPCR (Kernel`s Processor Control Region) 2) EPROCESS (Executable Process) 3) TEB (Thread Environment Block) 4) ETHREAD (Executable Thread)
  • 15. www.CodeEngn.com In Kernel Level, FS:0 = KPCR = 0xFFDFF000KPCR ( Kernel`s Processor Control Region )
  • 17. www.CodeEngn.com □ In Windows Kernel, Each process is represented as an EPROCESS into Kernel Memory. □ List of active processes is obtained by traversing a doubly linked list referenced in the EPROCESS Structure of each process. □ We can access EPROCESS by CurrentThread of KPRCB structure. □ The Windows scheduling algorithm is not executed at process.
  • 19. www.CodeEngn.com USER ADDRESS SPACE 2G (0x00000000 ~ 0x7FFFFFFF) TEB(0x7FFDEOOO) TIB TEB(0x7FFDEOOO) TIB DLL DLL DLL DLL LDR_MODULE LDR_MODULE LDR_MODULE LDR_MODULE PEB_LDR_DATA Process Image Stack Heap 0x40000000 ~ 0x7FFFFFFF 0x00000000 ~ 0x3FFFFFFF
  • 20. www.CodeEngn.com TEB ( Thread Environment Block ) In UserLevel, FS:0 = TEB = 0x7ffde000 (1st Process) □ UserMode Application can access this structure directly. □ GetCurrentProcessId() function use this structure for getting PID. □ We can get PEB address from this structure.
  • 21. www.CodeEngn.com PEB ( Process Environment Block ) □ UserMode Application can access this structure directly. □ This structure have loaded modules list. □ This structure have ProcessParameters information. □ IsDebuggerPresent() function use this structure.
  • 23. www.CodeEngn.com 1) Win32 UserLevel API Global Hooking 2) SSDT(System Service Distpach Table) hooking 3) IDT(Interrupt Descriptor Table) hooking 4) 0ne byte hooking 5) Blind hooking by using DRx
  • 24. www.CodeEngn.com Win32 UserLevel API Global Hooking Motivation □ Is there no way to Dll Injection without read/write process memory, and CreateRemoteThread() API? □ Is there no way to hook Win32 API globaly?
  • 25. www.CodeEngn.com Concept □ In Windows, DLL memory and mapped memory are shared. □ If we can modify memory of DLL without PageFault(Copy-On-Write), It will be applied to all processes. □ If we have chance to execute our code by victim process self, We don`t need CreateRemoteThread() anymore. □ In Windows, There is a region that will get mapped into every process address space, The name of this area is KUSER_SHARED_DATA.
  • 26. www.CodeEngn.com 1. Get the EPROCESS of explorer.exe 2. Attach to explorer.exe 3. Get the PEB from EPROCESS 4. Find Kernel32.dll address from Ldr in PEB. 5. Find IsDebuggerPresent() address from IMAGE_EXPORT_DIRECTORY of kernel32.dll 6. Modify IsDebuggerPresent() code to jmp KUSER_SHARED_DATA+0x8 with CR0 trick. 7. Now just waiting for victim process call IsDebuggerPresent() Process
  • 27. www.CodeEngn.com MOV EAX,DWORD PTR FS:[18] MOV EAX,DWORD PTR DS:[EAX+30] MOVZX EAX,BYTE PTR DS:[EAX+2] Original IsDebuggerPresent() code: Modifed IsDebuggerPresent() code: MOV EAX , KUSER_SHARED_DATA+0x8 JMP EAX
  • 28. www.CodeEngn.com PAYLOAD: DLL loading code : pushad pushfd push KSD + 0x8 + sizeof(DLL load code) call [KUSER_SHARED_DATA] popfd popad jmp [KUSER_SHARED_DATA+0x4]
  • 30. www.CodeEngn.com SSDT(System Service Distpach Table) hooking Motivation □ Is there no way to hook Native API as easier as IAT hook? □ Is there no way to hook Native API globaly?
  • 31. www.CodeEngn.com Concept □ Native system services`s addresses are listed in SSDT. □ KeServiceDescriptorTable is exported by the ntoskrnl.exe □ Windows XP later versions of the OS make the SSDT read-only, but we can bypass this protection with CR0 trick or MDL. □ We can get index number of Native API that we want to hook from ntdll.dll
  • 32. www.CodeEngn.com 1. Build the function that has same prototype with Native API to hook. 2. Get the index number of Native API. 3. Get address of SSDT by referencing KeServiceDescriptorTable. 4. Make SSDT memory area writeable. 5. KeServiceDescriptorTable->ServiceTableBase[index] = HookFunction; Process
  • 33. www.CodeEngn.com □ The KeServiceDescriptorTable is a table exported by the kernel, This table contains the core system services implemented in ntoskrnl.exe. □ There is another table in Windows Kernel, called KeServiceDescriptorTableShadow, that contains the address of USER & GDI services implemented in win32k.sys. This table is not exported. □ ServiceTable pointer of ETHREAD is not always have same value with KSDT.
  • 35. www.CodeEngn.com □ A system service dispatch is triggered when an INT 2E or SYSENTER instruction is called. □ Lower version than Windows 2000, Windows use INT 2E for service dispatch, Higher than Windows XP, Windows use SYSENTER for service dispatch. □ Normally, System call from UserLevel through ntdll.dll, but direct system call is possible. □ In Windows XP, we can use INT 2E instruction. □ System call number is contained in the EAX register.
  • 36. www.CodeEngn.com What is the CR0 trick? □ The WP bit controls whether the processor will allow writes to memory pages marked as read-only. □ Setting WP(Write Protection) to zero disables memory protection.
  • 37. www.CodeEngn.com What is the MDL? MDL (Memory Descriptor List): 1) Create the memory into our domain. - MmCreateMdl() 2) MDL build for NonPage - MmBuildMdlForNonPagedPool() 3) Change the flags of the MDL - MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA 4) Lock that page - MmMapLockedPages()
  • 38. www.CodeEngn.com How to get index number? ZwWriteFile in Ntdll.dll : InvalidateRect in user32.dll :
  • 40. www.CodeEngn.com IDT(Interrupt Descriptor Table) hooking Motivation □ IDT is used to handle interrupts, so there are many tasty things. □ IDT hooking is more powerful than SDT hooking.
  • 41. www.CodeEngn.com Concept □ We can use sidt,lidt instruction for getting and saving IDT information.
  • 42. www.CodeEngn.com □ Handler Address = MAKELONG(LowOffset,HiOffset); □ If DPL value of gate is 3, It can be called from both User and Kernel level. □ There are 3 types of gate. - Interrupt Gate (X 1 1 0) - Trap Gate (X 1 1 1) - Task Gate (0 1 0 1)
  • 43. www.CodeEngn.com □ The SIDT instruction is used to find the IDT in memory, It returns the address of the IDTINFO structure. The LIDT instruction is used for saving information into IDT. □ The IDT specifies how to process interrupts such as those fired when a key pressed, when a page fault occurs. □ The Total number of IDT gates is 256.
  • 44. www.CodeEngn.com Selector : #define KGDT_NULL 0 #define KGDT_R0_CODE 8 #define KGDT_R0_DATA 16 #define KGDT_R3_CODE 24 #define KGDT_R3_DATA 32 #define KGDT_TSS 40 #define KGDT_R0_PCR 48 #define KGDT_R3_TEB 56 #define KGDT_VDM_TILE 64 #define KGDT_LDT 72 #define KGDT_DF_TSS 80 #define KGDT_NMI_TSS 88
  • 45. www.CodeEngn.com There are so many interrupts :
  • 47. www.CodeEngn.com 0ne byte hooking Motivation □ I`m so lazy person to restore original codes of hooked function J □ Inline hooking is so static.
  • 48. www.CodeEngn.com Concept □ Some functions in Windows XP later versions of the OS have MOV EDI, EDI instruction. □ MOV EDI,EDI doesn`t take the effect to code flow. □ MOV EDI,EDI (=0x8B,0xFF) -> INT 0xFF (=0xCD,0xFF) □ We can set handler at INT 0xFF manually.
  • 49. www.CodeEngn.com 1. Get address of function. 2. Hook IDT (INT 0xFF) for all processors. 3. Make memory region of function to hook writeable. 4. Overwrite MOV EDI,EDI with 0xCD, the 'int' opcode making INT 0xFF. Process
  • 51. www.CodeEngn.com Blind hooking by using DRx Motivation □ I want to hook function without memory or table patching. □ Are there no way to hook dinamically?
  • 52. www.CodeEngn.com Concept □ We can use DR0 ~ DR3 for set addresses to hook. □ We can set handler at INT 0x01 (Debug Exception).
  • 53. www.CodeEngn.com 1. Get address of function. 2. Hook IDT (INT 0x01) for all processors. 3. Set addresses at DR0 ~ DR3. 4. Set hook type(E/W/RW) at DR7. Process
  • 54. www.CodeEngn.com typedef struct tagDebugReg7 { unsigned L0 :1; // unsigned G0 :1; // unsigned L1 :1; // unsigned G1 :1; // unsigned L2 :1; // unsigned G2 :1; // unsigned L3 :1; // unsigned G3 :1; // unsigned GL :1; // unsigned GE :1; // unsigned undefined1 :3; // 001 unsigned GD :1; // unsigned undefined2 :2; // 00 unsigned RW0 :2; unsigned LEN0 :2; unsigned RW1 :2; unsigned LEN1 :2; unsigned RW2 :2; unsigned LEN2 :2; unsigned RW3 :2; unsigned LEN3 :2; } DebugReg7; ADDRESS 1 DR0: ADDRESS 2 DR1: ADDRESS 3 DR2: ADDRESS 4 DR3:
  • 55. www.CodeEngn.com Lx? Gx? GD? RWx? 00(execute), 01(write), 11(read & write). LENx? 00(byte), 01(word), 11(dword).
  • 56. www.CodeEngn.com typedef struct DebugReg6 { unsigned B0 :1; unsigned B1 :1; unsigned B2 :1; unsigned B3 :1; unsigned undefined1 :9; unsigned BD :1; unsigned BS :1; unsigned BT :1; unsigned undefined2 :16; } DebugReg6; When Interrupt1 was occurred by DR0 ~ DR3. When Interrupt1 was occurred by Gd bit. When Interrupt1 was occurred by TF bit.
  • 59. www.CodeEngn.com 1) SDT Restore 2) SDT Relocation 3) KiFastCallEntry imitation 4) Bypassing Sysenter hook
  • 60. www.CodeEngn.com SDT Restore Motivation □ I want to be free from SDT hooking! □ Is there no way to restore SDT?
  • 61. www.CodeEngn.com Concept □ We can write to Kernel memory from User space by writing directly to devicephysicalmemory □ We can get original copy of the ServiceTable by loading ntoskrnl.exe into memory.
  • 62. www.CodeEngn.com 1. Use NtOpenSection to get a handle devicePhysicalmemory with SECTION_MAP_READ | SECTION_MAP_WRITE access. 2. Load ntoskrnl.exe into memory. 3. Use NtMapViewOfSection to map in the physical memory page. 4. Get the address of ServiceTable from the page. 5. Use the address of ServiceTable to offset into the loaded ntoskrnl.exe 6. comparing the copy in the kernel memory with the copy in the loaded ntoskrnl.exe Process
  • 64. www.CodeEngn.com SDT Relocation Motivation □ How about change SDT as new thing? □ Is there no way to make SDT hook localy?
  • 65. www.CodeEngn.com Concept □ Windows doesn`t use KeServiceDescriptorTable for getting address of ServiceTable. Actually, Windows use ETHREAD->ServiceTable to get address of ServiceTable. □ When new thread is created, we can know this by using PsSetCreateThreadNotifyRoutine()
  • 66. www.CodeEngn.com 1. Copy the SerivceTable from ntoskrnl.exe 2. Tracing threads of seleted process, and make NewSDT at each thread. 3. Regist PsSetCreateThreadNotifyRoutine() Process
  • 67. www.CodeEngn.com Process A Thread 1 Thread 1 Thread 1 Thread 1 Ntoskrnl.exe KeServiceDescriptorTable Win32k.sys KeServiceDescriptorTableShadow Process B Thread 1 Thread 1 Thread 1 Thread 1
  • 68. www.CodeEngn.com Process A Thread 1 Thread 1 Thread 1 Thread 1 Ntoskrnl.exe KeServiceDescriptorTable Win32k.sys KeServiceDescriptorTableShadow Process B Thread 1 Thread 1 Thread 1 Thread 1 MyDriver.sys New SDT 1 New SDT 1New SDT 1 New SDT 1 New SDT 1
  • 69. www.CodeEngn.com □ When UserThread is maded, ETHREAD->ServiceTable of that UserThread doesn`t have KeServiceDescriptorTableShadow. What is the problem? Where does problem come from? □ This problem is caused by PsConvertToGuiThread() that called by KiFastCallEntry().
  • 72. www.CodeEngn.com KiFastCallEntry Imitation Motivation □ Is there no way to bypass SDT hooking by hooking? □ Is there no way to handle syscall by myself?
  • 73. www.CodeEngn.com Concept □ The SYSENTER instruction passes control to the address specified in one of the Model-Specific Registers(MSRs). The Name of this register is IA32_SYSENTER_EIP, We can read and write to this register, By using RDMSR , WRMSR instruction.
  • 74. www.CodeEngn.com 1. Copy the KeServiceDescriptorTable from ntoskrnl.exe, Copy the KeServiceDescriptorTableShadow from Win32k.sys 2. Change IA32_SYSENTER_EIP for all processors. 3. Hadling system call J Process
  • 76. www.CodeEngn.com What is the thing that I did?
  • 78. www.CodeEngn.com Bypassing sysenter hook Motivation □ Is there no way to bypass sysenter hook? □ Is there more way to bypass SDT hook?
  • 79. www.CodeEngn.com Concept □ In Windows XP, Defaultly, Windows use sysenter to handle system call, but using int 0x2e is possible. □ We can modify the code of KiFastSystemCall() in the ntdll.dll by using Win32 UserLevel API global hook.
  • 80. www.CodeEngn.com 1. Hook IDT (INT 0x2E) for all processors. 2. Modify the code of KiFastSystemCall() 3. Hadling system call J Process
  • 84. www.CodeEngn.com What is the thing that I did?