OpenRCE

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Store Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Sunday, December 14 2008 18:52.37 CST

Printer Friendly ...

Bypassing windows hook engines which if the LoaderLock is held not executes the

Author: Dreg

# Views: 3577

This project bypass windows hook engines which if the LoaderLock is held not executes the hook handler.

This project include the bypass of the easy-hook FILEMON.

This POC try creates with CreateFileW two files:
- no_bypass_hook.txt: which is logged by the FILEMON of the easy-hook
- bypass_hook.txt: which bypass the FILEMON of the easy-hook
-
- The bypass method is held the LoaderLock:
-. RtlEnterCriticalSection( NtCurrentTeb()->Peb->LoaderLock );
-. CreateFile( ByPassFile.txt );
-. RtlLeaveCriticalSection( NtCurrentTeb()->Peb->LoaderLock );
- This works, because TDB of easy-hook uses the Auxiliary Windows Library
before call the hook handler, if AuxUlibIsDLLSynchronizationHeld
return TRUE, easy-hook not execute hook handler
- Helding the LoaderLock AuxUlibIsDLLSynchronizationHeld returns always TRUE

The code to bypass the easy-hook FILEMON hook handler is very simple:



RtlEnterCriticalSection( NtCurrentTeb()->Peb->LoaderLock );

CreateFileW

(

	FILE_BYPASS_HOOK,

	0,

	0,

	NULL,

	OPEN_EXISTING,

	FILE_ATTRIBUTE_NORMAL,

	NULL

);

RtlLeaveCriticalSection( NtCurrentTeb()->Peb->LoaderLock );

Then the FILE_BYPASS_HOOK never showed in easy-hook FILEMON Log.

Test the code is very simple, only runs bypass_easyhook.exe which creates two files each two seconds:



0-

 CreateFileW(bypass_hook.txt) <- This CALL BYPASS easy-hook



 CreateFileW(no_bypass_hook.txt) <- This CALL NOT BYPASS easy-hook

...

Next, run the FILEMON with the PID of bypass_easyhook.exe.

(Run the filemon from the path of FILEMON):

C:\bypass_easyhook\Release>FileMon.exe 2628
...

Number of assemblies processed = 3
Number of assemblies installed = 3
Number of failures = 0

FileMon has been installed in target 2628.

[2628:2772]: "no_bypass_hook.txt"
[2628:2772]: "no_bypass_hook.txt"

Only logged no_bypass_hook.txt, and the FILEMON never logged the CreateFileW of bypass_hook.txt :-).

Bypass windows hook engines which if the LoaderLock is held not executes the hook handler, is very simple with this trick.

But you want code a serious malware or program, held the LoaderLock only in safe situations. It is very important to avoid deadlocks.

The project: http://www.fr33project.org/projects/bypass_easyhook.rar

Active in Last 5 Minutes
	timtoady

There are 21,677 total registered users.

Recently Created Topics
PyEmu error when cal...	Sep/02
Restore Themida/Winl...	Sep/02
Anti-olly technique	Aug/30
RAR Password	Aug/29
Heap protection on W...	Aug/23
Why Inline asm in C+...	Aug/20
Bypassing OllyAdvance	Aug/17
Error in logic for g...	Aug/17
Has anyone seen this...	Aug/17
ARM Executable - Pat...	Aug/16

Recent Forum Posts
reverse engineering ...	raiden56
pydbg, memory breakp...	Researc...
RAR Password	Ineedhelp
RAR Password	cod
Heap protection on W...	voila
Heap protection on W...	j00ru
Heap protection on W...	voila
Heap protection on W...	j00ru
Heap protection on W...	psylocn
Why Inline asm in C+...	ronnie2...

Recent Blog Entries
	meshmesh	Sep/01
Is it legal??
	waleedassar	Aug/30
Anti-olly technique
	QvasiModo	Aug/24
WinAppDbg 1.4 is out!
	artemblagodarenko	Aug/18
Dataflow-0.2.0 released. Ne...
	grzonu	Aug/17
Bypassing OllyAdvanced
More ...

Recent Blog Comments
	tosanjay on:	Sep/02
PyEmu 0.0.2
	GynvaelColdwind on:	Sep/01
Is it legal??
	PeterFerrie on:	Aug/31
Anti-olly technique
	dennis on:	Aug/26
Dr. Gadget IDAPython plugin
	halsten on:	Aug/19
Dataflow-0.2.0 released. Ne...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit