OpenRCE

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Sunday, June 4 2006 12:37.04 CDT

Printer Friendly ...

Work Work Work

Author: AlexIonescu

# Views: 1851

Sorry for the lack of updates lately, I've been swamped with paid work (can you guess? Rootkit Detection of course).

I seem to have found an API that no commercial rootkit currently in the wild hooks. With it, all the rootkit files can be scanned for and found, although the code to do this is extremly complicated (You basically have to re-implement FindFirst/NextFile on top of it). I'm guessing the fact it's so complex is one of the reason why no commercial rootkit currently hooks it: they probably don't know how to modify it.

Another nice thing is that once I have the filename, although most rootkits hook CreateFile or OpenFile so that you can't get a handle to the file, they don't hook NtDeleteFile which lets you delete it by name without a handle. They also don't hook NtSetInformationFile, which is another method to delete the file (and can also be done with MoveFileEx).

So it's quite trivial to rename the file, and then CreateFile on it. If you can't rename for some reason, then create a symbolic link. No commercial rootkit I've seen protects against this.

Another thing about commercial rootkits: not only do they cost large amounts of money and make false promises of "Government use", but they also are a danger to system stability. One of the ones I've tried didn't close handles properly, so after a couple of TinyKRNL compilations (DDK Build spawns ~500 compiler processes during the build), the system was out of handles. Other commercial rootkits completely dismiss SEH, so passing NULL to a Native API will now BSOD your system.

There are 31,314 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
hi!	Jul/01
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit