Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  Generic Methods Towards Detecting When Drivers Maps into Memory?

Topic created on: January 5, 2007 08:37 CST by frankboldewin .

hi all,

i'm currently working on a paper that describes some analysing techniques that can be useful e.g. when kernel level rootkits use crippling/crypting stuff like rustock.

the aim is to have the clean native, uncrippled and pe-repaired driver of rustock, so that it can be loaded into ida for the main malware analysis.

all the work is done so far, but i'm unsatisfied with some technique i use in the last stage of uncrippling, because it's not very generic.

ok, the trick i'm using works fine here on my windows xp sp2 box, but differs on other systems, even if it's easy to find the right breakpoint.

here's what i'm doing:

1. starting softice
2. setting up a breakpoint in ntoskrnl.exe at 0x805a0591

what's at this address you ask?

0f 8c xx xx xx xx jl somewhere
ff 75 90          push dword [ebp-70] <--- breakpoint is here
e8 xx xx xx xx    call RtlImageNtHeader

when a driver is mapped into memory now, softice will break at this address and ebp-70 has a pointer to the start of the driver image.

from here it's easy to find the oep of the driver.

ImageBase + EntryPoint (start of PE-Header (e_lfanew points to it at offset 3ch) + 28h)

so after setting a breakpoint:

bpx imagebase+entrypoint

and leaving the debugger, the next time softice pops up at the drivers start address.

yeah i know, normal drivers are easy to detect at startup, like using iocreatedevice or the bpload function of softice, but this all fails with rustock, so i use this approach.
patching the driver start with 0xcc (int 3) and setting "i3here on" in softice also fails, because the driver won't start then. :(

any other cool tricks are really appreciated.

cheers,
frank boldewiin

  anonymouse     January 5, 2007 09:12.28 CST
is it boot loading driver if yes you can force a break on its DriverEntry when you set up a break on an indirect call
inside IopInitializeBuiltinDrivers
1 e 80552879     0001 (0001) nt!IopInitializeBuiltinDriver+0x276


if it is loaded via Service_Demand_start you can break on an indirect call in  IopLoadDriver  

Breakpoint 0 hit
nt!IopLoadDriver+0x66f:


i dont know if you could force softice to break so early in the stage but with windbg and a vm you can for sure step through whole Driver Entry dump it before its Init Section
is discarded  have its peheader repaired to make it identical to image reloacte it and load it in ida for static disassembly

  autarky   January 5, 2007 09:45.07 CST
I knocked up a quick and nsaty tool a while ago to deal with packed/encrypted drivers - it loads a driver that takes the return address from the stack when its DriverEntry is called and inserts a detour into ntoskrnl just before that address. The detour jumps to a 0xcc byte, followed by the call to the DriverEntry (eg call [edi+2c]) which had been overwritten by the detour.

Following that, the tool loads up the target driver, which will cause the kernel to break just before calling the target's DriverEntry (I always have WinDbg attached for stuff like this). I've used it to do runtime unpacking of Rustock in the past, but haven't tried it with any of the recent versions as I no longer work in AV.

As for walking through the DriverEntry for a driver that's boot loaded, there is some information in the following thread (the process is pretty similar if its start type is set to automatic, except you would break on different APIs):

http://www.woodmann.com/forum/showthread.php?t=9201

  sa7ori     January 5, 2007 13:08.21 CST
yea...am I missing something? cant you break on MapViewOfFile or something, or even later at IopLoadDriver? all in userspace before it even gets loaded?

  frankboldewin     January 6, 2007 10:24.44 CST
hm, donno what i'm doing wrong, but i haven't found a function called ioploaddriver on my windows xp sp2 system. even a:

strings -s c:\winnt\* | grep -i ioploaddriver

hasn't found some string reference in a driver or dll. :(

someone can enlighten me, which library exports this function, so i can add it to the exports in winice.dat

thanx in advance,
frank

  anonymouse     January 6, 2007 12:01.20 CST
dont you have the pdb file of ntoskrnl.exe from

its an internal function inside nt!NtLoadDriver

a non exported function


C:\Program Files\Debugging Tools for Windows>kd -kl -c "x nt!IopLoa*;q"


lkd> kd: Reading initial command 'x nt!IopLoa*;q'
805a65cf nt!IopLoadDriver = <no type information>
8068cce4 nt!IopLoaderBlock = <no type information>
805a6c67 nt!IopLoadUnloadDriver = <no type information>
805be688 nt!IopLoadFileSystemDriver = <no type information>
805bbf6e nt!IopLoadDumpDriver = <no type information>
quit:

C:\Program Files\Debugging Tools for Windows>

  frankboldewin     January 6, 2007 12:42.19 CST
dude, big thanx for the hint! ;)

Note: Registration is required to post to the forums.

There are 31,310 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit