Windows 内核驱动:A more stable way to locate real KiServiceTable

转载 2008年09月28日 11:10:00
By: 90210

Tan Chew Keong in his Win2K/XP SDT Restore 0.1 uses a simple way to find changed SDT entries - he just compares SDT from memory with SDT from ntoskrnl.exe file, assuming that KeServiceDescriptorTable.Base is not changed. If it is, Tan's code that locates KiServiceTable on disk will fail when KeServiceDescriptorTable.Base points somewhere outside the ntoskrnl.

I've found a way how to locate original KiServiceTable in the ntoskrnl file even if KeServiceDescriptorTable.Base has been changed. Method works both in the user mode and in the kmode.



This may be useful to bypass SDT-patching hooks, and not only to restore old SDT. For example, KAV uses SDT relocation ;)

KeServiceDescriptorTable is initialized by KiInitSystem():


    KeServiceDescriptorTable[0].Base = &KiServiceTable[0];
    KeServiceDescriptorTable[0].Count = NULL;
    KeServiceDescriptorTable[0].Limit = KiServiceLimit;
    KeServiceDescriptorTable[0].Number = &KiArgumentTable[0];
    for (Index = 1; Index < NUMBER_SERVICE_TABLES; Index += 1) {
        KeServiceDescriptorTable[Index].Limit = 0;
    }


Thus, we can find KiServiceTable by examining all xrefs to KeServiceDescriptorTable in the kernel. We will search for


C7 05 ..8 bytes..   mov     ds:_KeServiceDescriptorTable.Base, offset _KiServiceTable


from which we will get _KiServiceTable rva.

It's easy to find KeServiceDescriptorTable xrefs by scanning the code, but this is dangerous and time-consuming. It's better to use ntoskrnl's relocation information - it is always present in all nt systems.
This "mov [mem32], imm32" instruction will have 2 relocs pointing in it, and the second is the one we're searching for. So, the usermode code will do these steps:

1. Load ntosknrl as a dll.
2. Locate KeServiceDescriptorTable - it is exported.
3. Enumerate all relocations to find xrefs to the KeServiceDescriptorTable.
4. Check these opcodes to be a "mov [mem32],imm32".
5. Get KiServiceTable - it's offset is +6 from the opcode beginning.

The example code dumps KiServiceTable data from file and does no comparings with the existing sdt.

So, it's a must to a SDT-patching rootkit to hook file system and show "patched" version of ntoskrnl to all readers. And of course, services hooks code must reside in the ntoskrnl region and have no codepaths outside it. Otherwise it may be tracked in seconds.


#include <windows.h>
#include <winnt.h>
#include <stdio.h>

#define RVATOVA(base,offset) ((PVOID)((DWORD)(base)+(DWORD)(offset)))
#define ibaseDD *(PDWORD)&ibase
#define STATUS_INFO_LENGTH_MISMATCH      ((NTSTATUS)0xC0000004L)
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

typedef struct {
    WORD    offset:12;
    WORD    type:4;
} IMAGE_FIXUP_ENTRY, *PIMAGE_FIXUP_ENTRY;


typedef LONG NTSTATUS;

#ifdef __cplusplus
extern "C" {
#endif

NTSTATUS
WINAPI
NtQuerySystemInformation(    
    DWORD    SystemInformationClass,
    PVOID    SystemInformation,
    ULONG    SystemInformationLength,
    PULONG    ReturnLength
    );

#ifdef __cplusplus
}
#endif

typedef struct _SYSTEM_MODULE_INFORMATION {//Information Class 11
    ULONG    Reserved[2];
    PVOID    Base;
    ULONG    Size;
    ULONG    Flags;
    USHORT    Index;
    USHORT    Unknown;
    USHORT    LoadCount;
    USHORT    ModuleNameOffset;
    CHAR    ImageName[256];
}SYSTEM_MODULE_INFORMATION,*PSYSTEM_MODULE_INFORMATION;

typedef struct {
    DWORD    dwNumberOfModules;
    SYSTEM_MODULE_INFORMATION    smi;
} MODULES, *PMODULES;

#define    SystemModuleInformation    11

DWORD GetHeaders(PCHAR ibase,
                PIMAGE_FILE_HEADER *pfh,
                PIMAGE_OPTIONAL_HEADER *poh,
                PIMAGE_SECTION_HEADER *psh)

{
    PIMAGE_DOS_HEADER mzhead=(PIMAGE_DOS_HEADER)ibase;
    
    if    ((mzhead->e_magic!=IMAGE_DOS_SIGNATURE) ||        
        (ibaseDD[mzhead->e_lfanew]!=IMAGE_NT_SIGNATURE))
        return FALSE;
    
    *pfh=(PIMAGE_FILE_HEADER)&ibase[mzhead->e_lfanew];
    if (((PIMAGE_NT_HEADERS)*pfh)->Signature!=IMAGE_NT_SIGNATURE)
        return FALSE;
    *pfh=(PIMAGE_FILE_HEADER)((PBYTE)*pfh+sizeof(IMAGE_NT_SIGNATURE));
    
    *poh=(PIMAGE_OPTIONAL_HEADER)((PBYTE)*pfh+sizeof(IMAGE_FILE_HEADER));
    if ((*poh)->Magic!=IMAGE_NT_OPTIONAL_HDR32_MAGIC)
        return FALSE;
    
    *psh=(PIMAGE_SECTION_HEADER)((PBYTE)*poh+sizeof(IMAGE_OPTIONAL_HEADER));
    return TRUE;
}


DWORD FindKiServiceTable(HMODULE hModule,DWORD dwKSDT)
{
    PIMAGE_FILE_HEADER    pfh;
    PIMAGE_OPTIONAL_HEADER    poh;
    PIMAGE_SECTION_HEADER    psh;
    PIMAGE_BASE_RELOCATION    pbr;
    PIMAGE_FIXUP_ENTRY    pfe;    
    
    DWORD    dwFixups=0,i,dwPointerRva,dwPointsToRva,dwKiServiceTable;
    BOOL    bFirstChunk;

    GetHeaders((PBYTE)hModule,&pfh,&poh,&psh);

    // loop thru relocs to speed up the search
    if ((poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress) &&
        (!((pfh->Characteristics)&IMAGE_FILE_RELOCS_STRIPPED))) {
        
        pbr=(PIMAGE_BASE_RELOCATION)RVATOVA(poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress,hModule);

        bFirstChunk=TRUE;
        // 1st IMAGE_BASE_RELOCATION.VirtualAddress of ntoskrnl is 0
        while (bFirstChunk || pbr->VirtualAddress) {
            bFirstChunk=FALSE;

            pfe=(PIMAGE_FIXUP_ENTRY)((DWORD)pbr+sizeof(IMAGE_BASE_RELOCATION));

            for (i=0;i<(pbr->SizeOfBlock-sizeof(IMAGE_BASE_RELOCATION))>>1;i++,pfe++) {
                if (pfe->type==IMAGE_REL_BASED_HIGHLOW) {
                    dwFixups++;
                    dwPointerRva=pbr->VirtualAddress+pfe->offset;
                    // DONT_RESOLVE_DLL_REFERENCES flag means relocs aren't fixed
                    dwPointsToRva=*(PDWORD)((DWORD)hModule+dwPointerRva)-(DWORD)poh->ImageBase;

                    // does this reloc point to KeServiceDescriptorTable.Base?
                    if (dwPointsToRva==dwKSDT) {
                        // check for mov [mem32],imm32. we are trying to find
                        // "mov ds:_KeServiceDescriptorTable.Base, offset _KiServiceTable"
                        // from the KiInitSystem.
                        if (*(PWORD)((DWORD)hModule+dwPointerRva-2)==0x05c7) {
                            // should check for a reloc presence on KiServiceTable here
                            // but forget it
                            dwKiServiceTable=*(PDWORD)((DWORD)hModule+dwPointerRva+4)-poh->ImageBase;
                            return dwKiServiceTable;
                        }
                    }
                    
                } else
                    if (pfe->type!=IMAGE_REL_BASED_ABSOLUTE)
                        // should never get here
                        printf("/trelo type %d found at .%X/n",pfe->type,pbr->VirtualAddress+pfe->offset);
            }
            *(PDWORD)&pbr+=pbr->SizeOfBlock;
        }
    }    
    
    if (!dwFixups)
        // should never happen - nt, 2k, xp kernels have relocation data
        printf("No fixups!/n");
    return 0;
}

void main(int argc,char *argv[])
{    
    HMODULE    hKernel;
    DWORD    dwKSDT;                // rva of KeServiceDescriptorTable
    DWORD    dwKiServiceTable;    // rva of KiServiceTable
    PMODULES    pModules=(PMODULES)&pModules;
    DWORD    dwNeededSize,rc;
    DWORD    dwKernelBase,dwServices=0;
    PCHAR    pKernelName;
    PDWORD    pService;
    PIMAGE_FILE_HEADER    pfh;
    PIMAGE_OPTIONAL_HEADER    poh;
    PIMAGE_SECTION_HEADER    psh;

    
    // get system modules - ntoskrnl is always first there
    rc=NtQuerySystemInformation(SystemModuleInformation,pModules,4,&dwNeededSize);
    if (rc==STATUS_INFO_LENGTH_MISMATCH) {
        pModules=GlobalAlloc(GPTR,dwNeededSize);
        rc=NtQuerySystemInformation(SystemModuleInformation,pModules,dwNeededSize,NULL);
    } else {
strange:
        printf("strange NtQuerySystemInformation()!/n");
        return;
    }
    if (!NT_SUCCESS(rc)) goto strange;
    
    // imagebase
    dwKernelBase=(DWORD)pModules->smi.Base;
    // filename - it may be renamed in the boot.ini
    pKernelName=pModules->smi.ModuleNameOffset+pModules->smi.ImageName;
    
    // map ntoskrnl - hopefully it has relocs
    hKernel=LoadLibraryEx(pKernelName,0,DONT_RESOLVE_DLL_REFERENCES);
    if (!hKernel) {
        printf("Failed to load! LastError=%i/n",GetLastError());
        return;        
    }

    GlobalFree(pModules);

    // our own export walker is useless here - we have GetProcAddress :)    
    if (!(dwKSDT=(DWORD)GetProcAddress(hKernel,"KeServiceDescriptorTable"))) {
        printf("Can't find KeServiceDescriptorTable/n");
        return;
    }

    // get KeServiceDescriptorTable rva
    dwKSDT-=(DWORD)hKernel;    
    // find KiServiceTable
    if (!(dwKiServiceTable=FindKiServiceTable(hKernel,dwKSDT))) {
        printf("Can't find KiServiceTable.../n");
        return;
    }

    printf("&KiServiceTable==%08X/n/nDumping 'old' ServiceTable:/n/n",
                dwKiServiceTable+dwKernelBase);    
    
    // let's dump KiServiceTable contents        
    
    // MAY FAIL!!!
    // should get right ServiceLimit here, but this is trivial in the kernel mode
    GetHeaders((PBYTE)hKernel,&pfh,&poh,&psh);
    
    for (pService=(PDWORD)((DWORD)hKernel+dwKiServiceTable);
            *pService-poh->ImageBase<poh->SizeOfImage;
            pService++,dwServices++)
        printf("%08X/n",*pService-poh->ImageBase+dwKernelBase);    

    printf("/n/nPossibly KiServiceLimit==%08X/n",dwServices);

    FreeLibrary(hKernel);

}
http://www.rootkit.com/newsread.php?newsid=176

A more stable way to locate real KiServiceTable

Tan Chew Keong in his Win2K/XP SDT Restore 0.1 uses a simple way to find changed SDT entries - he ju...
  • iiprogram
  • iiprogram
  • 2008年04月04日 00:29
  • 479

【LightOJ 1274】Beating the Dataset(概率DP)

【LightOJ 1274】Beating the Dataset(概率DP)题目大意: 一道题目有多个输出文件。 每个文件有一个输出,”YES”或”NO” 现在直接提交答案,从”YES”开始,...
  • ChallengerRumble
  • ChallengerRumble
  • 2016年09月14日 19:50
  • 851

Learn.More.Python.3.the.Hard.Way.2017.9.pdf 英文原版 免费下载

下载地址: Learn.More.Python.3.the.Hard.Way.2017.9.pdf
  • jiongyi1
  • jiongyi1
  • 2017年12月31日 11:50
  • 363

杭电 HDU ACM 2612 Find a way (简单两路广搜)

欢迎参加——每周六晚的BestCoder(有米!) Find a way Time Limit: 3000/1000 MS (Java/Others)    Memory Limit: 32768/...
  • lsgqjh
  • lsgqjh
  • 2015年07月31日 09:47
  • 1573

[ACM] hdu Find a way

Find a way Time Limit: 3000/1000 MS (Java/Others)    Memory Limit: 32768/32768 K (Java/Others) Total...
  • sr19930829
  • sr19930829
  • 2014年01月18日 14:57
  • 2469

locate: warning: database /var/lib/slocate/slocate.db' is more than 8 days old

locate   -u         locate命令运行之前需要用updatedb或者locate   -u产生一个数据库,然后每次用户运行locate命令时就从数据库查找。所以当文件有变动的时候...
  • binger819623
  • binger819623
  • 2009年07月17日 11:33
  • 867

POJ 3259 虫洞 (BellMan-Ford)

While exploring his many farms, Farmer John has discovered a number of amazing wormholes. A wormhole...
  • h1021456873
  • h1021456873
  • 2017年03月22日 23:02
  • 85

HDU 2612 find a way

跑两遍BFS,开数组记录到达KFC步数。
  • sky_miange
  • sky_miange
  • 2015年02月06日 11:05
  • 906

ORACLE MERGE INTO语句,unable to get a stable set of rows in the source tables报错解决

ORACLE数据库,MERGE INTO语句,经常会出现  ORA-30926: unable to get a stable set of rows in the source tables   这...
  • zhanglu0223
  • zhanglu0223
  • 2014年06月04日 17:09
  • 9280

杭电-2612 Find a way(广搜)

Find a way Time Limit: 3000/1000 MS (Java/Others)    Memory Limit: 32768/32768 K (Java/Others) ...
  • lu_1110
  • lu_1110
  • 2016年07月30日 09:46
  • 202
内容举报
返回顶部
收藏助手
不良信息举报
您举报文章:Windows 内核驱动:A more stable way to locate real KiServiceTable
举报原因:
原因补充:

(最多只允许输入30个字)