Is it possible to encrypt a .sys file?

Just like exe encrypt.
Is it possible to make this encrypt?
Please also intro some tools.

Thanks!

[OHPen]

Hi,

yes it is possible to encrypt sys files. Protector Themida for example using a custom encryption routine to protect several parts of its code.

I don't know exactly what you mean with "intro tools" but if you think about
adding other binaries like pebundle does forget about it...

Cheers,

PAPiLLiON

[deroko]

yes, you may append your code to .sys but make sure to update checksum in PE header and to make code section writable. Any exception in r0 will cause bsod

The PE-checksum will be your smallest problem if you plan to encrypt *.SYS files.

You must take care of what sections are loaded at which time, you must take care of the init callbacks, you will run into some big problems when trying to allocate memory and some other nasty problems. Just to name one, how do you plan to call LoadLibrary or GetProcAddres from Ring-0? KERNEL32 is not present and you can't use SEH to find the imports by trial and error.

[OHPen]

He have to use native api, but thats obvious...

[deroko]

Originally Posted by MarkusO

Just to name one, how do you plan to call LoadLibrary or GetProcAddres from Ring-0? KERNEL32 is not present and you can't use SEH to find the imports by trial and error.

Simple, find ptr to ntoskrnl.exe from IDT and then cycle backward till you find ntoskrnl.exe base then locate ZwQuerySystemInformation to receive addresses of needed drivers and write GetProcAddress by yourself walking trough exports of needed .sys files At least that's how I would do it.

Originally Posted by MarkusO

The PE-checksum will be your smallest problem if you plan to encrypt *.SYS files.

You must take care of what sections are loaded at which time, you must take care of the init callbacks, you will run into some big problems when trying to allocate memory and some other nasty problems. Just to name one, how do you plan to call LoadLibrary or GetProcAddres from Ring-0? KERNEL32 is not present and you can't use SEH to find the imports by trial and error.

I do not think make a PE checksum will encrypt the .sys file.
It only prevent some modifications.
Encrypt file can not be analyzed by static disassemble tool such as IDA pro.

And as we know, VMProtect can make protection on .sys file but not encrypt, even compress.

[adaptor]

Dont' forget about MmGetSystemRoutineAddress routine Of couse if it works only for routines exported by ntoskrnl or HAL.. But in some cases it's enough.

Here is a plan how to make simple native encryptor Very common.
1) Get some user mode PE encryptor\compressor sources (better in asm)
2) Change GetProcAddress to MmGetSystemRoutineAddress
3) Change VirtualAlloc\VirtualFree to ExAllocatePool\ExFreePool
4) Debug

P.S. Classical compression based on possibility of making VirualSize of PE section bigger than PhisicalSize will work only in case Section alignment= 1000, File alignment= 200. Any other combination does'nt work for me.

Anyway compression in drivers it's not a good idea coz memory in pool is very
valuable resource.

[deroko]

agree, thats why small decryption code(xor/add/sub/rol/ror etc) is much better, import rebuilding code and compression is just wast of r0 memory