Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 01-01-2005, 00:04
Cobi Cobi is offline
Friend
 
Join Date: Sep 2004
Location: Germany
Posts: 55
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Cobi Reputation: 0
SST Hook -> Bluescreen!?

Hi there,
For educational purpose (?) i want to code a File/Regmon Clone, with the same method of SystemServiceTable Hooking described in "Undocumented Windows NT" but when i try to Patch i get a Bluescreen "DRIVER_IRQL_NOT_LESS_OR_EQUAL" !?
Code:
extern	PSERVICE_DESCRIPTOR_TABLE	KeServiceDescriptorTable;
#define	SYSTEMSERVICE(_function)	KeServiceDescriptorTable->ntoskrnl.ServiceTable[*(PULONG)((PUCHAR)_function+1)]

_asm cli;
(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile)) = NewZwCreateFile; // <---#HERE#
_asm sti;
The System crashes directly when i try to Patch.
Is the Table in WinXP write protected or whats going on?
The whole source is attached.
Happy new Year @all
-Cobi
Attached Files
File Type: rar Fmon.rar (10.8 KB, 15 views)
Reply With Quote
  #2  
Old 01-02-2005, 05:13
goggles99 goggles99 is offline
Friend
 
Join Date: Aug 2004
Posts: 61
Rept. Given: 5
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 4 Times in 4 Posts
goggles99 Reputation: 0
Lightbulb Try this

Yes, the "System Desciptor Table" in xp is write protected...
you need to disable the WP bit in the processors CR0 register.

Hooking by modifying the "Kernel service table" is used by several publicly available rootkit packages. HE4Hook and KApiHooks are two of them...

I can't download your attachment (Not enough thankyou points or something) but trysomething like this...

Code:
_asm
{
CLI //dissable interrupt
MOV EAX, CR0 //move CR0 register into EAX
AND EAX, NOT 10000H //disable WP bit 
MOV CR0, EAX //write register back
}

(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile)) = NewZwCreateFile; // <---#HERE#

_asm 
{
MOV EAX, CR0 //move CR0 register into EAX
OR EAX, 10000H //enable WP bit 
MOV CR0, EAX //write register back 
STI //enable interrupt
}

Last edited by goggles99; 01-02-2005 at 05:16.
Reply With Quote
  #3  
Old 01-02-2005, 07:27
Opc0de
 
Posts: n/a
Hi,

And if you want some examples of SDT hooking coded entirely in assembly language, you can look at my codes in my vault "Opc0de"
in the rootkit site:

hxxp://www.rootkit.com/download.php

Maybe you need to register before you be able to download it

Regards,
Opc0de
Reply With Quote
  #4  
Old 01-02-2005, 15:30
hajir
 
Posts: n/a
After each blue screen, a Crash Dump file is created in "Minidump" folder at your Windows directory.

You can load this dump file into "WinDbg" (A Microsoft debugger that comes with SDKs) or other debuggers that can load this type of files, and then you analyze the reason of the crash and get usefull ideas
Reply With Quote
  #5  
Old 01-02-2005, 18:17
Cobi Cobi is offline
Friend
 
Join Date: Sep 2004
Location: Germany
Posts: 55
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Cobi Reputation: 0
-> It seems to work (with the writeenabled SST)
Big Thx @ all!
@hajir
I know, but i had already lokated the error exacxtly a the point where i try to write a table entry, but thx the for tip
Reply With Quote
  #6  
Old 01-06-2005, 09:58
willii
 
Posts: n/a
Another bad news. Microsoft disable modify service table in 64-bit windows. It disable to modify service table and even function entry code. So such program cann't use in 64-bit windows in future.
Reply With Quote
  #7  
Old 01-07-2005, 03:15
Cobi Cobi is offline
Friend
 
Join Date: Sep 2004
Location: Germany
Posts: 55
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Cobi Reputation: 0
Hmm, yes, ( link ) but ->
Quote:
except through authorized Microsoft-originated hot patches
(That meens "except through everyone" )

Last edited by Cobi; 01-07-2005 at 20:33.
Reply With Quote
  #8  
Old 04-07-2005, 23:10
thewhiz
 
Posts: n/a
Curious if anyone has run into issues with WinXP SP2? I can hook ZwCreateFile (As I am trying to debug a rather nasty problem...) just fine, but if I want to open a file from my driver within the hook for ZwCreateFile, using the proper/original ZwCreateFile I manage to get a STATUS_ACCESS_VIOLATION.

Anyone run into this problem and have a quick solution? I have walked through the disassembly in Windbg and IDA Pro and see that everything goes bad when NtCreateFile->IoCreateFile->IopCreateFile runs into MmUserProbeAddress() on the FileHandle I supply to the original ZwCreateFile.

Any subtle insights would be greatly appreciated.
Reply With Quote
  #9  
Old 04-11-2005, 18:59
ionescu007
 
Posts: n/a
You're passing UserMode on a buffer that comes from Kernel-Mode.
Reply With Quote
  #10  
Old 04-12-2005, 00:49
thewhiz
 
Posts: n/a
How am I passing anything from UserMode? I am creating my own handle in kernel-mode to pass on to the original ZwCreateFile. Absolutely touching nothing coming from user-mode. The address of my kernel-mode allocated handle that I am passing is _valid_ for kernel-mode and not a user-mode buffer.
Reply With Quote
  #11  
Old 04-12-2005, 20:37
Cobi Cobi is offline
Friend
 
Join Date: Sep 2004
Location: Germany
Posts: 55
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Cobi Reputation: 0
If i understand you right you want to pass a File-Handle created by your Kernel-Mode Process to a User-Mode Process, so you could edit the File-Object and change its owner.
(ObObjectRefferenceByHandle or smth.)
Reply With Quote
  #12  
Old 04-12-2005, 22:51
thewhiz
 
Posts: n/a
Actually no. I am hooking ZwCreateFile, within the hooked function for ZwCreateFile that I created I am trying to call the original ZwCreateFile with all attributes allocated IN kernel-space and utilized IN kernel space. Absolutely NOTHING to do with user-mode other than interceding in the middle of a user-mode application attempting to open a file. Not in anyway shape or form attempting to pass anything back to user-mode.
Reply With Quote
  #13  
Old 05-04-2005, 09:37
username
 
Posts: n/a
Quote:
Originally Posted by thewhiz
Actually no. I am hooking ZwCreateFile, within the hooked function for ZwCreateFile that I created I am trying to call the original ZwCreateFile with all attributes allocated IN kernel-space and utilized IN kernel space. Absolutely NOTHING to do with user-mode other than interceding in the middle of a user-mode application attempting to open a file. Not in anyway shape or form attempting to pass anything back to user-mode.
check out KTHREAD.PreviousMode, probably that's cause of your problem. normally you'd have to re-enter the kernel thru the Zw APIs, but since that's what you hooked you'll need some extra logic in there to pass such calls directly down (or mock with PreviousMode directly).
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Windows Hook user1 Source Code 0 04-24-2021 05:23
How can I hook DllMain ? ioannis General Discussion 12 07-29-2015 01:09
DriverStudio 3.1 Viaagp.sys Bluescreen bgrimm General Discussion 1 02-19-2004 02:37


All times are GMT +8. The time now is 08:03.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2022 )