BanMe
August 29th, 2009, 01:17
code called before RtlCreateUserThread ..
InitUserHooks..
Native_HotPatchAddrEx
LdrpCallInitRoutine after hooking..
Code in "Shared" Mapped View (originates in server)..
code executed after call of RtlCreateUserThread by LdrpCallInitRoutine..
hmm
then goes on to deactivate Activation Context, it also leaves Ldr Critical Section..and then finally ZwTestAlert.. which calls the routine of RtlCreateUserThread..hope some of this was 'fun' .. ;p
regards BanMe
Code:
if(InitUserHooks(ClientView))
{
Status = RtlCreateUserThread(NtCurrentProcess(),0,0,0,0,0,(PUSER_THREAD_START_ROUTINE)wtf,0,&PortHandle,&Cid);
}
InitUserHooks..
Code:
BOOL InitUserHooks(PORT_VIEW CodeView)
{
ULONG Addr_BaseThreadStart = 0;
ULONG Addr_BaseThreadStartThunk = 0;
ULONG Addr_LdrInitializeThread = 0;
ULONG Addr_LdrCallInitRoutine = 0;
BYTE SigBaseThread[7] = { 0x33,0xED,0x53,0x50,0x6A,0x00,0xE9 };
BYTE SigLdrInitializeThread[9] = { 0x6A, 0x02, 0xFF, 0x76, 0x10, 0xFF, 0x75, 0xE0, 0xE8 };
BYTE CodBaseThread[2] = { 0x00,0x00};
BYTE CodLdrCallInit[5] = { 0x00,0x00};
NTSTATUS Status = 0;
ULONG NumOfBytes = 2;
PVOID pfnOrigin = 0;
int i;
GetProcessModules();
for(i = 0;i<20;i++)
{
if(wcscmp((PWSTR)Array_ModName[I], L"ntdll.dll"== 0)
break;
}
Addr_LdrInitializeThread = SigSeek_FindCode((DWORD)Array_ModHandle[I],((DWORD)Array_ModHandle[I]+Array_ModSize[I]),sizeof(SigLdrInitializeThread),(DWORD*)&SigLdrInitializeThread);
if(Addr_LdrInitializeThread)
{
__asm
{
mov ebx,[eax+0x9]
add ebx,eax
add ebx,0xd
mov Addr_LdrCallInitRoutine,ebx
}
}
else
{
return FALSE;
}
for(i = 0;i<20;i++)
{
if(wcscmp((PWSTR)Array_ModName[I], L"kernel32.dll"
break;
}
Addr_BaseThreadStartThunk = SigSeek_FindCode((DWORD)Array_ModHandle[I],((DWORD)Array_ModHandle[I]+Array_ModSize[I]),sizeof(SigBaseThread),(DWORD*)&SigBaseThread);
if(Addr_BaseThreadStartThunk)
{
// extract the address of kernel32.BaseThreadStart() from jmp instruction
// destination = code location + jump offset + 5
__asm
{
mov ebx, [eax+7]
add ebx, eax // code location
add ebx, 6 //
add ebx, 5
mov Addr_BaseThreadStart, ebx
}
}
else
{
return FALSE;
}
ULONG Hook_LdrCallInitRoutine = ((ULONG)CodeView.ViewBase);
if(Native_HotPatchAddrEx(Addr_LdrCallInitRoutine,Hook_LdrCallInitRoutine,0x1DEB,1,&pfnOrigin))
{
return TRUE;
}
return FALSE;
}
Native_HotPatchAddrEx
Code:
bool Native_HotPatchAddrEx(ULONG oldProc, ULONG newProc,WORD Code,ULONG NumOfNop, void**ppOrigFn)
{
bool bRet = false;
ULONG oldProtect = NULL;
ULONG pLongJump = 0;
ULONG pLongJumpAdr = 0;
ULONG ProtectSize = 2;
ULONG ProtectAddr = oldProc;
BYTE Nop = 0x90;
if(!NT_SUCCESS(NtProtectVirtualMemory(NtCurrentProcess(),(PVOID*)&ProtectAddr, &ProtectSize, PAGE_EXECUTE_READWRITE, &oldProtect)))
{
return bRet;
}
WORD *pJumpBack = (WORD*)oldProc;
__asm
{
lea ecx,Code
inc ecx
mov al,byte ptr[ecx];
movzx ecx,al
cmp ecx,0
je Failed
push ecx
add oldProc,ecx
push oldProc
pop ProtectAddr
mov ProtectSize,5
}
if(!NT_SUCCESS(NtProtectVirtualMemory(NtCurrentProcess(),(PVOID*)&ProtectAddr,&ProtectSize,PAGE_EXECUTE_READWRITE,&oldProtect)))
{
return bRet;
}
__asm
{
pop ecx
push oldProc
pop pLongJump
inc oldProc
push oldProc
pop pLongJumpAdr
dec oldProc
sub oldProc,ecx
}
if(*pJumpBack != 0xFF8B)
{
__asm
{
add oldProc,2
mov edi,oldProc
lea esi,Nop
mov ecx,NumOfNop
rep movsb
sub oldProc,2
}
}
*(BYTE*)pLongJump = 0xE9; // long jmp
*(ULONG*)pLongJumpAdr = (newProc - oldProc)-0x22; //
*pJumpBack = 0x1beb; // short jump back -7 (back 5, plus two for this jump)
if (ppOrigFn)
{
*ppOrigFn = ((BYTE*)oldProc);
bRet = true;
}
//if(!NT_SUCCESS(NtProtectVirtualMemory(NtCurrentProcess(),(PVOID*)&pLongJump, &ProtectSize, oldProtect, &oldProtect)))
//{
// return bRet;
//}
Failed:
return bRet;
}
LdrpCallInitRoutine after hooking..
Code:
_LdrpCallInitRoutine@16:
jmp _LdrpCallInitRoutine@16+1Dh (7C901193h)
nop
push esi
push edi
push ebx
mov esi,esp
push dword ptr [ebp+14h]
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
call dword ptr [ebp+8]
mov esp,esi
pop ebx
pop edi
pop esi
pop ebp
ret 10h
jmp 01570000
Code in "Shared" Mapped View (originates in server)..
Code:
XOR ECX,ECX
QSFRA:
MOV EAX,[ESP+(ECX*0x4)]
CMP EAX,0x7c900000
JL IncStack
CMP EAX,0x7cA00000
JG IncStack
RDUNOP:
CMP WORD PTR [EAX],0x406a
JE FAS
SUB EAX,1
JMP RDUNOP
FAS:
PUSH EBP
MOV EBP,ESP
MOV EAX,0x7c901179
JMP EAX
IncStack:
INC ECX
JMP QSFRA
ret
code executed after call of RtlCreateUserThread by LdrpCallInitRoutine..
Code:
__DllMainCRTStartupForGS@12:
mov edi,edi
push ebp
mov ebp,esp
cmp dword ptr [ebp+0Ch],1
je __DllMainCRTStartupForGS@12+0Bh (7C9222FAh)
xor eax,eax
inc eax
pop ebp
ret 0Ch
hmm
Code:
_BaseDllInitialize@12:
mov edi,edi
push ebp
mov ebp,esp
cmp dword ptr [ebp+0Ch],1
je _BaseDllInitialize@12+0Bh (7C818A92h)
pop ebp
nop
nop
nop
nop
nop
__BaseDllInitialize@12:
mov edi,edi
push ebp
mov ebp,esp
sub esp,424h
mov eax,dword ptr [___security_cookie (7C8856CCh)]
mov ecx,dword ptr [ebp+8]
push ebx
push esi
push edi
xor edi,edi
mov dword ptr [ebp-4],eax
mov dword ptr [ebp-424h],ecx
mov dword ptr [ebp-414h],edi
mov eax,dword ptr fs:[00000018h]
mov eax,dword ptr [eax+30h]
mov eax,dword ptr [eax+1D4h]
mov dword ptr [_SessionId (7C8856E4h)],eax
mov dword ptr [_BaseDllHandle (7C885054h)],ecx
mov eax,dword ptr fs:[00000018h]
mov ebx,dword ptr [eax+30h]
mov eax,dword ptr [ebp+0Ch]
sub eax,edi
mov dword ptr [ebp-420h],ebx
je 7C81CAF4
dec eax
je __BaseDllInitialize@12+89h (7C8185EDh)
dec eax
jne __BaseDllInitialize@12+61h (7C80C177h)
push edi
push 2
call _ConDllInitialize@8 (7C80B777h)
test al,al
je __BaseDllInitialize@12+82h (7C82B7ECh)
mov al,1
mov ecx,dword ptr [ebp-4]
pop edi
pop esi
pop ebx
call @__security_check_cookie@4 (7C8097AAh)
leave
ret 0Ch
then goes on to deactivate Activation Context, it also leaves Ldr Critical Section..and then finally ZwTestAlert.. which calls the routine of RtlCreateUserThread..hope some of this was 'fun' .. ;p
regards BanMe
lol...
