Exetools - Ill bcome crazy with damn driver!

Exetools (https://forum.exetools.com/index.php)

- General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)

- - Ill bcome crazy with damn driver! (https://forum.exetools.com/showthread.php?t=4496)

Ill bcome crazy with damn driver!

Why when i change a bit in this driver (w_w.ramdisk.tk) it doesnt start anymore?
1) driver is not signature
2) i've removed the installer (i deleted ramdisk.dll(<-- no crc check inside) from system32 and installer registry keys). Driver run.

this is driver entry method:

Quote:

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath)
{

push ebp
INIT:00018501 mov ebp, esp
INIT:00018503 push esi
INIT:00018504 mov esi, [ebp+arg_0]
INIT:00018507 lea eax, [ebp+arg_0]
INIT:0001850A push eax
INIT:0001850B push 10h
INIT:0001850D push offset start
INIT:00018512 push esi
INIT:00018513 call ds:IoAllocateDriverObjectExtension
INIT:00018519 test eax, eax
INIT:0001851B jl loc_185DA
INIT:00018521 mov ecx, [ebp+arg_0]
INIT:00018524 push edi
INIT:00018525 mov edi, [ebp+arg_4]
INIT:00018528 mov ax, [edi]
INIT:0001852B mov [ecx], ax
INIT:0001852E mov ax, [edi+2]
...
...
return
}

bp on IoAllocateDriverObjectExtension and sice break fine.
Now the things go bad:
When i change only one char in driver ramdisk.sys it doesnt run anymore(!?!?) and softice doesnt break anymore in driver entry point! Why?
There is any security check in windows kernel?
it seems that the system doesnt start it anymore because its changed... :eek:

Thx in adv,
DaGoN

just a hunch...

make sure you've unloaded the previous instance of ramdisk.sys before starting up the new one. windows may be preventing the loading of another ramdisk.sys because one is already in place.

Yes, i stop the service, after i load it in winhex and i change a char and save it, i restart the service and the service doesnt start anymore... :(
Stop again the service, undo in winhex and save it, i restart the service and it works! :confused:
I've try it with differents xp machines...

DaGoN

fixed checksum already?

Quote:

Originally Posted by pLayAr

fixed checksum already?

Ehm... how i can fix the checksum of a device drive?
I havent found nothing about it.

Thx,
DaGoN

Hi,

Use LordPE to recalculate the CheckSum.

LordPe reduce the file size and optimize it but the result is always the same: It doesnt work.
Lordpe result: Validate Pe image... done.

Try it, its strange, seem that there is a check from the system before driver start. :confused:

my test
bc *
bpx IoAllocateDriverObjectExtension
start service
softice break
bpx @esp (bpx on caller)
bd 00
x
sofice break here:

Quote:

::::::::::::::: ENTRY POINT :::::::::::::::::::::
INIT:00018500 push ebp
INIT:00018501 mov ebp, esp
INIT:00018503 push esi
INIT:00018504 mov esi, [ebp+arg_0]
INIT:00018507 lea eax, [ebp+arg_0]
INIT:0001850A push eax
INIT:0001850B push 10h
INIT:0001850D push offset start
INIT:00018512 push esi
INIT:00018513 call ds:IoAllocateDriverObjectExtension
INIT:00018519 test eax, eax <---- good all works fine (ramdisk process)
INIT:0001851B jl loc_185DA
INIT:00018521 mov ecx, [ebp+arg_0]
INIT:00018524 push edi
INIT:00018525 mov edi, [ebp+arg_4]
INIT:00018528 mov ax, [edi]
INIT:0001852B mov [ecx], ax
INIT:0001852E mov ax, [edi+2]
...
...

i change a char
bc *
bpx IoAllocateDriverObjectExtension
i restart the service
softice doesnt break anymore

DaGoN

Hi,

You are using Rebuild PE. I'm said to you to recalculate the Checksum.

Open LordPE hit "PE Editor", choose the sys file, locate the checksum and you will see a "?" on the right hand side just hit it and then hit "Save".

ALiAli

Thanks my friend.. now it works real good.
Ive patched this damn driver! :D

Thx again,
DaGoN

Just to fully answer your question,

Yes, there is a security check done by the NT Kernel, which is to verify that the PE Checksum is correct or not. You can find the code to generate it yourself and skip LordPE... Or you can patch the kernel loader to disable this check.

Best regards,
Alex Ionescu
Relsoft Technologies
http://www.relsoft.net

Quote:

You can find the code to generate it yourself and skip LordPE... Or you can patch the kernel loader to disable this check.

Ive choose to recalculate the checksum ;).
Thanks for ur infos...
Byez,
DaGoN