Exetools - SST Hook -> Bluescreen!?

Exetools (https://forum.exetools.com/index.php)

- General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)

- - SST Hook -> Bluescreen!? (https://forum.exetools.com/showthread.php?t=6159)

Cobi	01-01-2005 00:04

SST Hook -> Bluescreen!?

1 Attachment(s)

Hi there,
For educational purpose (?) i want to code a File/Regmon Clone, with the same method of SystemServiceTable Hooking described in "Undocumented Windows NT" but when i try to Patch i get a Bluescreen "DRIVER_IRQL_NOT_LESS_OR_EQUAL" !?

Code:

extern        PSERVICE_DESCRIPTOR_TABLE        KeServiceDescriptorTable;

#define        SYSTEMSERVICE(_function)        KeServiceDescriptorTable->ntoskrnl.ServiceTable[*(PULONG)((PUCHAR)_function+1)]



_asm cli;

(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile)) = NewZwCreateFile; // <---#HERE#

_asm sti;

The System crashes directly when i try to Patch.
Is the Table in WinXP write protected or whats going on?
The whole source is attached.
Happy new Year @all
-Cobi

goggles99

01-02-2005 05:13

Try this

Yes, the "System Desciptor Table" in xp is write protected...
you need to disable the WP bit in the processors CR0 register.

Hooking by modifying the "Kernel service table" is used by several publicly available rootkit packages. HE4Hook and KApiHooks are two of them...

I can't download your attachment (Not enough thankyou points or something) but trysomething like this...

Code:

_asm

{

CLI //dissable interrupt

MOV EAX, CR0 //move CR0 register into EAX

AND EAX, NOT 10000H //disable WP bit 

MOV CR0, EAX //write register back

}



(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile)) = NewZwCreateFile; // <---#HERE#



_asm 

{

MOV EAX, CR0 //move CR0 register into EAX

OR EAX, 10000H //enable WP bit 

MOV CR0, EAX //write register back 

STI //enable interrupt

}

Opc0de

01-02-2005 07:27

Hi,

And if you want some examples of SDT hooking coded entirely in assembly language, you can look at my codes in my vault "Opc0de"
in the rootkit site:

hxxp://www.rootkit.com/download.php

Maybe you need to register before you be able to download it

Regards,
Opc0de

hajir

01-02-2005 15:30

After each blue screen, a Crash Dump file is created in "Minidump" folder at your Windows directory.

You can load this dump file into "WinDbg" (A Microsoft debugger that comes with SDKs) or other debuggers that can load this type of files, and then you analyze the reason of the crash and get usefull ideas

Cobi	01-02-2005 18:17

-> It seems to work :D (with the writeenabled SST)
Big Thx @ all!
@hajir
I know, but i had already lokated the error exacxtly a the point where i try to write a table entry, but thx the for tip :)

willii

01-06-2005 09:58

Another bad news. Microsoft disable modify service table in 64-bit windows. It disable to modify service table and even function entry code. So such program cann't use in 64-bit windows in future.

Cobi	01-07-2005 03:15

Hmm, yes, ( link ) but ->

Quote:

except through authorized Microsoft-originated hot patches

:D (That meens "except through everyone" :cool: )

thewhiz

04-07-2005 23:10

Curious if anyone has run into issues with WinXP SP2? I can hook ZwCreateFile (As I am trying to debug a rather nasty problem...) just fine, but if I want to open a file from my driver within the hook for ZwCreateFile, using the proper/original ZwCreateFile I manage to get a STATUS_ACCESS_VIOLATION.

Anyone run into this problem and have a quick solution? I have walked through the disassembly in Windbg and IDA Pro and see that everything goes bad when NtCreateFile->IoCreateFile->IopCreateFile runs into MmUserProbeAddress() on the FileHandle I supply to the original ZwCreateFile.

Any subtle insights would be greatly appreciated.

ionescu007

04-11-2005 18:59

You're passing UserMode on a buffer that comes from Kernel-Mode.

thewhiz

04-12-2005 00:49

How am I passing anything from UserMode? I am creating my own handle in kernel-mode to pass on to the original ZwCreateFile. Absolutely touching nothing coming from user-mode. The address of my kernel-mode allocated handle that I am passing is _valid_ for kernel-mode and not a user-mode buffer.

Cobi	04-12-2005 20:37

If i understand you right you want to pass a File-Handle created by your Kernel-Mode Process to a User-Mode Process, so you could edit the File-Object and change its owner.
(ObObjectRefferenceByHandle or smth.)

thewhiz

04-12-2005 22:51

Actually no. I am hooking ZwCreateFile, within the hooked function for ZwCreateFile that I created I am trying to call the original ZwCreateFile with all attributes allocated IN kernel-space and utilized IN kernel space. Absolutely NOTHING to do with user-mode other than interceding in the middle of a user-mode application attempting to open a file. Not in anyway shape or form attempting to pass anything back to user-mode.

username

05-04-2005 09:37

Quote:

Originally Posted by thewhiz

check out KTHREAD.PreviousMode, probably that's cause of your problem. normally you'd have to re-enter the kernel thru the Zw APIs, but since that's what you hooked you'll need some extra logic in there to pass such calls directly down (or mock with PreviousMode directly).

All times are GMT +8. The time now is 16:26.