SYSENTER hook

to bilbo:

AMD very well has own "SYSENTER-SYSEXIT":
SYSCALL 0F05h
SYSRET 0F07h

exactly about this i'm interesting:
do someone see usage of these on AMD at 7FFE0300h?

[bilbo]

Well done, evaluator!
The trick I told before is just avoiding to copy the INT 2E snippet on top of SYSENTER snippet: in this way you would fuck all the pending system calls!
You are copying it at a displacement of 16 bytes: good.
You have also done a lot of checks... even address FFDF0300 (which is the same physical memory as 7FFE0300), SYSEXIT(at KiSystemService), the code inside KiSystemService (which force you to detect eventually softice) and two times the SYSENTER snippet... but better sure than unsure...

I found also it is not necessary to patch KiSystemCallExitBranch from 7506 (jnz KiSystemCallExit2) to 7505 (jnz KiSystemCallExit).

do someone see usage of these on AMD at 7FFE0300h?

No, my experiments were done on a rather old AMD K6 and there INT 2E was used.

niom: it looks like you are interested to ring0 detouring. This is for you: http://www.rootkit.com/newsread.php?newsid=152
It comes with nice code too

Regards, bilbo


Edited for evaluator...
Regarding ring0 detouring suggestion, it was for niom, as I wrote, not for you...
Regarding 9th post: look where I posted the answer, and look to my previous posts, please...
Regarding SYSEXIT patching... I have posted on WOODMANN a snippet which does not patch anything more than necessary...
Please don't be so aggressive... We are here to learn, not to flame each other
Best regards!

P.S. only 3 addresses for phys 41000? or 4? Do PHYS 41000 and you will know!!!

>>it looks like you are interested to ring0 detouring
nope.

>>I found also it is not necessary to patch KiSystemCallExitBranch
>>from 7506 (jnz KiSystemCallExit2) to 7505 (jnz KiSystemCallExit).

verry nessesary:) remember, why we are replaicing pair SYSENTER-SYSEXIT
by INT-IRET!?

(that will your 9th power post~:)

another Q: there is III virtual address for 41000, wich is!? :)

Hey guys, I've found some info about SYSENTER and int 2e at ElicZs website... here is the txt

http://www.anticracking.sk/elicz/infos/FastNTCALL.txt

Hopefully you guys can use this to gain some knowledge

[JMI]

Wow, and it was only written four years ago. Where has it been hiding? Oh yah. In plain sight.

Regards,

common, bilbo, vhere you sow aggrressionn!?
we'r juZt fun creckerz~~:)

JMI, & in that time reversers was trying change to SYSENTER,
while we are triing BACK TO Fu..

[Mkz]

evaluator,

On an AMD this is what I get (XP SP1):

7FFE0300   8BD4             MOV EDX,ESP
7FFE0302   0F34             SYSENTER
7FFE0304   C3               RETN ; ring0 returns to this line

This is the rest of the code, but it isn't called:

7FFE0305   9C               PUSHFD
7FFE0306   810C24 00010000  OR DWORD PTR SS:[ESP],100
7FFE030D   9D               POPFD
7FFE030E   C3               RETN
7FFE030F   8BD4             MOV EDX,ESP
7FFE0311   0F05             SYSCALL
7FFE0313   C3               RETN
7FFE0314   9C               PUSHFD
7FFE0315   810C24 00010000  OR DWORD PTR SS:[ESP],100
7FFE031C   9D               POPFD
7FFE031D   C3               RETN
7FFE031E   C2 0800          RETN 8

And here's a sample call

77D6E285   B8 41110000      MOV EAX,1141
77D6E28A   BA 0003FE7F      MOV EDX,7FFE0300
77D6E28F   FFD2             CALL EDX
77D6E291   C2 1000          RETN 10

Seems that the same instruction is used as in Intel, not the 0F05 variant...

Here's the cpu info before you say it's a pentium

[ WCPUID Version 3.0g  (c) 1996-2002  By H.Oda! ]

  Processor #1 : AMD Athlon (Model 4) / ...
      Platform : Socket A (Socket 462)
 Vendor String : AuthenticAMD
      CPU Type : Original OEM Processor (0)
        Family : 6  (7)
         Model : 4  (4)
   Stepping ID : 4  (4)
         Brand : ----
          APIC : ----
   Name String : AMD Athlon(tm) Processor

Internal Clock : 1399.32 MHz
    System Bus :  266.54 MHz DDR
  System Clock :  133.27 MHz
    Multiplier :   10.5  

    L1 I-Cache :   64K Byte
    L1 D-Cache :   64K Byte
    L1 T-Cache :  ----
    L1  Cache  :  ----
    L2  Cache  :  256K Byte
    L2  Speed  : 1399.32 MHz (Full)

    MMX   Unit : Supported
    SSE   Unit : Not Supported
   SSE2   Unit : Not Supported
   MMX2   Unit : Supported
  3DNow!  Unit : Supported
  3DNow!+ Unit : Supported