Another antirootkit tool: CodeWalker

@fl3a:

Hi, im currently building a generic method for finding rootkit processes which use their own implementation of thread/process scheduler such as phide_ex and Metraton's private PoC rootkit. I couldnt talk much about the method but i think it will detect some of the hidden rootkit process, even if it's private like Metraton's ;)

In this beta version, the main improves to other ark is heavily put in hidden driver object (System Modules tab) and code hooking detection.

For hidden driver detection, you can test it with some pretty well hidden driver PoC such as phide_ex and many builds of Rustock.B variants. Although you have to use the "Hardcore Scan" method to detect them.

For code hooking detection, the engine walks all the branches of scanned module i.e any execution path of it to detect modification (btw, that's why i call it CodeWalker). IMHO, It can detect code hooking very well especially with rootkits that place abnormal hooks like Rustock.C (FF25 & FF15 - jmp/call dword ptr [abc]) tho there're still some problems with false-positive hooks/modifications.

@Metraton:

Hi, thanks for bein one of my betatesters :) Glad to know it couldn't detect your rk like others ark out there becos it doesn't have a specific "weird" thread/process scheduler detector like abovementioned.

BTW, I would like to know which features you think that i can add to this tool also :) Thanks in advance.

@Vetinari:

I can assure you that this is just a false-positive of Avira ;) This is just because my tool use some techniqes which easily flag anti-malwares heuristic scanners. You can use this tool w/o being afraid of being "infected" with anything :)



Edited by thug4lif3 - 27 November 2008 at 5:10am

@fl3a:

Edited by Metraton - 25 November 2008 at 10:48pm

@GamingMasteR &

In next build I will try to limit the false-positive kernel code modification to lower rate. Thanks ;)

@redhawk:

I'll fix these bugs soon. May be it's becos of GUI bugs.

@controler:

Yes, virustotal always flag "rootkit tool" for programs which drop and load driver. Anyway, it's an anti-"rootkit tool", rite :D?

I will upload the new build asap. Thank you.

Edited by thug4lif3 - 21 November 2008 at 2:49am

Scanning memory then locks up Windows 100% after a few seconds only the mouse moves.
Tested on XP Pro SP2, with no SSDT hooks, AV or firewall software installed.

Richard S.

Up.

Im waiting for feedback :)

+FIX:
- fix bug in initializing & acquiring ERESOURCE


Edited by thug4lif3 - 20 November 2008 at 8:55am