New reverse engineering technique using
API hooking and sysenter hooking, andcapturing of cash card access
NetAgent Co., Ltd.
http://www.netagent.co.jp
Kenji Aiko1

What is API (function) hook?
• A technique in which you temporarily alter
jmp command or call command when an
application program calls a function(instruction code) in an external library (.dllor .so files,) to divert the process to analternative function.
• There are libraries for API hook for Linux(UNIX) and Windows each.
2The method of function intercepts• An intercept that change the head addressof functions (Detours).
• An intercept that change the IAT (ImportAddress Table) which is on the process.
• An intercept that replace DLL.
• Native API intercepts by SSDT alteration.
There are some other methods …
3

Windows CryptoAPI （1/2）• Decoding API provided by ADVAPI32.dll.
• Available in Windows 2000 and later.
• You can use many crypt algorithm without
professional knowledge.
• Related libraries like Hash, Signature,Confirmation as well.
• SSL communications in Windows
environment often uses CryptoAPIinternally.
4Windows Crypt APIs （2/2）• Cryptographic train is exported withfunction names Crypt***.
Crypt functions exported by ADVAPI32.dll……………….

5

A demonstration （1/4）• As the data in SSL communication go
through CryptoAPI, you can capture themby intercepting cryptographic functions inthe process.
Demo 1
Capturing InternetExplorer’s SSL
communication
6

Encrypted Data via SSL
Wireshark can capture SSL (https)
communications running on IE as
illustrated below: Confirm that data has
been encrypted by SSL.
detail
We can watch encrypted data7

Data gone through CryptoAPI• Data gone through Crypt Encrypt/Decrypt
can be seen in plain text.
■send data

■recv data8

Security in SSL communications• An encrypted, simply tapping the traffic will
not show the contents.
• While eavesdropping with MITM (Man InThe Middle) is possible, reliability andsecurity of the communication is
guaranteed by using legitimate security
certificate.
9Multiple purposes of API hooking• By intercepting at the very moment of
decoding in an application program, thecontents of SSL traffic are visible.
• Even the contents of traffic can be altered.
• The contents can be altered no matter
whether the security certificate is valid ornot.

10API hooking is easy
• We can intercept some functions,– by using LD_PRELOAD on Linux (UNIX).
– by installing Detours library which is released
from Microsoft Research Team on Windows.
Detours libraries
http://research.microsoft.com/sn/detours/

11

LD_PRELOAD• Available on Linux (UNIX).
• Only have to register corresponding .so filein LD_PRELOAD environmental variable.
----- terminal% gcc –shared –fPIC –o intercept.so intercept.c –ldl
% LD_PRELOAD=./intercept.so target_prog----12

Detours library （1/3）• This is function intercept library which isreleased by Microsoft Research Team.
• This can intercept by changing the first few
bytes of target function.
• It’s simple and easy to use.
13

Detours library （2/3）• I indicate head few byte of CryptEncryptfunction blow.

• This is a trivial assembler code, but if weintercept function by using Detours,assembler code will be changed as seenin the picture next page.
14

Detours library （3/3）

The head few bytes of function will bechanged by detours.dll.

• The first 5 bytes of CryptEncrypt function
was changed to “jmp” by detours.dll.
15

Iintercept by changing IAT• The way of jumping another function bychanging IAT in process.
You can see more detail in“Advanced Windows” by Jeffrey Richter.

16

DLL replacing （1/2）• We can intercept a function by making
fake DLL based on legitimate DLL withidentical export function.
■ normalcall or jmp

17

DLL replacing （2/2）• We can intercept a function by making
fake DLL between prog.exe andkernel32.dll.
■ DLL intercepts
call or jmp

We can confirm the called function
call or jmp

18

SystemServices hooking （1/2）• System service (synonymous with systemcall on Linux) intercept by altering SSDT
(System Service Descriptor Table).
• Processing takes place in the kernel land.
Details found at
Hooking Windows NT System Services
http://www.windowsitlibrary.com/Content/356/06/2.html
19

SystemServices hooking （2/2）
change to hook_createfile

SSDT
NtCreateFile

hook_createfile

NtDeleteFile

real_deletefile……….
SDT……….

Real code

Fake code

real_deletefile

hook_createfile

real_createfile
20sysenter hooking （1/4）• In WindowsXP/2003 (x86) environment,
processes are handed over to the kernel
by sysenter command.
• sysenter is called in ntdll.dll.
• sysenter will jump to the value assigned inMSR.
21sysenter hooking （2/4）
ntdll.dll（ZwCreateFile）

Jump!
ntdll.dll（sysenter）

The value in eax registor shows systemcall number.
22

sysenter hooking （3/4）■sysenter executed
1.
2.
3.
4.

Load the value of (MSR-174H) into CS
Load the value of (MSR-176H) into EIP
Load the value of (MSR-174H) + 8 into SS
Load the value of (MSR-175H) into ESPTherefore, sysenter hooking can beachieved by altering (MSR-176H)
corresponding to the CPU.

23

sysenter hooking （4/4）
Change to nt!
hook_KiFastCallEntry(804e0f6f)

CPU
MSR-175H

f9e73000

MSR-176H

804e0f6f……….

normalhooking

nt!KiFastCallEntry:

nt!hook_KiFastCallEntry:

mov ecx,23h
push 30h
pop fs…………….

xor eax, eax
………….
24

A Demonstration （2/4）• Eavesdropping with MITM by using API
hooking.

Demo 2
Capturing the traffic of P2P programs25

E-money Edy• Prepaid e-money (technically identical tosuica).
• Can be charged by bank transfer.
• Balance can be confirmed in real-time,
also can be recharged, using a devotedsoftware.
26

FeliCa Port （PaSoRi）• A device to read the data in IC cards
directly into PC’s developed by SONY.
• External ones connected through USB
also available in stores.
• There are libraries for FeliCa Port available
under BSD license.
27

EdyViewer.exe• A software to read and maintain the datastored in Edy.
• Can be charged from registered bankaccount.
• Operable on Windows.
• Official software for FeliCa Port.

28

felicalib libraries• Library to access IC cards using an USBtype device (PaSoRi). Licensed underBSD.
http://felicalib.tmurakam.org/• Can be used to access e-money’s like
Suica、Edy、nanaco.
• Inofficial libraries for FeliCa Port.
29

A Demonstration （3/4）• IC card reading tool can be built withfelicalib.

Demo 3
Get the information from the IC card30

Security of IC cards （1/2）• Have readable blocks and unreadableblocks.
• Have encrypted blocks as well in IC card.
• Can not be written with felicalib.
• Can not be accessed to encrypted blocks
with felicalib.

31Security of IC cards （2/2）• With the official tool EdyViewer.exe
reading from encrypted blocks, writing , allpossible.
• Uses SSL (https) to communicate with theadmission server.

32

A demonstration （4/4）• Examine the SSL communication whilecharging to an IC card.

Demo 4
Capturing the SSL traffic of the officialtool33

Perspectives （1/2）• With API hook, communication between
the user land and the kernel land can becaptured.
• How can we capture the communicationbetween EdyViewer.exe and a FeliCa Portdriver?

34

Perspectives （2/2）• With sysenter hook, system call can beobserved.
• How can we estimate the function callhistory using the system call history athand?

35

Thank you!

Any questions?

36