AVAR 2009@kyoto

FFR GreenKiller
Automatic kernel-mode malware analysis system

Junichi Murakami,
murakami@fourteenforty.jp
Director of Research,
Fourteenforty Research Institute, Inc.

Who am I?
• MURAKAMI Junichi(村上 純一)– Reverse Engineer, both Windows and Linux kernel
development– BlackHat speaker at US and Japan 08– Security & Programming Camp Instructor(2006 - )– ITPro ホワイトハッカー道場(White Hacker Dojo)
http://itpro.nikkeibp.co.jp/article/COLUMN/20070927/283156/
2

FFR GreenKiller

version

0.0.1

Analyzing malicious driver from VMM
ring 3AgentGuestring 0VMMmalware

TracerKernel

VMCALLlog

FFR GreenKiller(based on BitVisor)
3

Background

Rootkits, Part1of 3: The Growing Threat(McAfee Avert Labs)
http://www.mcafee.com/us/local_content/white_papers/threat_center/wp_akapoor_rootkits1_en.pdf
4Why kernel-mode (is troublesome) ?
User-mode malware is a process,Kernel-mode malware is a part of systemring 3malwarering 0malwareIDA Pro, etc.

Kernel

BSOD is very welcomed 5

FFR GreenKiller

version

0.0.1

Analyzing malicious driver from VMM
ring 3AgentGuestring 0VMM

malwareTracerKernel

VMCALLlog

FFR GreenKiller(based on BitVisor)
6

BitVisor - http://www.bitvisor.org• Open-source VMM software(BSD License)

Guest OSdevice driver• Secure VM Project(National Project in Japan)• Intel-VT and AMD-v supported

BitVisor
Security Features

VMM
Core

Disk Encryption
VPN・・・• GreenKiller uses BitVisor as a
VMM framework Hardware

7

BitVisor (cont.)
BIOS

NTLDR

Grub

BitVisor

Windows8

Initialization
ring 3ring 0AgentKernel

VMCALL

ptr_PsLoadedModuleList
ptr_IopLoadDriverHookAddr

1. Build up kernel APIdatabase
2. Hook driver-loading APIin GuestFFR GreenKiller
9

PsLoadedModuleList
PsLoadedModuleList

ntoskrnl.exe

win32k.sys...

DriverObject

DriverObject

DriverObject

Kernel10

DriverObject
kd> dt nt!_DRIVER_OBJECT+0x000 Type: Int2B+0x002 Size
: Int2B+0x004 DeviceObject: Ptr32 _DEVICE_OBJECT+0x008 Flags: Uint4B+0x00c DriverStart: Ptr32 Void+0x010 DriverSize: Uint4B+0x014 DriverSection: Ptr32 Void+0x018 DriverExtension : Ptr32 _DRIVER_EXTENSION+0x01c DriverName: _UNICODE_STRING+0x024 HardwareDatabase : Ptr32 _UNICODE_STRING+0x028 FastIoDispatch: Ptr32 _FAST_IO_DISPATCH+0x02c DriverInit: Ptr32
long+0x030 DriverStartIo: Ptr32
void+0x034 DriverUnload: Ptr32
void+0x038 MajorFunction: [28] Ptr32
long

DbgPrint
DbgPrintEx
・・・・・・

0x804d9000

0x8052902e (0x804d9000 + 0x5002e)
0x80529050 (0x804d9000 + 0x50050)

MZ....
.....................................PE...
.....
[.edata section]
DbgPrint
DbgPrintEx....

0x5002e0x50050

ntoskrnl.exe

11Initializationring 3

ring 0AgentKernel

VMCALL

ptr_PsLoadedModuleList
ptr_IopLoadDriverHookAddr

1. Build up kernel API
database
2. Hook driver-loading APIin GuestFFR GreenKiller
12

IopLoadDriver

Break(switch to VMM)
13

Break at DriverEntry
KernelIopLoadDriver

mov
mov
push
calladd
mov

malwareeax, dword ptr [guest_esp]
edx, eax
eax
GetAddressOfEntryPointedx, eax
byte ptr [edx], 0xcc

FFR GreenKiller
14Software BP vs. Hardware BP• Software BP– Replace original byte with int3(0xcc)• Processor generates an #BP when int3 is hit– No limit on number of BPs• Hardware BP– Use Debug Register(DR0-DR3)– Needless to modify original code
– Only 4 BPs simultaneously15

Code Tracing
DriverEntrycallA)

Insert ‘0xcc’ into closest branch bydisassembling the code from DriverEntry

B)

Execution is suspended on the branch
Check whether execution takes the branchaccording to EFLAGS’s value•
If true: Insert ‘0xcc’ into branched addr.
•If not: Working the same as A.

C)

Execution is suspended on the branched addr.
Check whether it is an entry of kernel API•
if true: Insert ‘0xcc’ into retaddr•if not: Working the same as A.

sub_10031

retcallDbgPrint

ret

ret
16

Definition of an FSM
SEARCH_B

checked,find next branch

Eval branch

Branch not taken,
find next branch
CHECK_A

EVAL_B
Branch taken, check address17That’s all?
• No, we have to consider multiple context
for callbacks• Driver is a plug-in for the kernel

18Callbacks
IRP
DriverEntry
Process
Managementmalware

TimerKernel ThreadKernel19Ex)PsSetCreateProcessNotifyRoutine
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath){…
PsSetCreateProcessNotifyRoutine(CreateProcessNotifyCallback, ; NotifyRoutine
FALSE; Remove);…
}
VOID CreateProcessNotifyCallback(IN HANDLE ParentId, IN HANDLE ProcessId,
IN BOOLEAN Create){DbgPrint(“Pid %d is %s¥n”,ProcessId, Create ? “created” : “exit”);}
20Callbacks(cont.)• IRP Handlers• DPC Routines• Registry Callbacks• Fs/Ndis/Tdi filters• PsSetCreateProcessNotifyRoutine• PsSetLoadImageNotifyRoutine• PsCreateSystemThread• etc.
21

Lookup Kernel APIKernel

malwarecall 0x8052902e

State: CHECK_AAPIAddress

DbgPrint0x8052902e

DbgPrintEx 0x80529050…

….

Kernel API DB
FFR GreenKiller
22

Lookup Kernel API(cont.)
BreakKernel

malwareState: CHECK_A

call PsSetCreateProcessNotifyRoutine

NTSTATUS
PsSetCreateProcessNotifyRoutine(IN PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine,
IN BOOL Remove);

ReturnAddress = [GUEST_ESP]
Arg1 = [GUEST_ESP+4]; NotifyRoutine
Arg2 = [GUEST_ESP+8]; Remove
FFR GreenKiller
23

Output[DriverEntry]
0xfd965012: DbgPrint(“DriverEntry: 0x%lx¥n”)
0xfd065054: IoCreateDevice(“¥¥Device¥m3z1”)
0xfd065067: IoCreateSymbolicLink(“¥¥Device¥m3z1”, “¥¥DosDevices¥m3z1”)
0xfd06508c: PsSetCreateProcessNotifyRoutine(CB#1)[DriverUnload]
0xfd9650c0: IoDeleteSymbolicLink(“¥¥DosDevices¥m3z1”)
0xfd9650cc: IoDeleteDevice[CB#1: PsSetCreateProcessNotityRoutine]
0xfd965134: PsGetCurrentProcessId
0xfd965140: DbgPrint(“CreateProcessCallback %d %d %d¥n”)
0xfd96710c: ExFreePool
24

Limitation• Require Intel-VT• Require an Agent in guest’s ring3– Request for quick hack :)• Limited API support– Callback, Argument recognization

25

Related Work
We can detect memory-patching by malware• Viton, Hypervisor IPS(BlackHat USA 08)– Manipulate Guest PageTable/PageTableEntry,– To protect memory patching by malicious driver
JP: http://www.fourteenforty.jp/research/research_papers/bh-japan-08-Murakami.pdf
EN: http://www.fourteenforty.jp/research/research_papers/bh-usa-08-Murakami.pdf

26

Q&A

27