首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 看雪峰会 看雪商城 证书查询
  1. 看雪社区
  2. 软件逆向
    3. 发新帖
[原创]DTrace 研究
2022-9-27 17:18 7487

[原创]DTrace 研究

VirtualCC 活跃值
2022-9-27 17:18
7487

DTrace 研究

Windbg调试器单步异常，直接gn不处理。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
32.0: kd:x86> gn
The context is partially valid. Only x86 user-mode context is available.
WOW64 single step exception - code 4000001e (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
vmp3_6+0x4fa074:
00000000`008fa074 90              nop
32.0: kd:x86> ub
vmp3_6+0x4fa063:
00000000`008fa063 33d3            xor     edx,ebx
00000000`008fa065 ffca            dec     edx
00000000`008fa067 41              inc     ecx
00000000`008fa068 84d9            test    cl,bl
00000000`008fa06a f7da            neg     edx
00000000`008fa06c e91832f0ff      jmp     vmp3_6+0x3fd289 (007fd289)
00000000`008fa071 9d              popfd
00000000`008fa072 0f31            rdtsc
32.0: kd:x86> gn

DTrace

 

DTrace on Windows - Windows drivers

 

使用D语言编写监控

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
#pragma D option quiet
#pragma D option destructive
 
syscall::Nt*:entry
/ execname == $1 /
{
    /*printf("%s [Caller %s]\n",probefunc, execname);*/
    if(probefunc == "NtQuerySystemInformation") {
        if(arg0 == 35){
            printf("Detect Kernel Debugger\n");
        }
    }
 
    if(probefunc == "NtQueryInformationProcess") {
        if(arg1 == 0x7){
            printf("Detect ProcessDebutPort\n");
        }
 
        if(arg1 == 0x1E){
            printf("Detect ProcessDebugObjectHandle\n");
        }
 
        if(arg1 == 0x1F){
            printf("Detect DebugFlags");
        }
    }
 
    if(probefunc == "NtSetInformationThread"){
        if(arg1 == 0x11){
            printf("HideFromDebugger\n");
        }
    }
 
    if(probefunc == "NtQueryInformationProcess"){
        if(arg1 == 0){
            printf("Query Process Basic Information \n");
        }
    }
 
    if(probefunc == "NtQueryObject"){
        if(arg1 == 2) {
            printf("Query Object Type Information\n");
        }
 
        if(arg1 == 3) {
            printf("Query Object Types Information\n");
        }
    }
 
    if(probefunc == "NtClose") {
        printf("Close Handle : 0x%x\n",arg0);
    }
 
    if(probefunc == "NtSetInformationObject") {
        if(arg1 == 4){
            printf("Set Handle Flag\n");
        }
    }
 
    if(probefunc == "NtGetContextThread"){
        printf("Get thread by thread handle : 0x%x",arg0);
    }
 
    if(probefunc == "NtYieldExecution") {
        printf("NtYieldExecution\n");
    }
 
    if(probefunc == "DbgSetDebugFilterState") {
        printf("DbgSetDebugFilterState\n");
    }
}

效果发现其检测内核调试器的存在。

 

使用Dtrace进行追踪

1
dtrace.exe -s test.d vmp3.6.exe

 

使用WinArk做inline hook。

 

 

成功绕过vmp3.6 反内核调试器。

 

其他研究

1
2
3
4
5
6
7
8
0033:00000000`00e06169 48c7c101000000     mov     rcx, 1
0033:00000000`00e06170 48c7c21b52e000     mov     rdx, 0E0521Bh
0033:00000000`00e06177 ff1425d1c09a00     call    qword ptr [9AC0D1h]
0033:00000000`00e0617e cc                 int     3
0033:00000000`00e0617f 488bc8             mov     rcx, rax
0033:00000000`00e06182 ff142577c19a00     call    qword ptr [9AC177h]
0033:00000000`00e06189 4883c428           add     rsp, 28h
0033:00000000`00e0618d cb                 retf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
0: kd> gn
The context is partially valid. Only x86 user-mode context is available.
WOW64 single step exception - code 4000001e (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
00000000`00528bd5 e948073800      jmp     008a9322
32.0: kd:x86> gn
The context is partially valid. Only x86 user-mode context is available.
WOW64 single step exception - code 4000001e (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
00000000`0052a6b6 e98dee3700      jmp     008a9548
32.0: kd:x86> gn
The context is partially valid. Only x86 user-mode context is available.
WOW64 single step exception - code 4000001e (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
00000000`00529a6a e9f7f93700      jmp     008a9466
32.0: kd:x86> gn
The context is partially valid. Only x86 user-mode context is available.
WOW64 single step exception - code 4000001e (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
00000000`00527c85 e9c6153800      jmp     008a9250
32.0: kd:x86> gn

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法

收藏
点赞・7
打赏
分享
最新回复 (4)
scz
雪    币： 4069
活跃值： (3047)
能力值： ( LV12，RANK：230 )
在线值：
发帖
回帖
粉丝
私信
scz 5 2022-9-28 09:04
2 楼
0
没想到DTrace有在Windows上出现的一天，真是活久见。学习了，谢谢分享。
imliuxin
雪    币： 26
活跃值： (1375)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
imliuxin 2023-7-30 14:49
3 楼
0
WinArk怎么做inline hook ？
其他研究又是啥？
默NJ
雪    币： 2077
活跃值： (4131)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
默NJ 2023-7-30 18:49
4 楼
0
dtrace好用，但是太折腾
秋狝
雪    币： 19299
活跃值： (28938)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
秋狝 2023-7-30 21:07
5 楼
1
感谢分享
游客
登录 | 注册 方可回帖
　回帖　 表情 雪币赚取及消费
高级回复
返回