Hook Specials 4: combine inline hook with idt hook

Author:Sysnap

   Inline hook is to modify some bytes of a fuction for jump instruction go to funtions oneself to execute......

   IDT HOOK is to modify entry fuction for normal exception handling on IDT table be do function's address oneself.

   Put the two ideas of thoughts is combined - """"one byte's hook""""
   Watch:

    nt!NtOpenFile:
    80579fd0 8bff            mov     edi,edi
    80579fd2 55              push    ebp
    80579fd3 8bec            mov     ebp,esp

    No problem is do inline hook the funtion.....But there only modify one byte...So that isn't inline hook 

    mov     edi,edi The Opcode is 8bff...........We modify 8b to 0xCD.....Then executed
    Then nt!NtOpenFile.....The mean executed 0xCD 0xFF and the opcode is INT 0XFF...Ah.....Then exception is occur......Goto dispose exception handling of INT 0XFF的............We can IDT HOOK INT 0XFF.........So our function onself is executed

     Summarizes:::The way can bypass many of tools about inline hook now...Because We modified one byte of function's start...In essence,That isn's inline hook,Because without jmp.....

     But modified IDT.....Need DUMP IDT for realize to have exception  ..........So dectect IDT is important....The table is used for virus....Except that,""""one byte hook"""""and keyboard record...Ban debug etc..........

Hijacking kernel handle

Anthor:Sysnap

Why need handle?

Handle just use citing of object,This is simple for get object when entry kernel.But why need handle? We should speak to need handle for parameter call api.Because irect use object,Maybe involves many of not-export.if realize oneself that is hardly real.however,Use standard kernel api depend on handle in many cases and we can't get handle for a kinds of reason.We will discuss how get a useful handle.

1.Create Handle

ObpCreateHandle will diagnoseAccessMode,if there is user mode,PVOID ObjectTable;
ObjectTable = PsGetCurrentProcess()->ObjectTable
If there is driver to open handle,ObjectTable = ObpKernelHandleTable;
ObpKernelHandleTable is pointer of HANDLE_TABLE with not-export and ATTACH to process of SYSTEM at systerm.
Call ObpIncrementHandleCount to add Object count numbers,here notice without necessary to do some thing .
Call ExCreateHandle to create handle,Call in ExCreateHandle
//// Allocation one HANDLE_TABLE_ENTRY and a handle,The handle's value produce and finished on
///ExpAllocateHandleTableEntry.
ExpAllocateHandleTableEntry is core for allocation handle,That refer to related data structure.but leave it.
We only know ObpCreateHandle to return handle and add a HANDLE_TABLE_ENTRY at ObjectTable
lkd> dt _HANDLE_TABLE_ENTRY
nt!_HANDLE_TABLE_ENTRY
   +0x000 Object           : Ptr32 Void
HANDLE_TABLE_ENTRY Include our Object.


2 Handle to mapping of OBJECT

There refer to format of HandleTable,Online talk about HandleTable,Here don't talk about is
typedef struct _EXHANDLE    
{   
    union    
    {   
        struct    
        {   
            ULONG TagBits : 02;   
            ULONG Index   : 30;   
        };   
   
        HANDLE GenericHandleOverlay;   
    };   
   
} EXHANDLE, *PEXHANDLE;

It is observed that a type is for HANDLE.Infact that is divided into two parts-TagBits and Index,Specific what,watch next function
PHANDLE_TABLE_ENTRY    
    LookupHandleTableEntry(   
               IN PXP_HANDLE_TABLE HandleTable,   
               IN EXHANDLE         Handle   
               )   
{   
    ULONG i, j, k;   
    PHANDLE_TABLE_ENTRY Entry = NULL;   
    ULONG TableCode = HandleTable->TableCode& ~TABLE_LEVEL_MASK;   
   
    i = (Handle.Index >> 17) &0x1FF;   
    j = (Handle.Index >> 9)  &0x1FF;   
    k = (Handle.Index)       &0x1FF;   
   
    switch (HandleTable->TableCode &TABLE_LEVEL_MASK)   
    {   
        case 0 :   
          Entry = &((PHANDLE_TABLE_ENTRY)TableCode)[k];   
        break;   
           
        case 1 :   
          if (((PVOID *)TableCode)[j])    
          {   
             Entry = &((PHANDLE_TABLE_ENTRY *)TableCode)[j][k];            
          }   
        break;   
        case 2 :   
          if (((PVOID *)TableCode)[i])   
          if (((PVOID **)TableCode)[i][j])   
          {   
             Entry = &((PHANDLE_TABLE_ENTRY **)TableCode)[i][j][k];           

             
          }   
        break;   
    }   
    return Entry;   
}

We can get HANDLE_TABLE_ENTRY to get Object depanded on handle
Above function only fit XP and 2003

3.Permissions of handle
If we modified one permissions of handle to throughHANDLE_TABLE_ENTRY::GrantedAccess

4ObOpenObjectByPointer
ObReferenceObjectByPointer add count
ObpCreateHandle create handle

5.How fake

Such as we forge handle of XX.EXE process.

1 First need confirm ObpKernelHandleTable
  DWORD dwObpKernelHandleTable = 0;
  PVOID lpPsSystemObject = (PVOID)PsGetCurrentProcess();
  dwObpKernelHandleTable = *(DWORD*)((DWORD)lpPsSystemObject +

gdwObjectTableOffset);

2 ObOpenObjectByPointer open explorer.exe (Try to find protective process)
Get handle hProcess
3 Get EPROCESS of XX.EXE's process object with some way
4 hProcess as an paramenter to be call,LookupHandleTableEntry get pEntry that was pointer of PHANDLE_TABLE_ENTRY
It's about time pEntry->Object must is EPRCESS of explorer.exe
5 Modified pEntry->Object = XX.EXE的EPROCESS
This is the time we finishied HANDLE and OBJECT hijack..

There is key step and some detauks need notice,such as add handle count of object etc.


6 Have the effect?
We know most kernel API have a parament as HANDLE and inside most call it.
ObReferenceObjectByHandle position object,Analysis ObReferenceObjectByHandle we can know how hijack was useful.
It is clear ObReferenceObjectByHandle depend on HANDLE_TABLE to handle into object,That is handle--->> pEntry->Object
So hijack was successed.
That is my thiking,Thanks.
reference:
[1] WRK
[2] PsCidTable related to article