[QUOTE=qihoocom]
but my hook in tophet will not modify any of execution image and any of function pointer(do you forgot the IAT/EAT?)
[/QUOTE]
It does detect IAT hooks, you can check the screenshot at page 1 about IAT hook in tcpip.sys (NdisOpenAdapter, NdisCloseAdapter) but EAT detection isnt stable. If your hook doesnt modify image or function ptr then my tool will not detect it, of cos ;) but my DKOM detection feature is currently in stable and ready for next build :)
I know what you had mentioned:
you scan AN API, when your DASM ENGINE find
a E8 call /FF 15 CALL, your Engine follow in, this called "deep scan", AND I had used this little trick for a long time. BUT, you may forget that your call
hook in MmLoadSystemImage is:
call f7946003 ; <--- this ADDRESS isn't in ntoskrnl.exe
my call HOOK is like this:
call 81a02451 ; <-- this ADDRESS is in ntoskrnl.exe
that is the differentia, because your ENGINE follow in each CALL xxxx,
and if xxxx's address is in ntoskrnl.exe, you take it for granted that it is a normal call, but not a Virus Modify. AND my scan ENGINE CAN deeply carry out...
Hi, im sorry that i cant fully understand your post, becos I dont know Chinese :( I only use google to translate to Vietnamese :( It translate "驱动有VMP，看起来一点都不舒服~ 最后说句：居然引入了MmIsAddressValid..." to "Driver has VMP, is not comfortable to look
To be the last: even the introduction of the MmIsAddressValid ...". Im really sorry, can you post in English ?
@Sudami:
No, that isnt the reason. Even CALL/JMP xxxx with xxxx inside ntoskrnl.exe or i.e the being scanned module, it still be detected as hook, becos it doesnt make any assumption that address inside ntoskrnl.exe is safe or geniune. It's the difference to other ark. It checks the target functions which is called, if the target is abnormal, suspect flag is set.
Hi, thanks for your testing driver, but I tested it and it was detected. You have to use the "Hardcore scan" method. The tool can detect your driver with the result shown below. Of cos I loaded your driver before starting my tool ;) You can check it again too.
@Sudami:
I just want to ask if I can contact you guys via email, ICQ or Yahoo Messenger or not.
haha,I have a simple way to bypass your inline hook scaning,just like this,
and your AR can't find my hook~~~
you can retry like this
ps:you can touch me by weolar@qq.com.
welcome to discuss Rootkit
