Position-Independent Code Analysis Problem Aleksandr Matrosov - - PowerPoint PPT Presentation

▶
position independent code analysis
SMART_READER_LITE
LIVE PREVIEW

Position-Independent Code Analysis Problem Aleksandr Matrosov - - PowerPoint PPT Presentation

Oct 25, 2022 298 likes •1.2k views

Reconstructing Gapz: Position-Independent Code Analysis Problem Aleksandr Matrosov Eugene Rodionov @matrosov @vxradius Outline of The Presentation Gapz: dropper exploprer.exe code injection trick Gapz: bootkit Classification

slide-1
SLIDE 1

Reconstructing Gapz: Position-Independent Code Analysis Problem

Aleksandr Matrosov Eugene Rodionov

@matrosov @vxradius

slide-2
SLIDE 2

Outline of The Presentation

  • Gapz: dropper

 exploprer.exe code injection trick

  • Gapz: bootkit

 Classification of modern bootkits  New VBR bootkit technique

  • Gapz: payload

 Hidden file system implementation  Disk hooks and Hooking engine  NDIS, TCP/IP stack implementation, HTTP protocol  C&C communications

  • Gapz: forensic approaches
  • HexRaysCodeXplorer
slide-3
SLIDE 3

Gapz: dropper

slide-4
SLIDE 4

PowerLoader Builder (since September 2012)

slide-5
SLIDE 5

PowerLoader Builder (since September 2012)

slide-6
SLIDE 6

Gapz Dropper Execution Stages

Injecting into explorer.exe (entry point) Local Privilege Escalation (icmnf) Infecting the system (isyspf) stage 1 stage 2

slide-7
SLIDE 7

Bypassing HIPS with eplorer.exe Code Injection

  • pens shared sections from

\\BaseNamedObjects mapped into explorer.exe and writes shellcode

slide-8
SLIDE 8

Bypassing HIPS with eplorer.exe Code Injection

The dropper searches for the window “Shell_TrayWnd”

slide-9
SLIDE 9

Bypassing HIPS with eplorer.exe Code Injection

The dropper calls GetWindowLong() so as to get the address of the routine related to the “Shell_TrayWnd” window handler The dropper calls SetWindowLong() to modify “Shell_TrayWnd” window-related data

slide-10
SLIDE 10

Bypass HIPS with eplorer.exe Code Injection

calls SendNotifyMessage() to trigger shellcode execution in explorer.exe address space arbitrary code execution in WndProc() of “Shell_TrayWnd”:

slide-11
SLIDE 11

Triggering Shellcode Execution

SendNotifyMessage() transfers control to the address pointed to address points to the KiUserApcDispatcher() routine

slide-12
SLIDE 12

Triggering Shellcode Execution

uses ROP-gadgets to jump into shellcode memory region and execute shellcode

slide-13
SLIDE 13

Triggering Shellcode Execution

uses ROP-gadgets to jump into shellcode memory region and execute shellcode

slide-14
SLIDE 14

Triggering Shellcode Execution

slide-15
SLIDE 15

Gapz: bootkit

slide-16
SLIDE 16

Modern Bootkits Classification (BIOS based)

Bootkits MBR VBR/IPL MBR Code modification Partition Table modification IPL Code modification BIOS Parameter Block modification TDL4 Olmasco Rovnix Gapz

slide-17
SLIDE 17

Gapz Bootkit Overview

Module Name Hooked Routine ntldr BlLoadBootDrivers bootmgr Archx86TransferTo32BitApplicationAsm winload.exe OslArchtransferToKernel ntoskrnl.exe IoInitSystem

Gapz bootkit features:

  • hooks int 13h handler
  • patches modules: ntldr, bootmgr, winload.exe, kernel

image to survive processor execution mode switching and kernel-mode code integrity checks

slide-18
SLIDE 18

Gapz Bootkit Workflow

Hook Archx86TransferTo32BitApplicationAsm in bootmgr Hook OslArchTransferToKernel in winload.exe Hook IoInitSystem in kernel image

Int 13h handler is hooked Bootmgr loads winload.exe Winload.exe loads kernel image Bootkit loads malicious kernel-mode code and runs it in a new system thread

slide-19
SLIDE 19

Gapz VBR Bootkit

Gapz VBR bootkit features:

  • Relies on Microsoft Windows VBR layout
  • The infections results in modifying only 4 bytes of VBR
  • The patched bytes might differ on various installations

jmp BIOS Parameter Block (BPB)

VBR code Text Strings

0x55 0xAA

0x000 0x003 0x054 0x19C 0x1FE 0x200 transfer control

slide-20
SLIDE 20

Gapz BPB Layout

struct BIOS_PARAMETER_BLOCK

{ WORD BytesPerSector; BYTE SecPerCluster; WORD ReservedSectors; BYTE Reserved[5]; BYTE MediaDescriptorID; WORD Reserved2; WORD SectorsPerTrack; WORD NumberOfHeads; DWORD HiddenSectors; DWORD Reserved3[2]; LONGLONG TotalSectors; LONGLONG StartingCluster; LONGLONG MFTMirrStartingCluster; DWORD ClustersPerMFTRecord; DWORD ClustersPerIndexBuffer; LONGLONG VolumeSerialNumber; DWORD Reserved4; };

slide-21
SLIDE 21

Gapz BPB Layout

struct BIOS_PARAMETER_BLOCK

{ WORD BytesPerSector; BYTE SecPerCluster; WORD ReservedSectors; BYTE Reserved[5]; BYTE MediaDescriptorID; WORD Reserved2; WORD SectorsPerTrack; WORD NumberOfHeads; DWORD HiddenSectors; DWORD Reserved3[2]; LONGLONG TotalSectors; LONGLONG StartingCluster; LONGLONG MFTMirrStartingCluster; DWORD ClustersPerMFTRecord; DWORD ClustersPerIndexBuffer; LONGLONG VolumeSerialNumber; DWORD Reserved4; };

slide-22
SLIDE 22

Gapz BPB Modification

MBR

NTFS File System IPL

VBR NTFS Volume

0x200 0x1E00 Number of “Hidden Sectors”

MBR

NTFS File System IPL

Infected VBR NTFS Volume

0x200 0x1E00

Hard Drive

Modified value of number of “Hidden Sectors”

Bootkit

before infection after infection

slide-23
SLIDE 23

Gapz: rootkit

slide-24
SLIDE 24

Gapz Rootkit Overview

  • Gapz rootkit functionality is implemented as

position independent kernel-mode code for both x86 and x64 platforms

  • Gapz rootkit capabilities:

 Hidden storage implementation

 User-mode payload injection  Covert network communication channel  C&C server authentication mechanism

slide-25
SLIDE 25

Gapz Rootkit Overview

  • Gapz rootkit functionality is implemented as

position independent kernel-mode code for both x86 and x64 platforms

  • Gapz rootkit capabilities:

 Hidden storage implementation

 User-mode payload injection  Covert network communication channel  C&C server authentication mechanism

slide-26
SLIDE 26

Gapz Kernel-mode Code Organization

struct GAPZ_BASIC_BLOCK_HEADER { // A constant which is used to obtain addresses // of the routines implemented in the block unsigned int ProcBase; unsigned int Reserved[2]; // Offset to the next block unsigned int NextBlockOffset; // Offset of the routine performing block initialization unsigned int BlockInitialization; // Offset to configuration information // from the end of the kernel-mode module // valid only for the first block unsigned int CfgOffset; // Set to zeroes unsigned int Reserved1[2]; };

slide-27
SLIDE 27

Gapz Kernel-mode Code Blocks

Block # Implemented Functionality

1

General API, gathering information on the hard drives, CRT string routines and etc.

2

Cryptographic library: RC4, MD5, SHA1, AES, BASE64 and etc.

3

Hooking engine, disassembler engine.

4

Hidden Storage implementation.

5

Hard disk driver hooks, self-defense.

6

Payload manager.

7

Payload injector into processes’ user-mode address space.

8

Network communication: Data link layer.

9

Network communication: Transport layer.

10

Network communication: Protocol layer.

11

Payload communication interface.

12

Main routine.

slide-28
SLIDE 28

Gapz Hidden Storage Implementation

  • Gapz implements modified FAT32 hidden volume

based on FullFat project

 Length of file name in FAT directory entry is 32 bytes

  • The hidden volume is stored in the file with name:

“\??\C:\System Volume Information\{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}”

  • The contents of the volume is encrypted with

AES-256 in CBC mode:

 The sector LBA is used as IV

slide-29
SLIDE 29

Gapz Hidden Storage Implementation

  • Gapz implements modified FAT32 hidden volume

based on FullFat project

 Length of file name in FAT directory entry is 32 bytes

  • The hidden volume is stored in the file with name:

“\??\C:\System Volume Information\{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}”

  • The contents of the volume is encrypted with

AES-256 in CBC mode:

 The sector LBA is used as IV

slide-30
SLIDE 30

Gapz Hidden Storage Implementation

  • Gapz implements modified FAT32 hidden volume

based on FullFat project

 Length of file name in FAT directory entry is 32 bytes

  • The hidden volume is stored in the file with name:

“\??\C:\System Volume Information\{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}”

  • The contents of the volume is encrypted with

AES-256 in CBC mode:

 The sector LBA is used as IV

slide-31
SLIDE 31

Gapz Crypto Library Implementation

  • Gapz crypto library functionality:

 Hashing: MD5, SHA1  Symmetric ciphers: RC4, AES  Asymmetric cipher: ECC

slide-32
SLIDE 32

Gapz Self-Defence Mechanisms

  • Gapz hooks IRP_MJ_INTERNAL_DEVICE_CONTROL and

IRP_MJ_DEVICE_CONTROL handlers to monitor:

 IOCTL_SCSI_PASS_THROUGH  IOCTL_SCSI_PASS_THROUGH_DIRECT  IOCTL_ATA_PASS_THROUGH  IOCTL_ATA_PASS_THROUGH_DIRECT

  • Gapz protects:

 MBR/VBR from being read/overwritten  its image on the hard drive from being overwritten

slide-33
SLIDE 33

Gapz Hooking Engine Implementation

  • Gapz hooking engine is based on the ”Hacker

Disassembler Engine”

  • Tries to avoid patching the very first bytes of the routine

being hooked (nop; mov edi, edi; etc.):

slide-34
SLIDE 34

Gapz Hooking Engine Implementation

  • Gapz hooking engine is based on the ”Hacker

Disassembler Engine”

  • Tries to avoid patching the very first bytes of the routine

being hooked (nop; mov edi, edi; etc.):

slide-35
SLIDE 35

Gapz Code Injection Functionality

Allocate memory buffer in target process address space Write payload and loader code into allocated buffer Create remote thread in the target process

Loader code DLL loader

(load/unload DLL modules)

Command executer

(call specific handler in DLL payload and pass necessary parameters)

EXE loader 1

(run EXE modules)

EXE loader 2

(run EXE modules)

slide-36
SLIDE 36

Gapz Payload Loader Code: DLL Loader & Command Executer

Map image into address space Fix relocations and initialize IAT Load or unload? Execute export #1 Execute export #2 Release image memory unload load

slide-37
SLIDE 37

Gapz Payload Loader Code: EXE Loaders

Drop payload image into %TEMP% directory Execute CreateProcessW API EXE Loader 1

Create legitimate suspended process (via CreateProcessAsUser) Overwrite process image with the malicious one Set process thread context according to malicious image Resume process thread EXE Loader 2

slide-38
SLIDE 38

Gapz Network Protocol Implementation

svchost.exe

  • verlord32(64).dll

Win32/Gapz kernel-mode module

TCP/IP protocol stack implementation Message to be sent to C&C Server

user mode kernel mode C&C Server Send using Win32 socket implementation Send directly using NDIS miniport driver

slide-39
SLIDE 39

Gapz Network Protocol Architecture

Gapz implementation OSI Model HTTP protocol (block #10) TCP/IP protocol (block #9) NDIS miniport wrapper (block #8) Application/Presentation Layer Network/Transport Layer Data Link Layer

slide-40
SLIDE 40

Gapz Network Protocol Implementation: NDIS

Gapz network protocol stack relies on miniport adapter driver:

Miniport adapter driver Intermediate driver Protocol driver (tcpip.sys) Filter driver

... ... ...

At the level of protocol or intermediate drivers Win32/Gapz’s network packet is “invisible” Win32/Gapz communicates directly to miniport adapter

Win32/Gapz Network packet

slide-41
SLIDE 41

Gapz C&C Communication Protocol

  • Gapz communicates to C&C servers over HTTP protocol
  • Capabilities of the protocol:

 00 - download payload  01 - send bot information to C&C  02 - request payload download information  03 - report on running payload  04 - update payload download URL

  • The requests corresponding to commands 0x01, 0x02 and 0x03 are

performed by the POST method of the HTTP protocol.

slide-42
SLIDE 42

Gapz C&C Communication Protocol: HTTP Request Message Header HTTP Header Request specific data

HTTP header HTTP body struct MESSAGE_HEADER { // Output of PRNG unsigned char random[128]; // a DWORD from configuration file unsigned int reserved; // A binary string which is used to authenticate C&C servers unsigned char auth_str[64]; };

slide-43
SLIDE 43

Gapz C&C Communication Protocol: HTTP Request Message Header HTTP Header Request specific data

HTTP header HTTP body struct MESSAGE_HEADER { // Output of PRNG unsigned char random[128]; // a DWORD from configuration file unsigned int reserved; // A binary string which is used to authenticate C&C servers unsigned char auth_str[64]; };

slide-44
SLIDE 44

Gapz C&C Communication Protocol: C&C Reply

Encrypted rc4 key K1 HTTP Header Reply specific data

HTTP message header HTTP message body

Authentication string

rc4 encrypted data with key k1

Decrypt key K1 Decrypt authentication string and reply-specific data using key K1 Check authentication string Process reply-specific data Reject reply-specific data match doesn’t match

slide-45
SLIDE 45

Gapz C&C Communication Protocol: URLs

slide-46
SLIDE 46

Gapz C&C Communication Protocol: URLs

slide-47
SLIDE 47

Gapz User-mode Payload Functionality

The module

  • verlord32(64).dll

is essential part of the Gapz bootkit Overlord32(64).dll is injected into svchost.exe process Overlord32(64).dll dispatches the requests from kernel-mode Cmd # Command Description gather information about all the network adapters installed in the system and their properties and send it to kernel-mode module 1 gather information on the presence of particular software in the system 2 check internet connection by trying to reach update.microsoft.com 3 send & receive data from a remote host using Windows sockets 4 get the system time from time.windows.com 5 get the host IP address given its domain name (via Win32 API gethostbyname) 6 get Windows shell (by means of querying “Shell” value of “Software\Microsoft\Windows NT\CurrentVersion\Winlogon” registry key)

slide-48
SLIDE 48

Gapz User-mode Payload Interface

Gapz impersonates the handler of the payload requests in the null.sys driver to communicate with the injected payload:

Win32/Gapz module Driver\Null DRIVER_OBJECT Driver\Null Driver Image

IRP_MJ_DEVICE_CONTROL

DriverUnload = NULL DriverUnload rotuine

IRP_MJ_DEVICE_CONTROL handler

Driver\Null DRIVER_OBJECT Driver\Null Driver Image

IRP_MJ_DEVICE_CONTROL

DriverUnload DriverUnload rotuine

IRP_MJ_DEVICE_CONTROL handler

Gapz’s hook

jmp gapz_hook

Payload interface before patching after patching

slide-49
SLIDE 49

Gapz User-mode Payload Interface

Gapz impersonates the handler of the payload requests in the null.sys driver to communicate with the injected payload:

Win32/Gapz module Driver\Null DRIVER_OBJECT Driver\Null Driver Image

IRP_MJ_DEVICE_CONTROL

DriverUnload = NULL DriverUnload rotuine

IRP_MJ_DEVICE_CONTROL handler

Driver\Null DRIVER_OBJECT Driver\Null Driver Image

IRP_MJ_DEVICE_CONTROL

DriverUnload DriverUnload rotuine

IRP_MJ_DEVICE_CONTROL handler

Gapz’s hook

jmp gapz_hook

Payload interface before patching after patching

slide-50
SLIDE 50

Modern bootkits comparison

Functionality Gapz Olmarik (TDL4) Rovnix (Cidox) Goblin (XPAJ) Olmasco (MaxSS)

MBR modification      VBR modification      Hidden file system type FAT32 custom FAT16 modification custom (TDL4 based) custom Crypto implementation AES-256, RC4, MD5, SHA1, ECC XOR/RC4 Custom (XOR+ROL)  RC6 modification Compression algorithm   aPlib aPlib  Custom TCP/IP network stack     

slide-51
SLIDE 51

Gapz: forensic approaches

slide-52
SLIDE 52

Hidden File System Reader

slide-53
SLIDE 53

Hidden File System Reader

slide-54
SLIDE 54

Hidden File System Reader

slide-55
SLIDE 55

HiddenFsReader: Free public forensic tool http://download.eset.com/special/ESETHfsReader.exe

slide-56
SLIDE 56

C++ code reconstruction problems

slide-57
SLIDE 57

C++ Code Reconstruction Problems

  • Object identification

 Type reconstruction

  • Class layout reconstruction

 Identify constructors/destructors  Identify class members  Local/global type reconstruction  Associate object with exact method calls

  • RTTI reconstruction

 Vftable reconstruction  Associate vftable object with exact object  Class hierarchy reconstruction

slide-58
SLIDE 58

C++ Code Reconstruction Problems

Class A vfPtr a1() a2() A::vfTable meta A::a1() A::a2() RTTI Object Locator signature pTypeDescriptor pClassDescriptor

slide-59
SLIDE 59

C++ Code Reconstruction Problems

slide-60
SLIDE 60

Identify Smart Pointer Structure

slide-61
SLIDE 61

Identify Exact Virtual Function Call in vtable

slide-62
SLIDE 62

Identify Exact Virtual Function Call in vtable

slide-63
SLIDE 63

Identify Exact Virtual Function Call in vtable

slide-64
SLIDE 64

Identify Objects Constructors

slide-65
SLIDE 65

Identify Objects Constructors

slide-66
SLIDE 66

Using Hex-Rays Decompiler

  • Identifying constructors/destructors

 Usually follow memory allocation  The pointer to object is passed in ecx (sometimes in other registers)

  • Reconstructing object’s attributes

 Creating custom type in “Local Types” for an object

  • Analyzing object’s methods

 Creating custom type in “Local Types” for a table of virtual routines

slide-67
SLIDE 67

Using Hex-Rays Decompiler

  • Identifying constructors/destructors

 Usually follow memory allocation  The pointer to object is passed in ecx (sometimes in other registers)

  • Reconstructing object’s attributes

 Creating custom type in “Local Types” for an object

  • Analyzing object’s methods

 Creating custom type in “Local Types” for a table of virtual routines

slide-68
SLIDE 68

Reconstructing Object’s Methods

slide-69
SLIDE 69

Reconstructing Object’s Methods

slide-70
SLIDE 70

Reconstructing Object’s Methods

slide-71
SLIDE 71

HexRaysCodeXplorer

slide-72
SLIDE 72

HexRaysCodeXplorer Features

  • Hex-Rays decompiler plugin
  • The plugin was designed to facilitate static

analysis of:

 object oriented code  position independent code

  • The plugin allows to:

 navigate through decompiled virtual methods  partially reconstruct object type

slide-73
SLIDE 73

Hex-Rays Decompiler Plugin SDK

  • At the heart of the decompiler lies ctree structure:

 syntax tree structure  consists of citem_t objects  there are 9 maturity levels of the ctree structure

slide-74
SLIDE 74

Hex-Rays Decompiler Plugin SDK

  • At the heart of the decompiler lies ctree structure:

 syntax tree structure  consists of citem_t objects  there are 9 maturity levels of the ctree structure

slide-75
SLIDE 75

Hex-Rays Decompiler Plugin SDK

  • Type citem_t is a base class for:

 cexpr_t – expression type  cinsn_t – statement type

  • Expressions have attached type information
  • Statements include:

 block, if, for, while, do, switch, return, goto, asm

  • Hex-Rays provides iterators for traversing the citem_t
  • bjects within ctree structure:

 ctree_visitor_t  ctree_parentee_t

citem_t cexpr_t cinsn_t

slide-76
SLIDE 76

Hex-Rays Decompiler Plugin SDK

  • Type citem_t is a base class for:

 cexpr_t – expression type  cinsn_t – statement type

  • Expressions have attached type information
  • Statements include:

 block, if, for, while, do, switch, return, goto, asm

  • Hex-Rays provides iterators for traversing the citem_t
  • bjects within ctree structure:

 ctree_visitor_t  ctree_parentee_t

citem_t cexpr_t cinsn_t

slide-77
SLIDE 77

HexRaysCodeXplorer: Gapz Position Independent Code

slide-78
SLIDE 78

HexRaysCodeXplorer: Virtual Methods

  • The IDA’s “Local Types” is used to represent object type
slide-79
SLIDE 79
  • Hex-Rays decompiler plugin is used to navigate through

the virtual methods

HexRaysCodeXplorer: Virtual Methods

slide-80
SLIDE 80
  • Hex-Rays decompiler plugin is used to navigate through

the virtual methods

HexRaysCodeXplorer: Virtual Methods

slide-81
SLIDE 81

DEMO

slide-82
SLIDE 82

HexRaysCodeXplorer: Object Type REconstruction

  • Hex-Rays’s ctree structure may be used to

partially reconstruct object type based on its initialization routine (constructor)

  • Input:

 pointer to the object instance  object initialization routine entry point

  • Output:

 C structure-like object representation

slide-83
SLIDE 83

HexRaysCodeXplorer: Object Type REconstruction

  • Hex-Rays’s ctree structure may be used to

partially reconstruct object type based on its initialization routine (constructor)

  • Input:

 pointer to the object instance  object initialization routine entry point

  • Output:

 C structure-like object representation

slide-84
SLIDE 84

HexRaysCodeXplorer: Object Type REconstruction

  • citem_t objects to monitor:

 memptr  idx  memref  call (LOBYTE, etc.)

slide-85
SLIDE 85

DEMO

slide-86
SLIDE 86

http://REhints.com

Follow us on twitter and github:  @REhints  https://github.com/REhints Beta testing will be open in July  send request to info@REhints.com

slide-87
SLIDE 87

References

 Gapz and Redyms droppers based on Power Loader code

http://www.welivesecurity.com/2013/03/19/gapz-and-redyms-droppers-based-on-power-loader-code/

 Mind the Gapz: The most complex bootkit ever analyzed?

http://www.welivesecurity.com/wp-content/uploads/2013/04/gapz-bootkit-whitepaper.pdf

 Modern Bootkit Trends: Bypassing Kernel-Mode Signing Policy

http://go.eset.com/us/resources/white-papers/Rodionov-Matrosov.pdf

 Defeating Anti-Forensics in Contemporary Complex Threats

http://go.eset.com/us/resources/white-papers/Matrosov_Rodionov_VB2012.pdf

 Bootkit Threats: In-Depth Reverse Engineering & Defense

http://www.welivesecurity.com/wp-content/media_files/REcon2012.pdf

slide-88
SLIDE 88
slide-89
SLIDE 89

Thank you for your attention!

Aleksandr Matrosov

@matrosov

Eugene Rodionov

@vxradius