How to manually find kernel modules on Windows

KPCR -> KDVersionblock -> PsLoadedModuleList


http://memogaki.wordpress.com/2011/10/01/kpcr/
http://stackoverflow.com/questions/10690330/how-do-i-get-the-address-to-kernel-modules-nt-and-win32k

Windows Portable Executable (PE) Header

http://marcoramilli.blogspot.com/2010/12/windows-pe-header.html

Manually load entry point to memory after create process with suspended

// Create a child process with suspended 
    if( !CreateProcess(NULL,       /* No module name (use command line). */
                       filename,   /* Command line. */
                       NULL,       /* Process handle not inheritable. */
                       NULL,       /* Thread handle not inheritable. */
                       FALSE,      /* Set handle inheritance to FALSE. */
                       CREATE_SUSPENDED,          /*<----- Suspedned flag. */
                       NULL,       /* Use parent's environment block. */
                       NULL,       /* Use parent's starting directory. */
                       &si,        /* Pointer to STARTUPINFO structure. */
                       &pi)        /* Pointer to PROCESS_INFORMATION structure. */
                   ) printf("Error in CreateProcess\n\n");    

    printf("ProcessID of %d\n",pi.dwProcessId);

    // read the memory in child process
    ReadProcessMemory(pi.hProcess,entry_point, point, 1, NULL);


The reason you want to read the memory in child process is to load the process code into memory.

When parent process create a child process with suspended, it only load the image_base text into memory. In other words, the PE header ( MZ ) is present in memory.  It waits the child process to access its entry_point code. When the child process access the first byte of the entry point, it loads the whole page into memory, which contains the real code of the program.

Get the Entry Point of Executable in Windows

PEiD

http://www.softpedia.com/get/Programming/Packers-Crypters-Protectors/PEiD-updated.shtml

Heap Exploits

BlackHat 2009
https://www.blackhat.com/presentations/bh-usa-09/MCDONALD/BHUSA09-McDonald-WindowsHeap-PAPER.pdf

BlackHat 2010
http://illmatics.com/Understanding_the_LFH.pdf

Heap Overflow exploits

http://heapoverflow.com/

Traversal Widows Process List

Method1:
Using the PsActiveProcessList in EProcess structure

Method 2:
Using the Handle_Table structure in Eprocess structure, and traversal HandleTableList.

kd> dt _Handle_table 0xe1001cd0 

nt!_HANDLE_TABLE

   +0x000 TableCode        : 0xe1002000

   +0x004 QuotaProcess     : (null) 

   +0x008 UniqueProcessId  : 0x00000004 

   +0x00c HandleTableLock  : [4] _EX_PUSH_LOCK

   +0x01c HandleTableList  : _LIST_ENTRY [ 0xe1023e44 - 0x8055b548 ]

   +0x024 HandleContentionEvent : _EX_PUSH_LOCK

   +0x028 DebugInfo        : (null) 

   +0x02c ExtraInfoPages   : 0

   +0x030 FirstFree        : 0x2c4

   +0x034 LastFree         : 0

   +0x038 NextHandleNeedingPool : 0x800

   +0x03c HandleCount      : 252

   +0x040 Flags            : 0

   +0x040 StrictFIFO       : 0y0

Method3: 

Using the queues in scheduler.

Windows rootkits Collection

rootkits collection:

http://ping-of-death.blogspot.com/2009/07/edmunds-rootkit-collection-downloads-w.html

I was thinking of posting them individually, but I didn’t want it to be seen as “spamming”, so here’s all the rootkits I have. These are all RS downloads.
Almost all files are zipped.
Some are tar.gz and others .rar.
Happy Hacking.

Legend:
Rootkit name
Description
download link
————————————–
Vanquish Rootkit
Vanquish is a DLL injection based Romanian rootkit that hides files, folders, registry entries and logs passwords.

http://rapidshare.com/files/214735218/vanquish-0.2.1.zip

NT Rootkit
The original and first public NT ROOTKIT – has not been updated for many years but is good for ideas.

http://rapidshare.com/files/214735636/rk_044.zip

FU Rootkit
The FU rootkit can hide processes, elevate process privileges, fake out the Windows Event Viewer so that forensics is impossible, and even hide device drivers (NEW!). (Look, Mom, no hands!) It does all this by Direct Kernel Object Manipulation (TM); no hooking! This project has been evolving other time. It was originally conceived as a proof-of-concept. FU is a play on words from the UNIX program “su” used to elevate privilege.

http://rapidshare.com/files/214736334/FU_Rootkit.zip

WinLogonHijack Rootkit
Winlogonhijack injects a dll into winlogon.exe and hooks msgina.WlxLoggedOutSAS, logging every login in plaintext.

http://rapidshare.com/files/214736739/winlogonhijack-v0.3-src.rar

MyNetwork Rootkit
This ethernet bridge allows many subnets to connect to one another, supports a central server, and watches ARP and ethernet traffic to maintain a MAC-router table. (windows vc7++) requires winpcap

http://rapidshare.com/files/214737889/MyNetwork.zip

Vice Rootkit
VICE is a tool to find hooks.
Features include:
1. Looks for people hooking IAT’s.
2. Looks for people hooking functions in-line aka detouring.
3. Looks for hooks in the System Call Table. Thanks to Tan perhaps it will fix the table in the future.
4. Looks for detour hooks in the System Call Table functions themselves.
5. Looks for people hooking IRP_MJ table in drivers. This is configurable by driver.ini.

http://rapidshare.com/files/214738213/vice.zip

KIog Rootkit
Klog demonstrates how to use a kernel filter driver to implement a simple key logger.
[code]http://rapidshare.com/files/214738979/Klog_1.0.zip[/code

]AFX Rootkit '05
This OPEN SOURCE Delphi rootkit uses code injection and hooks Windows native API to hide processes, modules, handles, files, ports, registry keys, etc.

http://rapidshare.com/files/214739475/AFXRootkit2005.zip

SinAR Rootkit
A Cross architecture Solaris rootkit.

http://rapidshare.com/files/214740016/SInAR-0.1.tar.gz

Shadow Walker Rootkit
Shadow Walker as seen at Black Hat and Phrack 63.

http://rapidshare.com/files/214740632/Shadow_Walker_1.0.rar

CFSD Rootkit

FUTo Rootkit
FUTo is the successor of FU. Its accompanying research paper can be found at

www.uninformed.org

. FUTo currently hides from Blacklight and IceSword as of the initial release.

http://rapidshare.com/files/214741940/FUTo_enhanced.zip

WMFT

WMFT Rootkit
Windows Memory Forensic Toolkit (WMFT) is a collection of utilities intended for forensic use. WMFT can be used to perform forensic analysis of physical memory images acquired from Windows 2003/XP machines.

http://rapidshare.com/files/214742116/wmftv02.zip

RAIDE Rootkit remover
RAIDE stands for Rootkit Analysis Identification Elimination. RAIDE is a rootkit detection/removal tool.

http://rapidshare.com/files/214742492/RAIDE_BETA_1.zip

BootKitBasic RootKit
BOOT KIT is a project related to custom boot sector code subverting Windows NT Security Model.The sample presented currently keeps on escalating cmd.exe to system privileges every 30 secs.
It has several features
1) It's very small.The basic framework is just about 100 lines of assembly code.It supports 2000,XP,2003
2) It patches the kernel at runtime(no files are patched on disk).
3) BOOT KIT is PXE-compatible.
4)It can even lead to first ever PXE virus
5)It also enables you to load other root kits if you have physical access(Normally root kits can only be loaded by the administrator.

http://rapidshare.com/files/214742926/bootkitbasic.zip

Defrag Rootkit
Windows NT/2K/XP Defragmentierer fuer FAT12/16/32/NTFS-Partitione.

http://rapidshare.com/files/214743554/defragger30b_src.zip

Keyboard Hook
Ps/2 Keyboard Hook with only 1-bit in the Keyboard Controller.

http://rapidshare.com/files/214744072/Ps2_Keyboard_Polling.zip

And...
For fun...

CheatEngine
Cheat Engine is a tool designed to give you the upper hand in games, but also contains other usefull tools to help debugging games and even normal applications.

http://rapidshare.com/files/214744668/CheatEngine54src.rar

Just got done uploading all of these today, so there shouldn't be any broken links.
But if there is, let me know.

**THESE DO NOT CONTAIN VIRUSES**
THEY CONTAIN INACTIVE ROOTKITS
Until you activate them, that is...
Wouldn't run these on your PC.

All files should contain tutorials.
I'm not held responsible for what you do with these rootkits.

author : indounderground n phphack

How to Limit the Amount of Memory Available to OS

Linux:

set the mem=2000m as the boot arguments, then the Linux only use first 2000MB memory. If the total RAM is 2G, it reserves 48MB.
http://fengweizhang.blogspot.com/2012/06/boot-arguments-on-linux.html


Windows:

Add line
MaxPhyPage=0x7D000 
at [386enh] section of C:\WINDOWS\system.ini
0x7D000 * 4KB = 2000MB
http://support.microsoft.com/kb/181862

Backup by using rsync in Linux and Windows

In Linux: man rsync


rsync -r ../WorkSpace username@servername:/home/username/backup-machine

In Windows, you can use cygwin

1. Install cygwin

2. search rsync, and install rsync package

3. run rsync

rsync -r /cygdrive/c username@servername:/home/username/back-windows

Modify Executable in Windows

1. Download Hex Editor: HxD
http://download.cnet.com/HxD-Hex-Editor/3000-2352_4-10891068.html

2. Open the Executable by using HxD

3. Go the executable place you want to modify
For example (nasm format) :
66 BA 2F 05 : mov dx, 0x52f
66 EE : out dx, al

Assembly in Windows

1. Compiler: MASM 
download: http://www.masm32.com/
install it
it has an masm editor
it use NASM assembly, please use pcasm for reference
http://www.drpaulcarter.com/pcasm/
But it doesn't have the IO instruction in the book


2. Start with hello world program

include \masm32\include\masm32rt.inc  
.data
MyTitle db "ASM is Fun!",0
MyText db "I hope you're learning!",0
.codestart:
push 0
push offset MyTitle
push offset MyTextpush 0
call MessageBoxA
call ExitProcess
end start



URL: http://computertech.createmybb3.com/showthread.php?tid=105
http://www.youtube.com/watch?v=gklpZIVuTBY



3. Write your own program

.386
.model flat,stdcall
.code
start
mov dx, 1327
out dx, ax
end start



This program write port 0x52f It looks like MASM cannot use hex because I get compile error.



4. Run the Program 

AllowIo.exe WritePort.exe /a
write to port in Windows, please see my another article
http://fengweizhang.blogspot.com/2012/04/user-program-write-to-io-ports-on.html

Open an website fro command prompt

"c:\program files\internet exploder\iexplore.exe 'http://www.yahoo.com'"


"c:\program files\internet exploder\iexplore.exe ''C:\hello.html"

User program write to IO ports on Windows

http://retired.beyondlogic.org/porttalk/porttalk.htm

Download the PortTalk 2.2 folder.
Look at the README file, you will know how to use it.

C:\porttalk>allowio beep /a
allow program beep.exe to write all the ports

C:\porttalk\AllowIO>allowio 0x42 0x43 0x61 beep.exe
allow the beep.exe to access port 0x42 0x43 and 0x61


Look at the IoExample folder, you will know how to write the sample user program to write ports.

In addition, we could use assembly IO instruction to write to port.
out dx, al
compile the assembly code into WritePort.exe file, and use AllowIo.exe to set the bitmap permission for this executable program
AllowIo.exe WritePort.exe /a

Again, AllowIo.exe provides the facility to modify the IO permission bitmap and write/read to IO ports via IOCTL calls.

Memory tool on Windows

vmmap
http://technet.microsoft.com/en-us/sysinternals/dd535533
cheatengine
http://www.cheatengine.org/

Run Python on Windows

1. Download the python
http://python.org/download/

2. Install it. it ususally installed at C:\Python27

3. Run it need to add the C:\Python27 to the PATH environment variable.
http://docs.python.org/faq/windows.html#how-do-i-run-a-python-program-under-windows
Add

;C:\Python23

to the PAHT environment variable at
properties window of “My Computer” under the “Advanced” tab

4. Type python from the command line

Disable PAE on Windows XP SP3

Go to computer -> properties, it will show in the hardware specification if the PAE enabled.
Enabling PAE (by setting bit 5, PAE, of the system register CR4), which is the sixth bit from the left. 

Disable method:

Normal boot.ini with PAE & DEP

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Pro x86" /noexecute=optin /fastdetect

Disabled DEP & PAE

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Pro x86" /execute /fastdetect

__________________

How to find PsActiveProcessHead in memory on Windows

PsActiveProcessHead is a pointer to the start of the kerne's list of _EPROCESS structures.

1. Get the FS register value: 0xffdff000, which points to the Kernel Processor Control Region (KPCR) structure

2. KDVersionBlock is at the offset 0x34 of KPCR

3. Get the KdVersionBlock value: 0x8054c738 (run x /20w 0xffdff034 in QEMU monitor)

4. PsActiveProcessHead is at the offset 0x78 of KdVersionBlock, which is at location 0x8054c7b0

5. Get the PsActiveProcessHead value: 0x80560bd8 ( run x /20w 0x8054c7b0)

6. See the LIST_ENTRY field of PsActiveProcessHead, and it is a double linked list.
7. See the process name ( run x /20c location)

More Info:

http://www.reverse-engineering.info/SystemInformation/GetVarXP.pdf

SMM on Windows

http://ivanlef0u.fr/repo/todo/chpie_smm_keysniff_ENG.pdf

Get MAC address of Windows

ipconfig \all

set domain in XP

My computer -> Properties -> System properties -> Comupter Name -> Change Domain

For exmaple, you are in a Company, after you install a new OS, you need to set the correct domain of your company. You add it form here, then restart your machine.

After you restart your machine, you need to add your comany account into administor account.
Go to Control panel -> account -> add account

Then you can switch user. Logout, and login use your company username and password

Note: this is for my expeirence on XP