4 ms·
Statically linked binaries aren’t exactly a “thing” on Windows... https://reverseengineering.stackexchange.com/questions/2070/can-i-statically-link-not-import-t
by lstamour 7y ago
Statically linked binaries aren’t exactly a “thing” on Windows... https://reverseengineering.stackexchange.com/questions/2070/can-i-statically-link-not-import-the-windows-system-dlls https://reverseengineering.stackexchange.com/questions/2070/... It appears to patch the SSDT table to intercept system calls to the kernel, and based on forum thread titles, has been caught by PatchGuard in Windows before, but I haven’t investigated myself.
From what I can tell, once a privileged process like a kernel driver, starts messing with memory it doesn’t own, like SSDT tables and loaded user-land DLLs, well, game’s over as far as system integrity’s concerned. PatchGuard does integrity checking, but I presume given how common it is, there are known ways to fool it or disable it, perhaps by poisoning whatever it uses to check the SSDT memory.
Interesting variations on this technique might be https://github.com/tandasat/DdiMon https://github.com/tandasat/DdiMon and https://github.com/tandasat/SimpleSvmHook https://github.com/tandasat/SimpleSvmHook
In terms of defense, there’s https://github.com/IgorKorkin/MemoryRanger https://github.com/IgorKorkin/MemoryRanger
And for an organized list of far too many examples for me to feel safe, there’s https://github.com/ExpLife0011/awesome-windows-kernel-security-development https://github.com/ExpLife0011/awesome-windows-kernel-securi... (Note: over half of the links I clicked at random had Chinese github commit text or readmes, presumably the list author is either searching Github by function calls or understands Chinese...) Less organized for obvious reasons, but this list of 199 starred projects might also be worth a look https://github.com/dmaynor?tab=stars https://github.com/dmaynor?tab=stars which in turn pointed me to https://github.com/Hack-with-Github/Awesome-Hacking https://github.com/Hack-with-Github/Awesome-Hacking
And if you like this, you’ll probably also like: https://news.ycombinator.com/item?id=21481598 https://news.ycombinator.com/item?id=21481598