• VMP3.6的反调试和反虚拟机

    背景

    看雪上有人泄露了3.6.0.1406，第一时间先下载下来，然后加壳之后扔进x32dbg，A debugger has been found.......

     还能怎么办？右键回收站。

     分析

    正准备放弃的时候，想了想要不在看看，好吧那就在看看，结果一段瞎分析之后定位到了scylla没有处理完善的函数NtQueryInformationThread和QueryInformationProcess

    1. HookNtQueryInformationThread ThreadHideFromDebugger 
    2. HookNtQueryInformationProcess ProcessDebugPort 
    3. HookNtQueryInformationProcess ProcessDebugObjectHandle 
    4. HookNtQueryInformationProcess ProcessDebugPort

    你问我怎么定位的，全是某牛姓男子给我说的，还有需要注意的是这些api下执行是不会断下的，因为它自己shadow了一份systemcall。

    R3的反调试，在scylla配置如下的情况下，添加下面的代码(不管你是inline，vt，ifhook都可以，反正蓝的也不是我的电脑)

    在内核的处理逻辑如下(都是最简单的返回，有的情况下返回是错误的)

    1. NTSTATUS HookNtQueryInformationProcess(
    2. 	HANDLE           ProcessHandle,
    3. 	PROCESSINFOCLASS ProcessInformationClass,
    4. 	PVOID            ProcessInformation,
    5. 	ULONG            ProcessInformationLength,
    6. 	PULONG           ReturnLength
    7. ) {
    8. 	
    9. 	UCHAR* fileName = PsGetProcessImageFileName(PsGetCurrentProcess());
    10.  
    11. 	if (memcmp((const char*)fileName, "SuperKiller",strlen("SuperKiller")) == 0 && ExGetPreviousMode() == UserMode)//最新的3.6
    12. 	{
    13.  
    14. 		if (ProcessInformationLength != 0)
    15. 		{
    16. 			__try
    17. 			{
    18. 				ProbeForRead(ProcessInformation, ProcessInformationLength, 4);
    19. 				if (ReturnLength != 0)
    20. 					ProbeForWrite(ReturnLength, 4, 1);
    21. 			}
    22.  
    23. 			__except (EXCEPTION_EXECUTE_HANDLER)
    24. 			{
    25. 				return GetExceptionCode();
    26. 			}
    27. 		}
    28.  
    29.  
    30. 		if (ProcessInformationClass == ProcessDebugObjectHandle)
    31. 		{
    32. 			DbgPrint("HookNtQueryInformationProcess ProcessDebugObjectHandle \n");
    33. 			PEPROCESS TargetProcess;
    34. 			NTSTATUS Status = ObReferenceObjectByHandle(ProcessHandle, 0x0400, *PsProcessType, UserMode, (PVOID*)& TargetProcess, NULL);
    35. 			if (NT_SUCCESS(Status) == TRUE)
    36. 			{
    37. 				__try
    38. 				{
    39. 					*(ULONG64*)ProcessInformation = NULL;
    40. 					if (ReturnLength != NULL)* ReturnLength = sizeof(ULONG64);
    41.  
    42. 					Status = STATUS_PORT_NOT_SET;
    43. 				}
    44.  
    45. 				__except (EXCEPTION_EXECUTE_HANDLER)
    46. 				{
    47. 					Status = GetExceptionCode();
    48. 				}
    49.  
    50. 				ObDereferenceObject(TargetProcess);
    51. 				return Status;
    52. 			}
    53. 			return Status;
    54. 		}
    55.  
    56.  
    57. 		else if (ProcessInformationClass == ProcessDebugPort)
    58. 		{
    59. 			DbgPrint("HookNtQueryInformationProcess ProcessDebugPort \n");
    60. 			if (ProcessInformationLength != sizeof(ULONG64))
    61. 				return STATUS_INFO_LENGTH_MISMATCH;
    62.  
    63. 			PEPROCESS TargetProcess;
    64. 			NTSTATUS Status = ObReferenceObjectByHandle(ProcessHandle, 0x0400, *PsProcessType, UserMode, (PVOID*)& TargetProcess, NULL);
    65. 			if (NT_SUCCESS(Status) == TRUE)
    66. 			{
    67. 				__try
    68. 				{
    69. 					*(ULONG64*)ProcessInformation = 0;
    70. 					if (ReturnLength != 0)
    71. 						* ReturnLength = sizeof(ULONG64);
    72. 				}
    73. 				__except (EXCEPTION_EXECUTE_HANDLER)
    74. 				{
    75. 					Status = GetExceptionCode();
    76. 				}
    77.  
    78. 				ObDereferenceObject(TargetProcess);
    79. 				return Status;
    80. 			}
    81. 			return Status;
    82. 		}
    83. 		
    84. 		else if (ProcessInformationClass == ProcessDebugFlags)
    85. 		{
    86. 			DbgPrint("HookNtQueryInformationProcess ProcessDebugFlags \n");
    87. 			if (ProcessInformationLength != 4)
    88. 				return STATUS_INFO_LENGTH_MISMATCH;
    89.  
    90. 			PEPROCESS TargetProcess;
    91. 			NTSTATUS Status = ObReferenceObjectByHandle(ProcessHandle, 0x0400, *PsProcessType, UserMode, (PVOID*)& TargetProcess, NULL);
    92. 			if (NT_SUCCESS(Status) == TRUE)
    93. 			{
    94. 				__try
    95. 				{
    96. 					*(ULONG*)ProcessInformation = 0;
    97. 					if (ReturnLength != 0)
    98. 						* ReturnLength = sizeof(ULONG);
    99. 				}
    100. 				__except (EXCEPTION_EXECUTE_HANDLER)
    101. 				{
    102. 					Status = GetExceptionCode();
    103. 				}
    104.  
    105. 				ObDereferenceObject(TargetProcess);
    106. 				return Status;
    107. 			}
    108.  
    109. 			return Status;
    110. 		}
    111.  
    112. 		else if (ProcessInformationClass == ProcessBreakOnTermination)
    113. 		{
    114. 			DbgPrint("HookNtQueryInformationProcess ProcessBreakOnTermination \n");
    115. 			if (ProcessInformationLength != 4)
    116. 				return STATUS_INFO_LENGTH_MISMATCH;
    117.  
    118. 			PEPROCESS TargetProcess;
    119. 			NTSTATUS Status = ObReferenceObjectByHandle(ProcessHandle, 0x1000, *PsProcessType, UserMode, (PVOID*)& TargetProcess, NULL);
    120. 			if (NT_SUCCESS(Status) == TRUE)
    121. 			{
    122. 				__try
    123. 				{
    124. 					*(ULONG*)ProcessInformation = 0;
    125. 					if (ReturnLength != 0)
    126. 						* ReturnLength = sizeof(ULONG);
    127. 				}
    128. 				__except (EXCEPTION_EXECUTE_HANDLER)
    129. 				{
    130. 					Status = GetExceptionCode();
    131. 				}
    132.  
    133. 				ObDereferenceObject(TargetProcess);
    134. 				return Status;
    135. 			}
    136.  
    137. 			return Status;
    138. 		}
    139. 	}
    140.  
    141. 	return ((PNtQueryInformationProcess)g_jmpNtQueryInformationProcess)(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength);
    142. }
    143.  
    144.  
    145. NTSTATUS HookNtQueryInformationThread(
    146. 	HANDLE          ThreadHandle,
    147. 	THREADINFOCLASS ThreadInformationClass,
    148. 	PVOID           ThreadInformation,
    149. 	ULONG           ThreadInformationLength,
    150. 	PULONG          ReturnLength
    151. ) {
    152. 	UCHAR* fileName = PsGetProcessImageFileName(PsGetCurrentProcess());
    153.  
    154. 	if (memcmp((const char*)fileName, "SuperKiller", strlen("SuperKiller")) == 0 && ExGetPreviousMode() == UserMode)//最新的3.6
    155. 	{
    156. 		if (ThreadInformationLength != 0)
    157. 		{
    158. 			__try
    159. 			{
    160. 				ProbeForRead(ThreadInformation, ThreadInformationLength, 4);
    161. 				if (ReturnLength != 0)
    162. 					ProbeForWrite(ReturnLength, 4, 1);
    163.  
    164. 			}
    165. 			__except (EXCEPTION_EXECUTE_HANDLER)
    166. 			{
    167. 				return GetExceptionCode();
    168. 			}
    169. 		}
    170.  
    171. 		if (ThreadInformationClass == ThreadHideFromDebugger)
    172. 		{
    173. 			DbgPrint("HookNtQueryInformationThread ThreadHideFromDebugger \n");
    174. 			if (ThreadInformationLength != 1)
    175. 				return STATUS_INFO_LENGTH_MISMATCH;
    176.  
    177. 			PETHREAD TargetThread;
    178. 			NTSTATUS Status = ObReferenceObjectByHandle(ThreadHandle, 0x40, *PsThreadType, UserMode, (PVOID*)& TargetThread, NULL);
    179. 			if (NT_SUCCESS(Status) == TRUE)
    180. 			{
    181. 				__try
    182. 				{
    183. 					*(BOOLEAN*)ThreadInformation =0;
    184.  
    185. 					if (ReturnLength != 0)* ReturnLength = 1;
    186. 				}
    187. 				__except (EXCEPTION_EXECUTE_HANDLER)
    188. 				{
    189. 					Status = GetExceptionCode();
    190. 				}
    191.  
    192. 				ObDereferenceObject(TargetThread);
    193. 				return Status;
    194. 			}
    195.  
    196. 			return Status;
    197. 		}
    198.  
    199. 	}
    200. 	return ((PNtQueryInformationThread)g_jmpNtQueryInformationThread)(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength);
    201. }

    R0的反调试，都是直接返回失败

    1. NTSTATUS HookNtQuerySystemInformation(
    2. 	SYSTEM_INFORMATION_CLASS SystemInformationClass,
    3. 	PVOID                    SystemInformation,
    4. 	ULONG                    SystemInformationLength,
    5. 	PULONG                   ReturnLength
    6. ) {
    7. 	if(SystemInformationClass ==  SystemKernelDebuggerInformation || SystemInformationClass == SystemKernelDebuggerInformationEx || SystemCodeIntegrityInformation == SystemInformationClass || ProcessDebugObjectHandle == SystemInformationClass)
    8. 		return STATUS_UNSUCCESSFUL;
    9.  
    10. 	return ((PNtQuerySystemInformation)g_jmpNtQuerySystemInformation)(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
    11. }

    反虚拟机

    1、需要处理的是cpuid，代码是抄的别人写的vt，随便改改

    Registers->Rcx = (ULONG_PTR)dwCpuidRegisters.ecx & 0xFFFFFFFF7FFFFFFF;//绕过vmp的虚拟机检测

    2、需要注意中断，如果用的vthook，需要判断当前的tf标志位

    1. if (GuestRflag.fields.tf)
    2. {
    3. ULONG64 info = 0;
    4. // 注入一个硬件调试中断
    5. InjectInterruption(kHardwareException, EXCEPTION_VECTOR_DEBUG, false, 0);
    6. info = VmxCsRead(GUEST_INTERRUPTIBILITY_INFO);
    7. info &= ~2;
    8. VmxCsWrite(GUEST_INTERRUPTIBILITY_INFO, info);
    9. }

    3、NtQuerySystemInformation的处理，比3.5多了一个BMSR

    1. NTSTATUS HookNtQuerySystemInformation(
    2. 	SYSTEM_INFORMATION_CLASS SystemInformationClass,
    3. 	PVOID                    SystemInformation,
    4. 	ULONG                    SystemInformationLength,
    5. 	PULONG                   ReturnLength
    6. ) {
    7. 	if (SystemInformationClass == SystemFirmwareTableInformation && SystemInformation)
    8. 	{
    9. 		__try
    10. 		{
    11. 			if (*(PULONG)SystemInformation == 0x4649524d || *(PULONG)SystemInformation == 0x52534d42)//MRIF BMSR
    12. 			{
    13. 				return STATUS_UNSUCCESSFUL;
    14. 			}
    15. 		}
    16. 		__except (EXCEPTION_EXECUTE_HANDLER) {}
    17. 	}
    18.  
    19. 	return ((PNtQuerySystemInformation)g_jmpNtQuerySystemInformation)(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
    20. }

    结束

    做完上面的准备工作，vmp3.6就能在虚拟机正常被调试了，这些都是某牛姓男子教的，我啥也不会！我是真菜啊！

  • 相关阅读:
    近期的一些小总结（关于TCP/IP协议相关的）
    Rancher清理节点
    python列表操作
    [附源码]java毕业设计ssm酒店综合管理平台
    视频通话中的Camera操作
    Pycharm配置Git以及Gitee实现代码管理（全网最详细）
    Spring依赖注入的简介说明
    深度学习——嵌入矩阵and学习词嵌入andWord2Vec
    高通导航器软件开发包使用指南（7）
    概率论的一些知识
  • 原文地址：https://blog.csdn.net/lyshark_lyshark/article/details/126792454