Skip to content

Commit 86dc487

Browse files
tandasattandasat
committed
Add x64 support
1 parent f2a99b6 commit 86dc487

27 files changed

+3193
-1850
lines changed

‎README.md‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,18 @@ thread context manipulation.
99
A supporting tool 'injector' is a sample program doing that type of code
1010
injection.
1111

12-
A related blog entory can be found [here](http://standa-note.blogspot.ca/2015/03/section-based-code-injection-and-its.html).
12+
A related blog entory can be found here:
13+
14+
http://standa-note.blogspot.ca/2015/03/section-based-code-injection-and-its.html).
1315

1416
Installation and Uninstallation
1517
-----------------
1618

17-
Use the 'sc' command, for example, for installation:
19+
Get an archive file for compiled files form this link:
20+
21+
https://github.com/tandasat/RemoteWriteMonitor/releases/latest
22+
23+
Then use the 'sc' command. For installation:
1824

1925
>sc create rwmon type= kernel binPath= C:\Users\user\Desktop\RemoteWriteMonitor.sys
2026
>sc start rwmon
@@ -23,6 +29,16 @@ For uninstallation:
2329

2430
>sc stop rwmon
2531
>sc delete rwmon
32+
33+
On the x64 bit platform, you have to enable test signing to install the driver.
34+
To do that, open the command prompt with the administrator privilege and type
35+
the following command:
36+
37+
>bcdedit /set {current} testsigning on
38+
39+
Then, reboot the system to activate the change. You also have to disable the
40+
Kernel Patch Protection (PatchGuard), and Google helps you do that work.
41+
2642

2743
Usage
2844
-------
@@ -36,8 +52,8 @@ what was written or mapped into the remote process. Output can be seen with
3652
DebugView and are all saved under the C:\Windows\RemoteWriteMonitor\
3753
directory. Written and mapped data is stored as \<SHA1\>.bin apart from a log file.
3854

39-
'injector' could be used to test the driver's function. Injecting and executing code into
40-
notepad.exe could be done by the following commands:
55+
'injector' could be used to test the driver's function. Injecting and executing
56+
code into notepad.exe can be done by the following commands:
4157

4258
>notepad && tasklist | findstr notepad
4359
notepad.exe 3368 Console 1 4,564 K
@@ -54,6 +70,9 @@ notepad.exe could be done by the following commands:
5470
Output on DebugView would look like this:
5571
![DebugView](/img/injector.png)
5672

73+
Note that the injector only works against 32 bit processes.
74+
75+
5776
Caveats
5877
-------
5978
- It reports all those API calls regardless of its memory protection, contents
@@ -62,7 +81,7 @@ output related to the sample you are analyzing as it reports a lot of legit
6281
activities too.
6382

6483
- It was designed so because it is far more difficult to track all written
65-
regions and reports only when it is executed (I wrote [it](https://sites.google.com/site/tandasat/home/egg) long time ago, and it was hell).
84+
regions and reports only when it is executed.
6685

6786
- It does not monitor any of processes existed when the driver was installed.
6887
Thus, the second injection will not be reported if the sample injects code
@@ -79,7 +98,7 @@ may be happening.
7998

8099
Supported Platform(s)
81100
-----------------
82-
- Windows 7 SP1 x86
101+
- Windows 7 SP1 and 8.1 (x86/x64)
83102

84103

85104
License

‎RemoteWriteMonitor/Release/RemoteWriteMonitor.sys‎

-11.5 KB
Binary file not shown.

‎RemoteWriteMonitor/Release/injector.exe‎

-22.5 KB
Binary file not shown.

‎RemoteWriteMonitor/RemoteWriteMonitor.sln‎

Lines changed: 71 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,71 @@
1-
2-
Microsoft Visual Studio Solution File, Format Version 12.00
3-
# Visual Studio 2013
4-
VisualStudioVersion = 12.0.31101.0
5-
MinimumVisualStudioVersion = 10.0.40219.1
6-
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RemoteWriteMonitor", "RemoteWriteMonitor\RemoteWriteMonitor.vcxproj", "{287B2687-2894-4AA5-A5A9-686AE6C5F34A}"
7-
EndProject
8-
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "injector", "injector\injector.vcxproj", "{FEE34C62-A273-4557-BF93-360BDA2855E5}"
9-
EndProject
10-
Global
11-
GlobalSection(SolutionConfigurationPlatforms) = preSolution
12-
Debug|Win32 = Debug|Win32
13-
Release|Win32 = Release|Win32
14-
EndGlobalSection
15-
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16-
{287B2687-2894-4AA5-A5A9-686AE6C5F34A}.Debug|Win32.ActiveCfg = Debug|Win32
17-
{287B2687-2894-4AA5-A5A9-686AE6C5F34A}.Debug|Win32.Build.0 = Debug|Win32
18-
{287B2687-2894-4AA5-A5A9-686AE6C5F34A}.Release|Win32.ActiveCfg = Release|Win32
19-
{287B2687-2894-4AA5-A5A9-686AE6C5F34A}.Release|Win32.Build.0 = Release|Win32
20-
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Debug|Win32.ActiveCfg = Debug|Win32
21-
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Debug|Win32.Build.0 = Debug|Win32
22-
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Release|Win32.ActiveCfg = Release|Win32
23-
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Release|Win32.Build.0 = Release|Win32
24-
EndGlobalSection
25-
GlobalSection(SolutionProperties) = preSolution
26-
HideSolutionNode = FALSE
27-
EndGlobalSection
28-
EndGlobal
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 2013
4+
VisualStudioVersion = 12.0.31101.0
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RemoteWriteMonitor", "RemoteWriteMonitor\RemoteWriteMonitor.vcxproj", "{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}"
7+
EndProject
8+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "injector", "injector\injector.vcxproj", "{FEE34C62-A273-4557-BF93-360BDA2855E5}"
9+
EndProject
10+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{94B67B9C-4EA6-4F4D-A1B2-51035E1CF277}"
11+
ProjectSection(SolutionItems) = preProject
12+
..\README.md = ..\README.md
13+
EndProjectSection
14+
EndProject
15+
Global
16+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
17+
Win7 Debug|Win32 = Win7 Debug|Win32
18+
Win7 Debug|x64 = Win7 Debug|x64
19+
Win7 Release|Win32 = Win7 Release|Win32
20+
Win7 Release|x64 = Win7 Release|x64
21+
Win8.1 Debug|Win32 = Win8.1 Debug|Win32
22+
Win8.1 Debug|x64 = Win8.1 Debug|x64
23+
Win8.1 Release|Win32 = Win8.1 Release|Win32
24+
Win8.1 Release|x64 = Win8.1 Release|x64
25+
EndGlobalSection
26+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
27+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Debug|Win32.ActiveCfg = Win7 Debug|Win32
28+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Debug|Win32.Build.0 = Win7 Debug|Win32
29+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Debug|Win32.Deploy.0 = Win7 Debug|Win32
30+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Debug|x64.ActiveCfg = Win7 Debug|x64
31+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Debug|x64.Build.0 = Win7 Debug|x64
32+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Debug|x64.Deploy.0 = Win7 Debug|x64
33+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Release|Win32.ActiveCfg = Win7 Release|Win32
34+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Release|Win32.Build.0 = Win7 Release|Win32
35+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Release|Win32.Deploy.0 = Win7 Release|Win32
36+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Release|x64.ActiveCfg = Win7 Release|x64
37+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Release|x64.Build.0 = Win7 Release|x64
38+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win7 Release|x64.Deploy.0 = Win7 Release|x64
39+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Debug|Win32.ActiveCfg = Win8.1 Debug|Win32
40+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Debug|Win32.Build.0 = Win8.1 Debug|Win32
41+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Debug|Win32.Deploy.0 = Win8.1 Debug|Win32
42+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Debug|x64.ActiveCfg = Win8.1 Debug|x64
43+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Debug|x64.Build.0 = Win8.1 Debug|x64
44+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Debug|x64.Deploy.0 = Win8.1 Debug|x64
45+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Release|Win32.ActiveCfg = Win8.1 Release|Win32
46+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Release|Win32.Build.0 = Win8.1 Release|Win32
47+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Release|Win32.Deploy.0 = Win8.1 Release|Win32
48+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Release|x64.ActiveCfg = Win8.1 Debug|x64
49+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Release|x64.Build.0 = Win8.1 Debug|x64
50+
{987A0E0D-CF4E-4DC8-A5FE-1CCCC3D75082}.Win8.1 Release|x64.Deploy.0 = Win8.1 Debug|x64
51+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win7 Debug|Win32.ActiveCfg = Debug|Win32
52+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win7 Debug|Win32.Build.0 = Debug|Win32
53+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win7 Debug|Win32.Deploy.0 = Debug|Win32
54+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win7 Debug|x64.ActiveCfg = Debug|x64
55+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win7 Release|Win32.ActiveCfg = Release|Win32
56+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win7 Release|Win32.Build.0 = Release|Win32
57+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win7 Release|Win32.Deploy.0 = Release|Win32
58+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win7 Release|x64.ActiveCfg = Release|x64
59+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win8.1 Debug|Win32.ActiveCfg = Debug|Win32
60+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win8.1 Debug|Win32.Build.0 = Debug|Win32
61+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win8.1 Debug|Win32.Deploy.0 = Debug|Win32
62+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win8.1 Debug|x64.ActiveCfg = Debug|x64
63+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win8.1 Release|Win32.ActiveCfg = Release|Win32
64+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win8.1 Release|Win32.Build.0 = Release|Win32
65+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win8.1 Release|Win32.Deploy.0 = Release|Win32
66+
{FEE34C62-A273-4557-BF93-360BDA2855E5}.Win8.1 Release|x64.ActiveCfg = Release|x64
67+
EndGlobalSection
68+
GlobalSection(SolutionProperties) = preSolution
69+
HideSolutionNode = FALSE
70+
EndGlobalSection
71+
EndGlobal

‎RemoteWriteMonitor/RemoteWriteMonitor/Arch/AMD64/amd64.asm‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
;
2+
; This module implements the lowest part of hook handlers
3+
;
4+
5+
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6+
.CONST
7+
8+
9+
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
10+
.DATA
11+
12+
13+
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
14+
.CODE
15+
16+
17+
; Implements jump to an arbitrary location without modifying registers.
18+
; 0ffffffffffffffffh is used as a mark to be replaced with a correct address.
19+
JMP_TEMPLATE MACRO
20+
nop ; This is space for implanting int 3 for debugging
21+
jmp qword ptr [jmp_address]
22+
jmp_address:
23+
dq 0ffffffffffffffffh
24+
ENDM
25+
26+
27+
28+
AsmNtMapViewOfSection_Win81_7 PROC
29+
mov qword ptr [rsp+10h], rbx
30+
mov qword ptr [rsp+18h], rsi
31+
mov qword ptr [rsp+8h], rcx
32+
push rdi
33+
JMP_TEMPLATE
34+
AsmNtMapViewOfSection_Win81_7 ENDP
35+
AsmNtMapViewOfSection_Win81_7End PROC
36+
nop
37+
AsmNtMapViewOfSection_Win81_7End ENDP
38+
39+
40+
; For Win 8.1
41+
AsmNtWriteVirtualMemory_Win81 PROC
42+
sub rsp, 38h
43+
mov rax, [rsp+60h]
44+
mov dword ptr [rsp+28h], 20h
45+
mov [rsp+20h], rax
46+
JMP_TEMPLATE
47+
AsmNtWriteVirtualMemory_Win81 ENDP
48+
AsmNtWriteVirtualMemory_Win81End PROC
49+
nop
50+
AsmNtWriteVirtualMemory_Win81End ENDP
51+
52+
53+
; For Win 7
54+
AsmNtWriteVirtualMemory_Win7 PROC
55+
mov rax, rsp
56+
mov qword ptr [rax+8h], rbx
57+
mov qword ptr [rax+10h], rsi
58+
mov qword ptr [rax+18h], rdi
59+
mov qword ptr [rax+20h], r12
60+
JMP_TEMPLATE
61+
AsmNtWriteVirtualMemory_Win7 ENDP
62+
AsmNtWriteVirtualMemory_Win7End PROC
63+
nop
64+
AsmNtWriteVirtualMemory_Win7End ENDP
65+
66+
67+
68+
END

‎RemoteWriteMonitor/RemoteWriteMonitor/Arch/x86/asm.cpp‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Copyright (c) 2015, tandasat. All rights reserved.
2+
// Use of this source code is governed by a MIT-style license that can be
3+
// found in the LICENSE file.
4+
5+
//
6+
//
7+
//
8+
#include "stdafx.h"
9+
#include "../../asm.h"
10+
11+
////////////////////////////////////////////////////////////////////////////////
12+
//
13+
// macro utilities
14+
//
15+
16+
////////////////////////////////////////////////////////////////////////////////
17+
//
18+
// constants and macros
19+
//
20+
21+
////////////////////////////////////////////////////////////////////////////////
22+
//
23+
// types
24+
//
25+
26+
////////////////////////////////////////////////////////////////////////////////
27+
//
28+
// prototypes
29+
//
30+
31+
////////////////////////////////////////////////////////////////////////////////
32+
//
33+
// variables
34+
//
35+
36+
////////////////////////////////////////////////////////////////////////////////
37+
//
38+
// implementations
39+
//
40+
41+
EXTERN_C void AsmNtMapViewOfSection_Win81_7(){};
42+
43+
EXTERN_C void AsmNtMapViewOfSection_Win81_7End(){};
44+
45+
EXTERN_C void AsmNtWriteVirtualMemory_Win81(){};
46+
47+
EXTERN_C void AsmNtWriteVirtualMemory_Win81End(){};
48+
49+
EXTERN_C void AsmNtWriteVirtualMemory_Win7(){};
50+
51+
EXTERN_C void AsmNtWriteVirtualMemory_Win7End(){};

0 commit comments

Comments
 (0)