ahm3dgg

Keybase proof

I hereby claim:

• I am ahm3dgg on github.
• I am ahm3dgg (https://keybase.io/ahm3dgg) on keybase.
• I have a public key whose fingerprint is FA0D BCB9 FB16 F819 5D65 BA44 53E5 BC39 DD58 4291

To claim this, I am signing this object:

ahm3dgg

#include <phnt_windows.h>
#include <phnt.h>
#include <cstdio>

#pragma comment(lib, "ntdll.lib")

#define NTCHECK(a) { Status = (a); if(!NT_SUCCESS(Status)) { ReportNTError(Status); return Status; } }

void ReportNTError(NTSTATUS Status)
{

ahm3dgg

#include <phnt_windows.h>
#include <phnt.h>
#include <cstdio>

#pragma comment(lib, "ntdll.lib")

#define NTCHECK(a) { Status = (a); if(!NT_SUCCESS(Status)) { ReportNTError(Status); return Status; } }

void ReportNTError(NTSTATUS Status)
{

ahm3dgg

// Bassicly I was thinking of a way to call LoadLibrary without having to let it load a file from disk, 
// however since it accepts a file path, I needed to work around that, for that part I was inspired by the doppelganging method, 
// and its use of Transactional NTFS, it works bassicaly like that

// - Create an NTFS Transaction
// - Create a File in that Transaction
// - Write the file (this can be embedded into the binary, received from the network, etc ...) into transacted file (only visible to our process)
// - from here we can actually just map the file as an image, and it will be marked as MEM_IMAGE
// - But we want to call LoadLibraryW

ahm3dgg

Fixing an APT sample so it can work on Modern Windows versions - An Exercise in Reverse Engineering

Sample

I stumbled upon an old miniduke APT malware, and found that it has some cool tricks, while I won't be explaining how the malware works or what it even does, I will be focusing on showing a code flaw in the sample, that was the reason for a crash that I found while debugging it on Windows 10, as well as showing how we can fix it, that requires some amount of reverse engineering and coding (I will use C & Assembly).

But to give you a quick introduction, that sample comes as 32-bit DLL file, with one export with name 'JorPglt', which is the start of payload, the sample also employs few simple (code mutation / instruction-level obfuscations) that we will discuss as well.

So without getting into much details here is where the code flaw resides

ahm3dgg

// https://www.vbsedit.com/html/6f28899c-d653-4555-8a59-49640b0e32ea.asp

#include <Windows.h>
#include <cstdio>

#define rcast reinterpret_cast

// IDA is the best.
typedef HRESULT(__stdcall* _Run)(
	void* _this,

ahm3dgg

{$AsmMode intel}

program PascalRizz;

uses Windows, SysUtils;

function Checksum(apiname: PChar): UInt32; assembler;
asm
                 mov esi, apiname

ahm3dgg

type
  TStub = record
    Name: string;
    Address: Pointer;
    SSN: integer;
  end;
  
  TStubMap = specialize TDictionary<string, TStub>; 
  
var