Rootkit Unhooker v3.8 It's Past, Present and Future of the NTx86 Rootkit Detection

By: DiabloNova
Rootkit Unhooker v3.8
It's Past, Present and
Future of the NTx86 Rootkit Detection

Contents:

1) RKU short
overview (Past)
2) New features of the 3.8 (Present)
3) Perspectives
(Future)

******RKU short overview******

Rootkit Unhooker is enough
known for specialists (and not only) rootkit detection and removal software
developed since 2006 by group of independent people who are NOT related or
affiliated with commercial security companies or malicious software coders
groups.

RKU main goal was always not simple reveal rootkits, but
effectively counteracts with them, resulting in rootkits removal with help of
RKU. Due to implementation specific, this rootkit detection software is able to
reveal most of well-known rootkit technologies implemented in both user and
kernel mode of the NT core based operation systems such as Windows 2000, XP,
2003, Vista, 2008. RKU main features are: detection of different type of hooks
(just as example: most common used splicing, Import table patching, Export table
patching, DKOH, (S)SSDT patching, IDT manipulation etc), successful removal most
of them (if they of course can be removed and doesn’t restoring), detection of
the other hidden stuff such as processes, drivers, files, alternate data streams
stealth code working in kernel mode, internal system mismatches and more and
more, where main goals of each part was and will be deeper technical realization
of each feature. You can read full list of features inside RKU help so let us do
not waste our time and continue to more interesting stuff.

Originally,
program development started in the end 2005 beginning of the 2006 as
proof-of-concept project. With time it has become more than just simple PoC as
many others antirootkits/rootkit detectors (for example klister, DarkSpy and
many many others). Its target was always wide sphere of activity, where each
part of detection implemented well-enough, in the beginning for the detection of
all-available proof-of-concepts rootkits and their technologies, further for the
detection and removal of the existent and dramatically quickly evolving
malicious software such as never-ending bots with rootkit components. Little
time after born this project was open source (until 2.0.40 version). The first
appearance of this software was on SysInternals forums, now they are part of the
Microsoft Technet. Well we will return to this part soon lately.

This
project was always fully FREEWARE and free from any kind of specially created
backdoors or “easter“ eggs. Since 2007 RKU divides on the two different parts,
LE and VX, where LE stands for Lite Edition and VX for Veritable eXtended
version. Their main difference initially was not only the level of features they
are provides, but also their future development. For example, it has claimed
that LE is the last public available Rootkit Unhooker version due to numerous
reasons and its development will be soon completely over. And this exactly is
happened, 4 October 2007 was released last version of public RKU labeled as 3.7.
The reasons of this were said many times before and we see no points in
repeating them again.

Unfortunately, instead of understanding few simple
(as we think) things many people related to crapware/security coding has started
creating numerous idiotic rumors about RKU itself and its authors. We have a
very good laugh on their hypothesis and their behavior during last year. We even
was unable to think, that few “respected” well-known security developers (like
Ilya Rabinovich for example in his postings at virusinfo.info Kaspersky
sponsored forums) will spread and actively defend full of idiocy theory about
relationship between disappearing of the RKU and pompous introducing of the
so-called first fourth generation rootkit detection software (in reality
bullshit). Stuff that is more interesting has taken place at the SysInternals
forums where several guys starts actively search for backdoors inside RKU and by
the way advertising of their commercial software (OnlineSolutions). Seems to be
these people just waited when we finally shut up to start their ridiculous
campaigns. After revealing of the well-known for specialists Rustock.C but fully
unknown for everybody else including most of the antivirus companies mister
Alexander Gostev from the KL accused us in malicious software coding and “long
advertising of nothing”, where mister Gostev used several interesting for his
physiatrist terms and analogues, moreover this so-called virus analyst from
so-called antivirus company even claimed that we can’t detect Rustock beastie.
Thank you, dear Kaspersky Lab, hope after this shit, your buggy and shitty
product will detect something more than just KL self-made Trojans and VBA
macro-viruses written by mister Gostev.

In the middle of 2008 become real
vacuum of rootkit detection software from independent groups. Actually just ONE
active good freeware project – Root Repeal (http://rootrepeal.googlepages.com).
Anything else – only full trash, even GMER did not update for a long time. In
addition, where IceSword is almost dead. We are not speaking about numerous
so-called antirootkits from antivirus companies just because they are full trash
oriented mostly on rootkits of Hacker Defender long time ago finished era.
Rootkit activity however didn’t reduced and more rootkits in the past year
dramatically evolved in technologies they are using. Yes most of them are still
completely script-kiddies by their nature, but we saw malware bootkit, we saw
Acsesso, we saw Rustock series and we can imagine what will be in the near
future. And it was required to update old good RKU 3.7 to satisfy new time, new
threats, “new” rootkit technologies and we did this.

******New features
of the 3.8******

First, it was required to answer on the existing or just
revealed rootkit technologies implemented for example in Rustock.C. Kaspersky
Lab long time ago denies its existence and after revealing of this rootkit by
their concurrent DrWeb they of course started stupid and absolutely mediocre,
helpless campaign against everybody who are not with them or their passive
proactive position. Obviously we cannot copy-paste all methods of the detection
of this kind of rootkits from VX to LE, so we did another variant of detection,
based on revealing and removing rootkit hooks. It is known, that exactly
numerous Rustock.C hooks are protecting this rootkit from revealing/removal by
antivirus software. We do not want to speak anymore about Rustock because it is
obviously dead theme, where too much money of the *** is involved and too much
shit already told. However new 3.8 LE doesn’t detects all this rootkit hooks,
just because for revealing all of them it is required to copy-past too much code
from VX, which we do not want to publish at all. Our next target was bootkit.
Yes it is quite old and already very good known rootkit, but we would like to
add to its detection something new, not just did copy-paste like did some of
antivirus antirootkits (BlackLight, GMER (aswar) for example). The idea of the
bootkit detection is not new – it is crosschecking of the main boot record
sector (usually 0) for mismatch between two different scan. Where High Level API
make first scan and where next low-level disk reading make the second scan. Most
of antirootkits here using original ClassReadWrite handler located inside
classpnp.sys, however we found this solution good, but not very cool, since it
is obviously several easy ways to bypass it. We decided to do a little
experiment and since we cannot use anything from private VX series, it was
required to create new detection method for the bootkit, which not mentioned in
VX variant. We choose SCSI, actually SCSI_REQUEST_BLOCK. It is well documented
way, but very easy and not very hardware independent. However it works, at least
in our test, lol. The removal of bootkit, also was based on the same method. We
doubt in future of the bootkits, since it is always known for what and where you
should look for their detection, no matter even if bootkit will change boot
sequence in BIOS.
After dealing with these two bad guys we started attacking
rootkits with anti-antirootkits part. Yes, such kind of beasties exists, and it
is new flow in malicious rootkit development. While seems to be completely
unable to bypass antirootkits conceptually malware coders due to complete lack
of professionalism and their love for easy-money started attacking antirootkits
in their crappy products. Example given – special FSD filters preventing
antirootkits from operation with RAW disk data, hooking several non-meaningful
for rootkit, but meaningful for antirootkits functions and preventing
antirootkits from correct using them. As the last and very dangerous methods
here we saw rootkit named Siberia2 which specially did damage to Object
Directory to prevent antirootkits from work and detection. The funny part of all
of these rootkits – there are nothing else interesting in them except their
aggressive defense. Further rootkits with such “technologies” will come soon; we
have no doubt in this. Next, it was required to answer on several new
interesting proof-of-concept which were introduced during last year. However we
found nothing useful in some of them (such as raw filtering) simple because
these PoC incomplete, buggy and in real life will not survive few hours of work,
because when they are becoming unseen for the system, it can do with space they
allocate whatever operation system wants. There is no good realization of the
disk sectors hider, only BSOD-generator like dead concepts. Very likely that
this kind of technology exists elsewhere (since we have equal private demo
non-malicious rootkits), but in the private. Therefore, we cannot and do not
want fight with non-meaningful shadows.
We found very simple and efficient
way of the hidden processes detection for the 2003/Vista/2008 systems. It isn’t
really new, as you probably know klister introduced Scheduler lists analysis
long time ago. But since 2003 release no rootkit detectors with klister
functionality were made for the new NT core. Scheduler was changed in 2003 and
it is applies also for Vista/2008.
Little explanations here. Since 2003
scheduler lists are now doesn’t accessible from functions body where they were
located previously. Scheduler lists now accessible from Processor control region
data, where scheduler now operates them though special array of PCRB structures
per processor.

It is not a secret technology and we can even give a
sample of the code to the public, it is very simple and covers all available now
NT versions since 2003. We would like to share this code because it is easy way
to help antirootkits developers detect hidden stuff under new NT’s. We didn’t
see something like that in public before, maybe because we too little googled
for this?

void Win2k3VistaKiWaitListHeads()
{
    ULONG 
KiWaitInListHead_offset = 0;
    ULONG KiDispatcherReadyListHead_offset = 
0;
    PKPRCB p1 = NULL;
    KiWaitInListHead = 
NULL;
    KiDispatcherReadyListHead = NULL;

    p1 = 
KeGetCurrentPrcb();
    if (p1)
    {
        switch ( NtBuildNumber 
)
        {
        case 3790:
            {
                switch 
( wServicePackMajor )
                {
                case 
0:
                    {
                        KiWaitInListHead_offset = 
0x920;
                        KiDispatcherReadyListHead_offset = 
0x930;
                        break;
                    }
                case 
1:
                case 
2:
                default:
                    {
                        KiWaitInListHead 
= &p1->WaitListHead;
                        KiDispatcherReadyListHead 
= 
&p1->DispatcherReadyListHead[0];
                        return;
                    }            
                }
                break;
            }
        case 
6000:
            {
                KiWaitInListHead_offset = 
0x1A20;
                KiDispatcherReadyListHead_offset = 
0x1A60;
                break;
            }
        case 
6001:
            {
                KiWaitInListHead_offset = 
0x1AA0;
                KiDispatcherReadyListHead_offset = 
0x1AE0;
                break;
            }
        default:
            {
                KiWaitInListHead_offset 
= 0;
                KiDispatcherReadyListHead_offset = 
0;
                break;
            }
        }
        if 
(KiWaitInListHead_offset)    
            KiWaitInListHead = 
(PLIST_ENTRY)(PBYTE(p1) + KiWaitInListHead_offset);
        if 
(KiDispatcherReadyListHead_offset) 
            KiDispatcherReadyListHead = 
(PLIST_ENTRY)(PBYTE(p1) + 
KiDispatcherReadyListHead_offset);
    }
}

Where
KiDispatcherReadyListHead now is array of ListEnties for each priority. Parsing
of these lists also was changed since 2000/XP.

void 
ProcessKiWaitListHead(PLIST_ENTRY List, PEPROCESSINFO 
pinf)
{
    PLIST_ENTRY entry = List;
    PETHREAD et1;
    ULONG 
_offset;

    if (List == NULL) return;
    entry = 
entry->Flink;

    do
    {    
        //Thread.Tcb.WaitListEntry 
- OffsetWaitListEntry
        switch ( NtBuildNumber 
)
        {
        case 3790:
            {
                _offset 
= 0x60;
                break;
            }
        case 
6000:
        case 6001:
            {
                _offset = 
0x70;
                break;
            }
        default:
            {
                _offset 
= 0x60;
                break;
            }
        }
        et1 = 
(PETHREAD)((ULONG)entry - _offset);
        if 
(MmIsAddressValid(et1))
        {
            AddToProcessTable(et1, 
pinf);
        }
        entry = entry->Flink;
    } while (entry != 
List);
}

void ProcessKiDispatcherReadyLists(PLIST_ENTRY StartListHead, 
PEPROCESSINFO pinf, ULONG ListHeads)
{
    PLIST_ENTRY 
CurrentListHead;
    ULONG Counter = 0;
  
  for( CurrentListHead = 
StartListHead;
            Counter < 
ListHeads;
            CurrentListHead++, 
Counter++)
    {
  
      ProcessKiWaitListHead(CurrentListHead, 
pinf);
    }
}

We would like to thanks author of
RootRepeal because we have consultation with him while researching this
method.

Excluding these new features in the RKU 3.8 also fixed some old
terrible bugs, removed some obsolete detection methods, updated internal
structures etc. RKU 3.8 also features physical memory dumping which is based on
opensource win32dd project. However we found win32dd code, especially driver
part buggy and recoded most of it.

******Perspectives******

As
for now we continue LE as well as VX development even if sources of VX were sold
in last year the rights on this code is still ours. More things should be added
to improve their usability, stability and detection/removal methods. We are not
anymore interested in script-kiddies feedback as well as their continuing
idiotic rumoring of nonexistent things. However if you have questions, minidumps
etc we will be glad to hear you, feel free to contact. Development of freeware
tools heavy depends on feedback from users. We long time were on sysinternals
forums helping people in dealing not only with malware, but also in different
areas. This place long time have a lot of constructive and talented peoples.
However since acquiring by Microsoft in the July 2006 SysInternals become more
and more unfriendly, and finally now we can tell with 100% sure, Microsoft
provides at SysInternals (as part of TechNet) and especially forums politics of
the CENSORSHIP. You do not need to be very smart person to understand this.
Firstly Microsoft ordered to drop support of the old versions of Windows for SI
tools (it was made specially because the same new ProcMon can have compatibility
with old versions, no matter what somebody claims against, it may not use
Minifilters for NT4/2000 for example, and please do not make us too much laugh
telling that this is impossible). Stupid EULA was added in everything, most
interesting projects like Rootkitrevealer, Autoruns, FileMon, RegMon were ended,
because we cant say that non-meaningful updates of Autoruns is evolution.
However all this of course on programs authors decisions, but it is too
suspicious in relation to Microsoft isn’t? What about forums, which we cannot
anymore use, because Microsoft Administration in the face of Curtis Metz has
build blacklist of IP’s. Forums are under heavy censorship. And main role here
is playing mister Karl, aka Karlchen – very old moderator, who is responsible
for all censorship at forums, mockery in several topics, posting personal
moderators opinions in closed by the same moderator topics, silent graffiti in
several topics (which they now can’t delete – pure Drama, isn’t?). It is really
– “Power corrupts” and mister Karlchen now perfectly knows this. After
kicking/banning us this place was owned by gang of real idiots of any kind, they
all think that they are living in Matrix and evil rootkits everywhere including
their home toasters. This idiocy owned in the past very good and interesting
place. Owned with direct help of mister Karl and new
administration.
Drama.

Well enough about idiots, let’s go back to main
theme.
Below is the link to the latest Rootkit Unhooker v3.8. It is uploaded
to free file hoster service, simple because we doesn’t have a vault here and
can’t use any other ftp in security reasons. MD5 checksum included, help file
and localization packs also here. Perhaps if administration of rootkit.com won't
be against here also will be soon posted old source code of RKU, not only very
old 2.0 ;)

If you have questions/comments/suggestions please use Memo
system to reach us. Stupid output will be ignored, offensive output will be
ignored and reported to administration.

NOTE: YOU USE THIS SOFTWARE AT
YOUR OWN RISK
NOTE: REMOVE ALL PREVIOUS LE VERSIONS BEFORE USING THAT
VERSION!

http://rapidshare.com/files/136965760/RkU3.8.341.552.rar.html
df4536abcf25ec8f77c91f2b058e4c02
*RkU3.8.341.552.exe

Locals
http://rapidshare.com/files/134702156/2local.rar.html

This
software and article is posted at rootkit.com as exclusive. Any other links
elsewhere to this software without noticing original post location and MD5
checksum IS NOT GENUINE.