Skip to content

Hooking Shadow and normal SSDT with Kaspersky Hypervisor and abusing alignment

Notifications You must be signed in to change notification settings

iomeone/pwn3d_align

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

3 Commits
 
 
 
 
 
 

Repository files navigation

pwn3d_align

pwn3d_align is a x64 Windows Driver created to monitor/hide or block access from processes, objects, files using SSDT/Shadow SSDT hooks with abusing aligment.

KasperskyHook

This techniques modifies klhk.sys aka "Kaspersky Lab service driver". This driver is the antivirus legitimate driver, more information can be found on the original repo.

The original intetion was to monitor malware behavior on the system and the main goal is not to bypass antivirus or anticheats solutions, but, that can be done anyway.

Compatibility

Lets call 'Kaspersky hooks' everything that can be done modifying klhk.sys ok?

When the definition USE_KASPERSKY is set the project will use Kaspersky hooks that is compatible on Windows 7/8/8.1 and 10, Intel and AMD supported but Virtualization should be enabled on the BIOS.

When USE_KASPERSKY is not set the project will use SSDT and Shadow SSDT, that is hardcoded to Windows 7 7601 SP1 (x64 of course) only, it can also be said that PatchGuard NEEDS TO BE TURNED OFF HERE as there's checks for those.

Hooks

  • NtQuerySystemInformation
  • NtOpenProcess
  • NtAllocateVirtualMemory
  • NtFreeVirtualMemory
  • NtWriteVirtualMemory
  • NtLoadDriver
  • NtDeviceIoControlFile
  • NtUserFindWindowEx
  • NtUserWindowFromPoint
  • NtUserBuildHwndList
  • NtGetForegroundWindow
  • NtUserQueryWindow

Compilation, Installation and Usage

Visual Studio 2019 required with SDK/WDK 1903 Compilation is simple, just open the project and build it using the IDE.

No driver certificate is given here, either load the driver with test signing mode enabled or sign it yourself using a valid certificate.

A debug log is generated by default, you can use a tool like DebugViewer to see those logs. Use TestHide.exe to check if things are actually working.

KasperskyHook can be used without triggering the PatchGuard, no actually hooks can be found or checked in a normal way.

Important note: KasperskyHookLoader.exe should be used to load the Driver if USE_KASPERSKY flag enabled, otherwise you can just load the driver using a ordinary way.

About

Hooking Shadow and normal SSDT with Kaspersky Hypervisor and abusing alignment

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published