3

I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, without actually debugging the program.

Since I'm not a software developer, I'd really rather avoid writing code to do API hooking. My next thought was to use a modified kernel32.dll in the same directory as the program, counting on "DLL Load Order Hijacking". So... I modified a copy of the dll, essentially replacing the export for IsDebuggerPresent with mov eax, 1

If I open the DLL in IDA and examine the export, it shows exactly the code I patched in, but if I run the executable, when it makes the call to IsDebuggerPresent the same address I modified instead shows a JMP to the proper IsDebuggerPresent instructions.

Is what I'm trying to do even feasible, or do I have to do API hooking to make it work? I'm Really looking for a simple POC, so again, I'd prefer not to have to figure out a metric buttload of C++ just to test a theory.

4

Windows has a concept of trusted libraries to hamper attacks like these:

Dynamic-Link Library Search Order

Citing from the search order:

If the DLL is on the list of known DLLs for the version of Windows on which the application is running, the system uses its copy of the known DLL (and the known DLL's dependent DLLs, if any) instead of searching for the DLL. For a list of known DLLs on the current system, see the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs.

So for your case, I would suggest giving API hooking a try ;) It really isn't too hard (Windows to the rescue for all your shady needs).

edit:

some pointers for hooking

You may go ahead and use Windows Hooking API

However, it is quiet straight forward to do yourself:

  1. Use GetProcAddress to find GetDebuggerPresent in your address space (Windows does not like ASLR). You can assume it is at the same location in the other process.

  2. Backup the first few bytes (ReadProcessMemory), insert any hook (WriteProcessMemory) and you code (VirtualProtectEx).

side node: you may need to elevate the permissions of your process first (OpenProcessToken, ...).

edit 2:

I found some of my old code. You can find it here. Please note this code was written for a research project to avoid Sandbox detection and that I was a student at the time (i.e. the code may not be high quallity).

  • Fair enough. Any chance you could point me in the direction of a decent tutorial? When I say that I don't know C++, please understand that on the few occasions I've written anything in C++, I have to disassemble them to understand what they are doing, and if they'll do what I want. High-level languages have never really made any sense to me. – Bjørn Ulfson Feb 7 '17 at 17:31
  • See my second edit ;) Its clean C code. – Nordwald Feb 8 '17 at 7:33
0

As mentioned above, just placing the DLL in the same directory won't be enough for certain windows DLLs, as windows searches for those in specific paths as documented about Dynamic-Link Library Search Order.

However, there's some potential trickery with the knownDlls list you can manipulate to succeed in your DLL replacing attempts:

  1. You could remove specific DLLs from the list, allowing yourself (and others, thus exposing the machine to some potential risk) to load said DLL from the application's location.

  2. You could replace the DLL name stored as the value of the key in the same registry path. Instead of a DLL name, simply place a full path and the DLL will be loaded from your specified location for all processes.

Although this might not be advised as there's a risk of a malicious entity exploiting those changes to hijack DLLs on your machine, it's definitely an easy way to test your endeavors without writing any API hooking code, as requested :)

Another approach would be searching for some pre-made API hooking utilities (there, are, plenty)

  • yes, but (1) and (2) are ugly hacks that have system-wide implications, like visiting someone's house and changing their carpet. The changes should be limited to the current process. – peter ferrie Feb 10 '17 at 20:03
  • Yes. I mentioned that in my original answer. These approaches answer OPs original request: a easy way that will not require hooking, and I would think is perfectly fine when done in a VM or as part of a one time limited test (as is implied by OPs POC remark). – NirIzr Feb 10 '17 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.