0

I want to write a program to obtain the information of process, for the purpose of detecting and combating malware. I can use C++ and Win32 APIs to finish it, but I then started suspecting those APIs may be hooked in order to avoid my tests.

My question is: Can I get that information without using APIs? I cannot find any details about how zwQueryInformationProcess() functions.

  • and ZwQueryInformationProcess is not an "API"? – Igor Skochinsky Mar 1 '17 at 14:31
  • @Igor i think he wants to write his own equivalent of that.. API – Sigtran Mar 1 '17 at 14:52
  • It might be easier to address the issue of API hooking rather then implementing a generic zwQueryInformationProcess copy. You might be able to get some of the information it provides, but that depends on what info exactly you're interested in. – NirIzr Mar 1 '17 at 17:13
  • Your question is really not specific enough. What information are you trying to get? Are you trying to avoid userland or kernel detection? Details about ZwQueryInformationProcess are on the MSDN : msdn.microsoft.com/en-us/library/windows/desktop/… – Dillinur Mar 1 '17 at 17:46
  • @Dillinur I am writing a program to detect the hidden process which is executed by hacker or someone else. I consider the situation that if those APIs are hooked, can I still find the evil, hidden processes as usual. – Sunichi Mar 2 '17 at 2:33
1

Have a look at the Process Environment Block (PEB)

API functions like zwQueryInformationProcess() parse the data from intern structures. Some of them may provide the information you need and you should be able to find them without utilizing API functions.

You can also get a lot of information from the file header im memory, TEBs (Thread Environment Blocks) or you try a level deeper: EPROCESS. The later is utilized at kernel level.

0

You can find a lot of resources about the internals of zwQueryInformationProcess because that information is undocumented. As nordwald said, detecting malware with zwQueryInformationProcess is possible, and more so in several ways but I would like to focus on something slightly different for this answer.

The general task of detecting malware in a process is usually pretty complex, specially when you aim to perform it generically and for multiple malware families. There are books about the topic and articles upon articles on related subjects. There are dozens if not hundreds of techniques malware can avoid detection, bypass protections and prevent analysis. There are multiple ways to avoid or mitigate most of those tricks and successfully detect malware samples that employ them. There's a huge market for malware detection with dozens of products attempting to detect and block viruses. Some would say that industry is falling behind of malware writers and it is generally quite feasible to make a malware FUD (fully undetected).

This is a huge domain with a lot of written material and aggregated knowledge.

Detecting malware is not something you could do with something as simple as using raw data instead of calling an API. Companies fail at doing that after investing millions of dollars, and much more.

I do not aim to discourage you from pursuing that or similar goals, I do however think you should make some effort at reading existing material to quickly further your understanding of the malware and anti-virus world, good luck!

  • ZwQueryInformationProcess requires opening the process for querying, hence an API which is likely hooked to refuse opening for the target process. – peter ferrie Mar 10 '17 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.