3

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I decided to delete that question and ask my question directly by explaining all the details so maybe I can find a better solution for my problem.

Driver size is about 3mb and it is packed and when it's loaded on memory it gets around 6mb which shows how much garbage code is actually there, it used anti static analysis methods like jumping to different locations by register, calling API functions using push and ret instructions and getting API addresses using brute force and many more methods that I am not aware.

Now when I am using windbg to analyze the driver I tried the ta instruction which was suggested in the previous question about python script, even 6 hours was not enough to get to that address. As a result I thought about the ideas below but I am not sure if they are working or if there is any open source tool for these ideas so I would really appreciate it if anyone can give me a solution to this problem.

  1. Using DTrace is one of the ideas that I tried, the problem is, driver detecting both debugger and my virtual machine so when I am using sc command to run the driver, its getting closed immediately so I do not know how can I use DTrace since I am not familiar that much with the tool.

  2. Using or writing an IRP tracker so I can find out what functions get called when I am using sc command. I found out OSR has a tool for this purpose but sadly it is not working for windows 11 but maybe there is an open source tool for this idea.

Tldr; Working on a virtualized and heavily mutated driver with tons of fake calls that hide all import functions and getting addresses using brute forcing memory I need a way to find all those functions.

Improve this question
1
  • You might be better off working on the driver when it isn't loaded, maybe copy the binary to another system and analyse it statically so that you can disable the debugger detection. I say driver but this sounds like a rootkit or endpoint security product.
    – Mega Tonnage
    Oct 10, 2022 at 22:52

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.