5

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my environment for Kernel debugging (using IDA's windbg plugin) and set a breakpoint for the new driver (it's called Fdisk.sys, so I've been typing "bu fdisk.sys!DriverEntry"). However, IDA never breaks when the driver is loaded. I can tell that it has run because it starts hiding a registry key (Ultra3), and dumping the memory and using Volatility to look at unloaded modules, I can see that fdisk.sys was unloaded. I can also confirm that it's installed hooks into a number of kernel API's. How do I get IDA/windbg to break on the driver before it gets to run?

Improve this question

3 Answers 3

Reset to default
6

For some reason I have yet to determine, every effort to set a breakpoint on this module by name (fdisk.sys) is failing. The driver isn't loaded at bootup (at least, not at the point that I'm investigating right now). It's loaded by a module and then unloaded again fairly soon thereafter.

I finally used a debugger (indside my VM) to step through the module that launches the driver, stopped execution after the file was written to disk, and used a hex editor to change the first instruction to INT 3. That worked; when the driver loads the exception is caught by the kernel debugger and I'm able to start reviewing. phew

Now I gotta figure out why I couldn't get it break by name.....

Improve this answer
5

It may be late but: If you use WinDBG(kd) to debug the kernel use

sxe -c ".echo fdisk loaded;" ld:fdisk.sys

this is usable in user and kernel mode and cause the debugger break-in after module loaded and before entry-point.

Improve this answer
1
  • 2
    be aware sxe ld will only work for the first time load and not subsequnet loads of the same module take a look at the exchange between pavel and raj here for a partial workariund to sxe ld recurring breaks osronline.com/showthread.cfm?link=233022
    – blabb
    May 11, 2014 at 7:57
4

For windbg take a look at my answer here

How can you reliably unpack a Windows driver manually?

if you are using virtual kd and vmware just run the script when virtual kd breaks for the first time after the connection

it will simply print out all the driver details as and when they are loaded right from bootphase

for other vms you need to set sxe -ibp; and reboot and run the script on Initial breakin

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.