I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my environment for Kernel debugging (using IDA's windbg plugin) and set a breakpoint for the new driver (it's called Fdisk.sys, so I've been typing "bu fdisk.sys!DriverEntry"). However, IDA never breaks when the driver is loaded. I can tell that it has run because it starts hiding a registry key (Ultra3), and dumping the memory and using Volatility to look at unloaded modules, I can see that fdisk.sys was unloaded. I can also confirm that it's installed hooks into a number of kernel API's. How do I get IDA/windbg to break on the driver before it gets to run?
3 Answers
For some reason I have yet to determine, every effort to set a breakpoint on this module by name (fdisk.sys) is failing. The driver isn't loaded at bootup (at least, not at the point that I'm investigating right now). It's loaded by a module and then unloaded again fairly soon thereafter.
I finally used a debugger (indside my VM) to step through the module that launches the driver, stopped execution after the file was written to disk, and used a hex editor to change the first instruction to INT 3. That worked; when the driver loads the exception is caught by the kernel debugger and I'm able to start reviewing. phew
Now I gotta figure out why I couldn't get it break by name.....
It may be late but: If you use WinDBG(kd) to debug the kernel use
sxe -c ".echo fdisk loaded;" ld:fdisk.sys
this is usable in user and kernel mode and cause the debugger break-in after module loaded and before entry-point.
-
2be aware sxe ld will only work for the first time load and not subsequnet loads of the same module take a look at the exchange between pavel and raj here for a partial workariund to sxe ld recurring breaks osronline.com/showthread.cfm?link=233022– blabbMay 11, 2014 at 7:57
For windbg take a look at my answer here
How can you reliably unpack a Windows driver manually?
if you are using virtual kd and vmware just run the script when virtual kd breaks for the first time after the connection
it will simply print out all the driver details as and when they are loaded right from bootphase
for other vms you need to set sxe -ibp; and reboot
and run the script on Initial breakin