Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


POC: Stealthed Kernelmode API hooking

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine Extensions
View previous topic :: View next topic  
Author Message
Dark Byte
Site Admin
Reputation: 363

Joined: 09 May 2003
Posts: 21517
Location: The netherlands

PostPosted: Tue Mar 12, 2019 9:27 am    Post subject: POC: Stealthed Kernelmode API hooking Reply with quote

Here's an extension/example that will hook NtQuerySystemInformation and ZwQuerySystemInformation and keep a log of all the calls.

It will use DBVM (latest version) to hide the changes in kernelmode memory from patchguard. There is an option to run without DBVM, but you will BSOD within a few hours (but might be enough to to get the data you need anyhow)

This extension adds a new generateAPIHookScriptK function to deal with the >2GB detour, but I guess you can also apply it to your own situation in case the prefered base fails (change kalloc to alloc then)

The kinfo.sys driver (source included) gets manually mapped by CE using the loadModule function (it can map .sys files, as long as it only imports ntoskrnl.exe and hal.dll exports, so the project has some modified parameters here and there)

The internal log can be 64MB , so if you close CE and then unload the driver it will keep logging for a while (Do write down the export addresses of kinfo.sys and register them back, and do a resume on the gui, so don't erase the old log which is it's default behaviour)

Download: https://cheatengine.org/download/poc/kinfo.zip
extract to the base of your CE folder, overwriting the old vmdisk files

once loaded you'll have a "proof-of-concept" menu item left of the help menu item



kinfo.png
 Description:
Screenshot of it working
 Filesize:  36.09 KB
 Viewed:  2014 Time(s)

kinfo.png



_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine Extensions All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites