Security research and technical articles by Ido Veltzman.
Event Tracing for Windows is one of Windows' richest telemetry systems. This video introduces the ETW ecosystem and shows how EtwSuite can turn raw provider events into practical security research and UAC-bypass detections.
Hey there, it has been a "little" while since I published my last post. After scrapping and rewriting multiple ideas, I decided to write something a bit different from my previous posts. This post contains technical information, but I also wanted to share my thoughts after working on a hypervisor project for more than a year.
In the last blog post, we learned about two common hooking methods (IRP Hooking and SSDT Hooking) and two different injection techniques from the kernel to the user mode for both shellcode and DLL (APC and CreateThread) with code snippets and examples from Nidhogg. In this blog post, we will write a simple driver that is capable of bypassing AMSI to demonstrate patching usermode memory from the…
In the last blog post, we learned about the different types of kernel callbacks and created our registry protector driver. In this blog post, I'll explain two common hooking methods (IRP Hooking and SSDT Hooking) and two different injection techniques from the kernel to the user mode for both shellcode and DLL (APC and CreateThread) with code snippets and examples from Nidhogg. While there are…
In the last blog post, we learned some debugging concepts, understood what is IOCTL how to handle it and started to learn how to validate the data that we get from the user mode - data that cannot be trusted and a handling mistake can cause a blue screen of death. In this blog post, I'll explain the different types of callbacks and we will write another driver to protect registry keys. We started…
Cronos is a new sleep obfuscation technique co-authored by idov31 and yxel. It is based on 5pider's Ekko and like it, it encrypts the process image with RC4 encryption and evades memory scanners by also changing memory regions permissions from RWX to RW back and forth. In this blog post, we will cover Cronos specifically and sleep obfuscation techniques in general and explain why we need them and…
In the last blog post we understood what it is a callback routine, how to get basic information from user mode and for the finale created a driver that can block access to a certain process. In this blog, we will dive into two of the most important things there are when it comes to driver development: How to debug correctly, how to create good user-mode communication and what lessons I learned…
In the last blog post, we had an introduction to kernel development and what are the difficulties when trying to load a driver and how to bypass it. In this blog, I will write more about callbacks, how to start writing a rootkit and the difficulties I encountered during my development of Nidhogg. As I promised to bring both defensive and offensive points of view, we will create a driver that can…
This blog post series isn't a thing I normally do, this will be more like a journey that I document during the development of my project Nidhogg. In this series of blogs (which I don't know how long will it be), I'll write about difficulties I encountered while developing Nidhogg and tips & tricks for everyone who wants to start creating a stable kernel mode driver in 2022. This series will be…
When I first heard about Rust, my first reaction was "Why?". The language looked to me as a "wannabe" to C and I didn't understand why it is so popular. I started to read more and more about this language and began to like it.
When I first heard about ModuleStomping I was charmed since it wasn't like any other known injection method. Every other injection method has something in common: They use VirtualAllocEx to allocate a new space within the process, and ModuleStomping does something entirely different: Instead of allocating new space in the process, it stomps an existing module that will load the malicious DLL.…
Many times I've wondered how comes that there are no tools to get active UDP connections. Of course, you can always sniff with Wireshark or any other tool of your choosing but, why netstat doesn't have it built in? That is the point that I went on a quest to investigate the matter.