Development Let’s develop a simple driver to detect and delete SST hooks. Therefore, our solution should not use Zw-functions and SST, as it is supposed that System Service Table is corrupted by malware. In this article, I am not going to pay attention to filter driver and function code splicers. However, I will probably do it in future.
Comparing current SST with the initial one located in ntoskernel.exe is the easiest way for hooks detecting and removing.
We should perform the following steps:
- Find ntoskernel module in memory.
- Find ntoskernel section, where SST is located, and calculate relative SST offset in section.
- Find ntoskernel section in ntoskernel.exe.
- Calculate real SST address in file.
- Read values from file and compare them with SST.
Before implementation, we’ll consider memory-mapped files in kernel mode.
Memory-mapped files in kernel mode
Memory-mapped file is a virtual memory segment that has been assigned a direct byte-for-byte correlation with some portion of a file or file-like resource.
We are going to use memory-mapped files in kernel mode, as they are quite useful for parsing PE file. In addition, their API is really easy-to-use, as it is rather similar to Win32 API.
SST unhooker demonstration
We have considered steps for developing a simple console utility named “unhooker.exe” for testing purposes. We can start it with no parameters; in this case, it will show information about its abilities:
- 1. The “stat” command shows statistics about SST hooking.
- 2. The “unhook” command cleans up SST.
The following example demonstrates how to use utility to detect and delete hooks:
Steps for unhooker building are just as ones, described in the “Hide Driver” article:
- Install Windows Driver Developer Kit 2003 http://www.microsoft.com/whdc/devtools/ddk/default.mspx
- Set global environment variable “BASEDIR” to path of installed DDK. Go here: Computer -> Properties -> Advanced -> Environment variables ->System Variables -> New
And set it like this: BASEDIR -> c:\winddk\3790
(You have to restart your computer after this.)
- If you choose Visual Studio 2003, then you can simply open UnhookerMain.sln and build it all.