[Patrick]

Hi all, pretty beginner problem here I suppose.

I've been debugging for a few years and am always looking to learn new things everyday. I've RE'd a few postmortem crash dumps regarding rootkits but have never attempted a liveKD on one. I set up a quick 'isolated lab' using VMware, with the guest OS as Windows 7 x86. I tried executing three droppers, all rootkits:

Code: Select all

Dr.Rustock.PE386 // Access violation appcrash.
Dr.Rustock B huy32 // Access violation appcrash.
Runtime2 // .exe deletes after execution and nothing is dropped.

I figured after the above happened that they're simply noticing they are being executed in a virtual environment, so I did some research and stumbled on making the following additions to the cfg:

Code: Select all

isolation.tools.setPtrLocation.disable = "TRUE"
isolation.tools.setVersion.disable = "TRUE"
isolation.tools.getVersion.disable = "TRUE"
monitor_control.disable_directexec = "TRUE"
monitor_control.disable_chksimd = "TRUE"
monitor_control.disable_ntreloc = "TRUE"
monitor_control.disable_selfmod = "TRUE"
monitor_control.disable_reloc = "TRUE"
monitor_control.disable_btinout = "TRUE"
monitor_control.disable_btmemspace = "TRUE"
monitor_control.disable_btpriv = "TRUE"
monitor_control.disable_btseg = "TRUE"

This has done nothing to help.

Is this stemming from virtual environment detection, and if it is, is my best bet just to use an *actual* system to RE malware on? Or am I missing something completely different and really obvious?

Thanks.

[maximusdecimer]

Hi Patrick,

I suspect these rootkits won't run on Win7. Try to run on XP guest.

[EP_X0FF]

Code: Select all

Dr.Rustock.PE386 // Access violation appcrash.
Dr.Rustock B huy32 // Access violation appcrash.
Runtime2 // .exe deletes after execution and nothing is dropped.

None of them compatible with something above XP. Some will fail to run on SP3 as well. Additionally some of them incompatible with MP CPU config, use XP SP2 + 1 core 1 thread with PAE off/on.

[Patrick]

Makes perfect sense, and I wondered if that was maybe the case. Thanks very much.

Is there any way to check what OS' the rootkits were written for other than hoping you find some good documentation? I tried researching it but couldn't find much other than misc. documentation from various AV's.

[maximusdecimer]

Rootkit droppers may use GetVersionEx api or drivers use PsGetVersion kernel api to find expected OSes so that they can run. But it's not guaranteed that they use them. So we get BSOD sometimes when running on unsupported OSes.

[Patrick]

Just got XP SP2 off the TechNet servers, so I'll give that a go with what EP recommended.

Thanks again.

[Patrick]

Worked just fine, and had a lot of fun.

Thanks again for your help.