A forum for reverse engineering, OS internals and malware analysis 

Windows 8 rookits

Forum for analysis and discussion about malware.

Windows 8 rookits

 #15633  by dphrag
 Mon Sep 17, 2012 8:56 am
I am looking for rootkits that will work on Windows 8 , try to put together a pool of those . I tried testing some but they didnt seem to work, so i thought i would ask here if anyone has gone down that road before ?

Re: Windows 8 rookits

 #15636  by EP_X0FF
 Mon Sep 17, 2012 11:03 am
I dont think any of them will work fine on Windows 8 even if this is just third remake of the same Vista. Most of r0 rootkits (not driver agents like Necurs for example) rely on undocumented API/opaque system structures that are subjects of change between Windows versions. They using hardcoding and other sings of bad programming. I expecting some rootkits to be updated for Windows 8, like for example Sinowal and MaxSS. However r3 rootkits should work fine. Except maybe some real mad skills crapware.

Re: Windows 8 rookits

 #15637  by dphrag
 Mon Sep 17, 2012 11:52 am
Yea that what i thought as well but wasn't sure. I am looking for specially r0 rootkits , didn't know that Necurs works on Win8 ! When i even tried some ark's tools they failed to work also. Guess have to wait .

Re: Windows 8 rookits

 #15643  by EP_X0FF
 Mon Sep 17, 2012 4:10 pm
dphrag wrote:didn't know that Necurs works on Win8 ! When i even tried some ark's tools they failed to work also. Guess have to wait .
Have no idea will it work or no. But more likely will. Well better chance than any other because Necurs is not rootkit. Also forget about ARK software as class. Its useless piece of junk code.

Re: Windows 8 rookits

 #15671  by MindfreaK
 Tue Sep 18, 2012 7:50 pm
Ring3 rootkits will work like they did before , but in windows 8 you can't inject into the new taskmanager, so you need to use AppInit_Dlls or the way ZeroAccess for x64 did it.
http://www.codeproject.com/Articles/493 ... -API-hooks
This could be interesting for ring3 rootkits, for both x86 and x64.

http://stoned-vienna.com/
There are allready bootkits for Windows 8 the first i saw was that from Peter Kleisner.

Re: Windows 8 rookits

 #15676  by AaLl86
 Wed Sep 19, 2012 8:12 am
markusg wrote:perhaps from interest
http://www.itsec.it/2012/09/18/uefi-tec ... 8-bootkit/
Yes, that project builds a Windows 8 EFI Bootkit POC able to disable Driver Signing Enforcement and Patchguard... Hope that can help security analyst and, perhaps, normal people, to understand how UEFI technology operates...

Andrea
 Return to “Malware”