[Brookit]

Hi,

some probably already know, but Cr4sh posted in russian blog of esagelab about how to bypass detection of hidden executable code in a nifty way. So all credit for PoC goes to him.

Original: http://esagelab.ru/blog/tech/%D0%BE%D0% ... B#more-130

English version: http://translate.google.com/translate?h ... BB&prev=_t

Repository: https://github.com/Cr4sh/DrvHide-PoC

BTW
allive -> alive


Regards

[EP_X0FF]

This is nice idea. However it is bit old trick (we were looking on the same idea when working on Unreals), yes by public tools this is undetectable (at present time).
However I believe this is just a question of short time, because this method is easy to detect. And some additional detection methods must be implemented because detection also can be easily compromised :)

[Alex]

Yes, it is interesting, but as EP_X0FF said it can be easily detected. For example Kernel Detective shows that the code is executing (see thread stack also) from resource section what is malicious by default.

kd.jpg (19.03 KiB) Viewed 532 times