分类渗透案例下的文章 - 白帽Wiki

[2021]windows 19H1中一种冷门的反调试方法

windows 19H1中PsSuspendProcess新加了一点代码:
```cpp
NTSTATUS PsSuspendProcess(_EPROCESS* Process)
{
  const auto currentThread = KeGetCurrentThread();
  KeEnterCriticalRegionThread(currentThread);

NTSTATUS status = STATUS_SUCCESS;
  if ( ExAcquireRundownProtection(&Process->RundownProtect) )
  {
    auto targetThread = PsGetNextProcessThread(Process, nullptr);
    while ( targetThread )
    {
      // Our flag in action
      if ( !targetThread->Tcb.MiscFlags.BypassProcessFreeze )
        PsSuspendThread(targetThread, nullptr);

targetThread = PsGetNextProcessThread(Process, targetThread);
    }
    ExReleaseRundownProtection(&Process->RundownProtect);
  }
  else
    status = STATUS_PROCESS_IS_TERMINATING;

if ( Process->Flags3.EnableThreadSuspendResumeLogging )
    EtwTiLogSuspendResumeProcess(status, Process, Process, 0);

KeLeaveCriticalRegionThread(currentThread);
  return status;
}
```
```cpp
 if ( !targetThread->Tcb.MiscFlags.BypassProcessFreeze )
```
总所周知 调试器都要用这个函数挂起线程、进程
因此如果我们给线程设置一个参数(THREAD_CREATE_FLAGS_BYPASS_PROCESS_FREEZE为0x40):
```cpp
NtCreateThreadEx(&handle, MAXIMUM_ALLOWED, nullptr, NtCurrentProcess(),
                 &printer, nullptr, THREAD_CREATE_FLAGS_BYPASS_PROCESS_FREEZE,
                 0, 0, 0, nullptr);
```
那么这个线程将无法暂停!
那么 如何利用为反调试呢?
继续看PsSuspendProcess->KeSuspendThread:
```cpp
ULONG KeSuspendThread(_ETHREAD *Thread)
{
  auto irql = KeRaiseIrql(DISPATCH_LEVEL);
  KiAcquireKobjectLockSafe(&Thread->Tcb.SuspendEvent);

auto oldSuspendCount = Thread->Tcb.SuspendCount;
  if ( oldSuspendCount == MAXIMUM_SUSPEND_COUNT ) // 127
  {
    _InterlockedAnd(&Thread->Tcb.SuspendEvent.Header.Lock, 0xFFFFFF7F);
    KeLowerIrql(irql);
    ExRaiseStatus(STATUS_SUSPEND_COUNT_EXCEEDED);
  }

auto prcb = KeGetCurrentPrcb();
  if ( KiSuspendThread(Thread, prcb) )
    ++Thread->Tcb.SuspendCount;

_InterlockedAnd(&Thread->Tcb.SuspendEvent.Header.Lock, 0xFFFFFF7F);
  KiExitDispatcher(prcb, 0, 1, 0, irql);
  return oldSuspendCount;
}
```
可以看到 Thread->Tcb.SuspendCount 在成功暂停线程的时候会增加! 也就是说我们可以利用那个新的flag阻止线程暂停 这样子这个count就不会增加 当调试器调用NtResumeProcess的时候 计数就会减少! 利用这一点我们就可以知道自己是否被调试:
```cpp
for(size_t i = 0; i < 128; ++i)
  NtSuspendThread(thread, nullptr);

while(true) {
  if(NtSuspendThread(thread, nullptr) != STATUS_SUSPEND_COUNT_EXCEEDED)
    std::puts("I was suspended\n");
  Sleep(1000);
}
```

阅读全文

2021-01-10 huoji 0 条评论