crvvdev / masterhide

A x64 Windows Rootkit using SSDT or Hypervisor hook

Here's a little bit of my work

Check out my blog!

Popular Projects

• MasterHide - Abusing Kaspersky Hypervisor to hook Windows Syscalls

Software Development Projects

• titancf - CrossFire cheat code base
• iw4mp - Call of Duty: Modern Warfare 2 (2009) cheat code base
• Intraceptor - Intercept Windows NT API calls and redirect them to a kernel driver to bypass process/threads handle protections.

Socials

masterhide's Issues

end line in logs

MasterHide/MasterHide/shadow_ssdt.cpp

Lines 387 to 400 in 3e79de1

	if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERBUILDWNDLIST, oNtUserBuildHwndList ) )
	DBGPRINT( "Failed to unhook NtUserBuildHwndList" );
	if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERWNDFROMPOINT, oNtUserWindowFromPoint ) )
	DBGPRINT( "Failed to unhook NtUserWindowFromPoint" );
	if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERFINDWNDEX, oNtUserFindWindowEx ) )
	DBGPRINT( "Failed to unhook NtUserFindWindowEx" );
	if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTGETFOREGROUNDWND, oNtUserGetForegroundWindow ) )
	DBGPRINT( "Failed to unhook NtUserGetForegroundWindow" );
	if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERQUERYWND, oNtUserQueryWindow ) )
	DBGPRINT( "Failed to unhook NtUserQueryWindow" );

add \n
correct:

	if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERBUILDWNDLIST, oNtUserBuildHwndList ) )
		DBGPRINT( "Failed to unhook NtUserBuildHwndList\n" );

	if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERWNDFROMPOINT, oNtUserWindowFromPoint ) )
		DBGPRINT( "Failed to unhook NtUserWindowFromPoint\n" );

	if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERFINDWNDEX, oNtUserFindWindowEx ) )
		DBGPRINT( "Failed to unhook NtUserFindWindowEx\n" );

	if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTGETFOREGROUNDWND, oNtUserGetForegroundWindow ) )
		DBGPRINT( "Failed to unhook NtUserGetForegroundWindow\n" );

	if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERQUERYWND, oNtUserQueryWindow ) )
		DBGPRINT( "Failed to unhook NtUserQueryWindow\n" );

overflow in wcsncmp

MasterHide/MasterHide/shadow_ssdt.cpp

Line 203 in 3e79de1

if ( ObjName->Name.Buffer && !wcsncmp( L"\\Windows\\ApiPort", ObjName->Name.Buffer, 20 ) )

"\Windows\ApiPort" lenght is 17, not 20

wcsncmp( L"\\Windows\\ApiPort", ObjName->Name.Buffer, 17 )

incorrect comments

MasterHide/MasterHide/mh_hooks.h

Line 6 in 3e79de1

// ntoskrnl.exe

MasterHide/MasterHide/mh_hooks.h

Line 15 in 3e79de1

// win32k.sys

correct:

//
// win32k.sys
//
static auto SYSCALL_NTUSERFINDWNDEX = 0x106e;
static auto SYSCALL_NTUSERWNDFROMPOINT = 0x1014;
static auto SYSCALL_NTUSERBUILDWNDLIST = 0x101c;
static auto SYSCALL_NTGETFOREGROUNDWND = 0x103c;
static auto SYSCALL_NTUSERQUERYWND = 0x1010;

//
// ntoskrnl.exe
//
static auto SYSCALL_NTQUERYSYSINFO = 0x0033;
static auto SYSCALL_NTOPENPROCESS = 0x0023;
static auto SYSCALL_NTALLOCVIRTUALMEM = 0x0015;
static auto SYSCALL_NTWRITEVIRTUALMEM = 0x0037;
static auto SYSCALL_NTFREEVIRTUALMEM = 0x001b;
static auto SYSCALL_NTDEVICEIOCTRLFILE = 0x0004;
static auto SYSCALL_NTLOADDRIVER = 0x0004;

Hypervisor not loaded

Hello there. I can't overcome the error. I've been working on this for a long time, but I can't find a solution. Can you tell me what I'm doing wrong and which way to look?

useless assignment

MasterHide/MasterHide/tools.h

Line 17 in 3e79de1

us->Length = 0;

useless assignment

[SC] StartService FAILED 31

[SC] StartService FAILED 31:
A device attached to the system is not functioning.

When i try To Start On My Windows 10 i am getting this error.
I am using on My laptop Lenovo ideapad 330 can anyone help in this.

Slow string validation

MasterHide/MasterHide/mh_hooks.cpp

Line 380 in 3e79de1

if ( strlen( Serial ) > 0 )

MasterHide/MasterHide/mh_hooks.cpp

Line 392 in 3e79de1

if ( strlen( Model ) > 0 )

MasterHide/MasterHide/mh_hooks.cpp

Line 423 in 3e79de1

if ( strlen( Serial ) > 0 )

MasterHide/MasterHide/mh_hooks.cpp

Line 435 in 3e79de1

if ( strlen( Model ) > 0 )

Decreased performance, more correct do like
Serial [0] != '\0'

Dangerous assignment

MasterHide/MasterHide/tools.cpp

Line 32 in 3e79de1

PUNICODE_STRING pModuleName = ( PUNICODE_STRING )lpModuleName;

MasterHide/MasterHide/tools.cpp

Line 66 in 3e79de1

PUNICODE_STRING pModuleName = ( PUNICODE_STRING )lpModuleName;

More better:

wchar_t lpModuleName[ MAX_PATH ];
status = ZwQueryVirtualMemory( NtCurrentProcess(), PsGetProcessSectionBaseAddress( Process ), static_cast<MEMORY_INFORMATION_CLASS>(2), lpModuleName, sizeof( lpModuleName ), nullptr );
if ( NT_SUCCESS( status ) )
{
	const auto unModuleNameSize = wcslen(lpModuleName);
	if (unModuleNameSize > 0 )
	{
		AllocateUnicodeString( ProcessImageName, static_cast<USHORT>(unModuleNameSize));
		wcscpy_s( ProcessImageName->Buffer, unModuleNameSize, lpModuleName );
		bReturn = true;
	}
}

Easy to detect

Bad size for ProbeForRead

MasterHide/MasterHide/tools.cpp

Line 117 in 3e79de1

ProbeForRead( pImageBase, sizeof( pImageBase ), __alignof( pImageBase ) );

Bad size for ProbeForRead, code trying to check for sizeof(PUCHAR), but want to read sizeof(IMAGE_DOS_HEADER)

ProbeForRead( pImageBase, sizeof(IMAGE_DOS_HEADER), __alignof( pImageBase ) );