trietptm / uberstealth

Automatically exported from code.google.com/p/uberstealth

Hi there 👋

• 🔭 I’m currently working on incident response & digital forensics (DFIR), cyber security consulting/blue teaming services, system/internal penetration testing/red teaming.
• 🌱 I’m currently learning Mathematics for Computer Science and Security Engineering.
• 👯 I’m looking to collaborate on study/researching state-of-the-art tools, techniques, tactics in binary analysis and reverse engineering.
  • Python is my favorite programming language: https://github.com/trietptm?tab=repositories&q=&type=&language=python
  • I am honoured to be mentioned in the book "The Beginner's Guide to IDAPython" (https://leanpub.com/IDAPython-Book) and some FireEye Flare-On Challenge Honor Roll pages.
• 🤔 I’m looking for help with business development in Vietnam.
• 💬 Ask me about any Cyber Security questions if you need Cyber Security Consulting (securing accounts/systems, system security assessments, cyber-security maturity assessment, suspicious/malicious file examination,...) or have a malware/hacking outbreak and need an incident compromise assessment (how and when a hacker got into your system, what post-exploitation activities they did in your system,...), malware remediation help, securing your systems and digital assets.
• 📫 How to reach me: [phone] (WhatsApp, Viber, Signal), LinkedIn (https://www.linkedin.com/in/trietptm/), Twitter DM (https://twitter.com/MinhTrietPT) or reaching me via our company Facebook page for our reverse engineering online courses: https://www.facebook.com/novasec.vn .

GitHub Stats

uberstealth's Issues

GetStartupInfoA

What feature do you suggest?
Implement countermeasures for the anti-debugging technique based on the  
GetStartupInfoA API.

Original issue reported on code.google.com by [email protected] on 13 Sep 2011 at 10:32

Absolute pathes in projects

Hidedebugger and uberstealth projects have hardcoded absolute pathes inside

Idea is to base on some environmental variable,
eg: $(OLLY), $(IDA)

Also C++ and Linker sections could reuse these...

Original issue reported on code.google.com by [email protected] on 11 Jan 2012 at 9:14

Fix usage of deprecated API

fix deprecated used API in drivers:
(from compiler output)

warning C4996: 'MmCreateMdl': was declared deprecated
warning C4996: 'MmMapLockedPages': was declared deprecated
warning C4996: 'ExAllocatePool': was declared deprecated

Original issue reported on code.google.com by [email protected] on 11 Jan 2012 at 9:33

OllyDbg windows are not hidden

What steps will reproduce the problem?
1. Select "Hide debugger windows" under "Stealth Options 2"
2.
3.

What is the expected output? What do you see instead?
The OllyDbg Windows should be hidden from the debuggee.

Please provide any additional information below.

Original issue reported on code.google.com by [email protected] on 13 Sep 2011 at 7:04

IDT hook in RDTSCEMU is not atomic

What steps will reproduce the problem?
1. Make IDT hook atomic
2.
3.

What is the expected output? What do you see instead?


Please provide any additional information below.

Original issue reported on code.google.com by [email protected] on 8 Nov 2011 at 7:28

Passing unknown exceptions does not work in OllyDbg

What steps will reproduce the problem?
1. Select "Automatically pass unknown exception to debuggee".

What is the expected output? What do you see instead?
The exceptions are not passed to the debuggee.

Original issue reported on code.google.com by [email protected] on 18 Sep 2011 at 3:39

SEH support not working in OllyDbg

What steps will reproduce the problem?
1. Selecting any of the SEH support functions has no effect.

What is the expected output? What do you see instead?
The debugger can not be halted on SEH or after EIP has changed. Logging doesn't 
work as well.

Original issue reported on code.google.com by [email protected] on 18 Sep 2011 at 3:41

NtSystemDebugControl

What feature do you suggest?
Implement countermeasures for the anti-debugging techniques based on the 
NtSystemDebugControl API.

Original issue reported on code.google.com by [email protected] on 13 Sep 2011 at 10:30

SEH support not working in IDA

What steps will reproduce the problem?
1. Select any SEH monitoring option.

What is the expected output? What do you see instead?
The debugger can not be halted on SEH or after EIP has changed. Logging also 
doesn't work.

Original issue reported on code.google.com by [email protected] on 18 Sep 2011 at 5:37

Inject stealth dll by queueing an APC

What feature do you suggest?
Dll injection upon process startup could be realized via APC injection.

Please provide any additional information below.
One advantage of APC injection is that it is more robust in the presence of 
non-standard PE headers. Also, it might be a bit more stealthy since there 
would be no image import descriptor entry in the address space pointing at the 
name/path of the injected dll.

Original issue reported on code.google.com by [email protected] on 28 Sep 2011 at 9:47

Autoadded breakpoint on each executed opcode

What steps will reproduce the problem?
1. Turn on the checkbox "Automatically hald debugger at new EIP after SEH 
exception"
2.
3.

What is the expected output? What do you see instead?
I see that when having single step tracing (TF=1) plugin puts breakpoint on 
every executed line!

What version of the product are you using? On what operating system?
built manually, taken from latest git trunk

Please provide any additional information below.

Original issue reported on code.google.com by [email protected] on 12 Jan 2012 at 6:49

Improving debugger experience

What feature do you suggest?
There should be an option to (at least) write a message to the OllyDbg/IDA log 
window whenever the debuggee tries to
1) terminate any process
2) spawn a new process with debugging flags (DEBUG_ONLY_THIS_PROCESS)
3) use WriteProcessMemory on the own address space (e.g. to evade hardware 
breakpoints)
4) possibly other events(?)

Ideally, the debugge should be halted before performing such actions.

Original issue reported on code.google.com by [email protected] on 13 Sep 2011 at 10:40

Remote WinDbg doesn't work

What steps will reproduce the problem?
1. Select remote windbg debugger
2. Start the debugger

What is the expected output? What do you see instead?
uberstealth should inject the dll into the remote process. Instead it tries to 
inject into a local process with the same process id.

Original issue reported on code.google.com by [email protected] on 24 Feb 2012 at 9:12

[deleted issue]

[deleted issue]

Remote debugging not working in IDA

What steps will reproduce the problem?
1. Enable uberstealth in IDA.
2. Start the win32 remote debugger.
3. Start the remote stealth server.

What is the expected output? What do you see instead?
The stealth options should be applied to the remote process. Instead 
uberstealth tries to inject into a process on the local machine.

Original issue reported on code.google.com by [email protected] on 18 Sep 2011 at 3:49

Improved NtClose technique doesn't work on X64 systems

What steps will reproduce the problem?
1. Select "Improved NtClose".
2. Start the debugger and let the debugge close an invalid handle.

What is the expected output? What do you see instead?
The NtClose API raises an exception but the plugin should prevent this.

Please provide any additional information below.
The issue only appears on 64 bit Windows.

Original issue reported on code.google.com by [email protected] on 26 Sep 2011 at 7:00