pwn3d_align

KO | EN

gitlite — search

#python #java #python3 #arduino #golang #machine-learning #rust #html #flask #javascript #seismology #nodejs

★ 23 Open GitHub ↗

Hooking Shadow and normal SSDT with Kaspersky Hypervisor and abusing alignment

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# pwn3d_align
pwn3d_align is a x64 Windows Driver created to monitor/hide or block access from processes, objects, files using SSDT/Shadow SSDT hooks with abusing aligment.

# KasperskyHook

This techniques modifies klhk.sys aka "Kaspersky Lab service driver".
This driver is the antivirus legitimate driver, more information can be found on the [original repo](https://github.com/iPower/KasperskyHook/).

The original intetion was to monitor malware behavior on the system and the main goal is not to bypass antivirus or anticheats solutions, but, that can be done anyway.

## Compatibility
##### Lets call 'Kaspersky hooks' everything that can be done modifying klhk.sys ok?

When the definition `USE_KASPERSKY` is set the project will use _Kaspersky hooks_ that is compatible on Windows 7/8/8.1 and 10, Intel and AMD supported but Virtualization should be enabled on the BIOS.

When `USE_KASPERSKY` is not set the project will use SSDT and Shadow SSDT, that is hardcoded to Windows 7 7601 SP1 (x64 of course) only, it can also be said that **PatchGuard NEEDS TO BE TURNED OFF HERE** as there's checks for those.

## Hooks

- NtQuerySystemInformation
  - NtOpenProcess
  - NtAllocateVirtualMemory
  - NtFreeVirtualMemory
  - NtWriteVirtualMemory
  - NtLoadDriver
  - NtDeviceIoControlFile
  - NtUserFindWindowEx
  - NtUserWindowFromPoint
  - NtUserBuildHwndList
  - NtGetForegroundWindow
  - NtUserQueryWindow

## Compilation, Installation and Usage

Visual Studio 2019 required with SDK/WDK 1903
Compilation is simple, just open the project and build it using the IDE.

No driver certificate is given here, either load the driver with test signing mode enabled or sign it yourself using a valid certificate.

A debug log is generated by default, you can use a tool like DebugViewer to see those logs.
Use TestHide.exe to check if things are actually working.

KasperskyHook can be used without triggering the PatchGuard, no actually hooks can be found or checked in a normal way.

**Important note:** _KasperskyHookLoader.exe_ should be used to load the Driver if `USE_KASPERSKY` flag enabled, otherwise you can just load the driver using a ordinary way.

pwn3d_align

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README