Skip to content

Commit 6d13482

Browse files
connarconnar
committed
Update bypassingspeakeasy.md
1 parent 55e7a6e commit 6d13482

File tree

1 file changed

+96
-7
lines changed

1 file changed

+96
-7
lines changed

‎content/posts/bypassingspeakeasy.md‎

Lines changed: 96 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ ShowToc = true
55
tags = ["speakeasy", "Obfuscation"]
66
categories = ["Malware"]
77
author = ["connar"]
8+
[markup.goldmark.renderer]
9+
unsafe = true
810
+++
911

1012
# Bypassing emulators - Exploring SpeakEasy
@@ -1101,12 +1103,99 @@ This time, to make it a bit more interesting, we will be trying to generate a ma
11011103
- One being the **total time** of running the loops (more on this later)
11021104
- One being a **key computed inside the loops**
11031105

1104-
The masterkey will essentially be:
1105-
$$K_M = K_{IDT} \oplus K_{T} \oplus K_{L}$$
1106-
where:
1107-
- $$K_{IDT} = \text{IDTR}_{\text{limit}}$$
1108-
- $$K_{T} = T_{\text{end}} - T_{\text{start}}$$
1109-
- $$K_L = \sum_{i=1}^{0x4F672} \text{Hash}(\text{API\_Return}_i) + \sum_{i=1}^{0x2B157} \text{Hash}(\text{API\_Return}_3)$$
1106+
<p>The masterkey will essentially be:</p>
1107+
1108+
<math display="block">
1109+
<msub>
1110+
<mi>K</mi>
1111+
<mi>M</mi>
1112+
</msub>
1113+
<mo>=</mo>
1114+
<msub>
1115+
<mi>K</mi>
1116+
<mi>IDT</mi>
1117+
</msub>
1118+
<mo>⊕</mo>
1119+
<msub>
1120+
<mi>K</mi>
1121+
<mi>T</mi>
1122+
</msub>
1123+
<mo>⊕</mo>
1124+
<msub>
1125+
<mi>K</mi>
1126+
<mi>L</mi>
1127+
</msub>
1128+
</math>
1129+
1130+
<p>where:</p>
1131+
1132+
<ul>
1133+
<li>
1134+
<math display="inline">
1135+
<msub>
1136+
<mi>K</mi>
1137+
<mi>IDT</mi>
1138+
</msub>
1139+
<mo>=</mo>
1140+
<msub>
1141+
<mtext>IDTR</mtext>
1142+
<mtext>limit</mtext>
1143+
</msub>
1144+
</math>
1145+
</li>
1146+
<li>
1147+
<math display="inline">
1148+
<msub>
1149+
<mi>K</mi>
1150+
<mi>T</mi>
1151+
</msub>
1152+
<mo>=</mo>
1153+
<msub>
1154+
<mi>T</mi>
1155+
<mtext>end</mtext>
1156+
</msub>
1157+
<mo>−</mo>
1158+
<msub>
1159+
<mi>T</mi>
1160+
<mtext>start</mtext>
1161+
</msub>
1162+
</math>
1163+
</li>
1164+
<li>
1165+
<math display="inline">
1166+
<msub>
1167+
<mi>K</mi>
1168+
<mi>L</mi>
1169+
</msub>
1170+
<mo>=</mo>
1171+
<munderover>
1172+
<mo>∑</mo>
1173+
<mrow><mi>i</mi><mo>=</mo><mn>1</mn></mrow>
1174+
<mrow><mn>0x4F672</mn></mrow>
1175+
</munderover>
1176+
<mtext>Hash</mtext>
1177+
<mo stretchy="false">(</mo>
1178+
<msub>
1179+
<mtext>API_Return</mtext>
1180+
<mi>1,2</mi>
1181+
</msub>
1182+
<mo stretchy="false">)</mo>
1183+
<mo>+</mo>
1184+
<munderover>
1185+
<mo>∑</mo>
1186+
<mrow><mi>i</mi><mo>=</mo><mn>1</mn></mrow>
1187+
<mrow><mn>0x2B157</mn></mrow>
1188+
</munderover>
1189+
<mtext>Hash</mtext>
1190+
<mo stretchy="false">(</mo>
1191+
<msub>
1192+
<mtext>API_Return</mtext>
1193+
<mn>3</mn>
1194+
</msub>
1195+
<mo stretchy="false">)</mo>
1196+
</math>
1197+
</li>
1198+
</ul>
11101199

11111200
We will also use the previous PoC with the `GetLastError()`. The idea here is to:
11121201
- Encrypt / Decrypt the shellcode with the masterkey.
@@ -1579,7 +1668,7 @@ We will be now using a different approach, mimicking how the windows kernel itse
15791668
>
15801669
> - While the names of variables in a C struct might change or be renamed in a new SDK (at compilation time), the binary offset (like `0x60` for the PEB or `0x18` for the LDR) is a hardcoded constant in the Windows Kernel's own source code. If we take a look at the dissasembly of any internal Windows function that accesses the PEB, we will see instructions like `mov rax, gs:[60h]`, `mov rax, [rax+18h]`.
15811670
>
1582-
> - These are the exact raw offsets we will use in our new mathematical PEB walk. The kernel doe snot know the name Ldr, it only knows that the pointer it needs is 24 bytes (`0x18`) from the start of the PEB.0
1671+
> - These are the exact raw offsets we will use in our new mathematical PEB walk. The kernel doe snot know the name Ldr, it only knows that the pointer it needs is 24 bytes (`0x18`) from the start of the PEB.
15831672
15841673
Here is an additional explanation of the code, before we move into the full sample:
15851674
```c

0 commit comments

Comments
 (0)