Method and system for detecting windows rootkit that modifies the kernel mode system service dispatch table
View Patent ↗A method, system, and computer program product for detecting a kernel-mode rootkit that hooks the System Service Dispatch Table (SSDT) is secure, avoids false positives, and does not disable security applications. A method for detecting a rootkit comprises the steps of calling a function that accesses a system service directly, receiving results from calling the function that accesses the system service directly, calling a function that accesses the system service indirectly, receiving results from calling the function that accesses the system service indirectly, and comparing the received results from calling the function that accesses the system service directly and the received results from calling the function that accesses the system service indirectly to determine presence of a rootkit.
1. A computer-implemented method for detecting a rootkit, comprising:
identifying a plurality of real addresses within an operating system kernel by accessing a plurality of kernel export tables, wherein the plurality of real addresses are associated with a kernel mode Nt function;
scanning a system service dispatch table (SSDT) in order to determine if unwanted modifications have occurred in the SSDT, wherein the scanning includes comparing the plurality of real addresses with a plurality of addresses within the SSDT;
determining a real address of a function that accesses a system service directly from inside the kernel for comparison with another address;
calling the function that accesses the system service directly;
receiving results from calling the function that accesses the system service directly;
calling a function that accesses the system service indirectly;
receiving results from calling the function that accesses the system service indirectly; and
comparing the received results from calling the function that accesses the system service directly and the received results from calling the function that accesses the system service indirectly to determine presence of a rootkit, wherein the function that accesses the system service directly is the kernel mode Nt function, and the function that accesses the system service indirectly is a user mode Nt function or a Zw function.
2. The method of claim 1 , wherein the step of calling the function that accesses the system service indirectly comprises the steps of:
calling a function that obtains an address of the function that accesses a system service directly; and
calling the function that accesses a system service directly using the obtained address.
3. The method of claim 1 , wherein a particular address in the table of the function that accesses a system service directly has been replaced with an address of a rootkit function.
4. The method of claim 3 , wherein the rootkit function is operable to hide a process, a thread, a file or a registry entry.
5. The method of claim 1 , wherein a particular address of the kernel mode Nt function is obtained from the SSDT.
6. The method of claim 5 , wherein the particular address in the SSDT of the kernel mode Nt function has been replaced with an address of a rootkit function.
7. The method of claim 6 , wherein the rootkit function is operable to hide a process, a thread, a file or a registry entry.
8. The method of claim 1 , wherein the real address is determined for comparison by accessing a kernel export table.
9. The method of claim 1 , wherein the scanning includes comparing the real address with an address in the system service dispatch table.
10. A system for detecting a rootkit comprising:
a processor operable to execute computer program instructions;
a memory operable to store computer program instructions executable by the processor such that the system is configured for:
identifying a plurality of real addresses within an operating system kernel by accessing a plurality of kernel export tables, wherein the plurality of real addresses are associated with a kernel mode Nt function;
scanning a system service dispatch table (SSDT) in order to determine if unwanted modifications have occurred in the SSDT, wherein the scanning includes comparing the plurality of real addresses with a plurality of addresses within the SSDT;
determining a real address of a function that accesses a system service directly from inside the kernel for comparison with another address;
calling the function that accesses the system service directly;
receiving results from calling the function that accesses the system service directly;
calling a function that accesses the system service indirectly;
receiving results from calling the function that accesses the system service indirectly; and
comparing the received results from calling the function that accesses the system service directly and the received results from calling the function that accesses the system service indirectly to determine presence of a rootkit, wherein the function that accesses the system service directly is the kernel mode Nt function, and the function that accesses the system service indirectly is a user mode Nt function or a Zw function.
11. The system of claim 10 , wherein the step of calling the function that accesses the system service indirectly comprises the steps of:
calling a function that obtains an address of the function that accesses a system service directly; and
calling the function that accesses a system service directly using the obtained address.
12. The system of claim 10 , wherein a particular address in the table of the function that accesses a system service directly has been replaced with an address of a rootkit function.
13. The system of claim 12 , wherein the rootkit function is operable to hide a process, and a thread.
14. The system of claim 10 , wherein a particular address of the kernel mode Nt function is obtained from the system service dispatch table.
15. The system of claim 14 , wherein the particular address in the system service dispatch table of the kernel mode Nt function has been replaced with an address of a rootkit function.
16. The system of claim 15 , wherein the rootkit function is operable to hide a file or a registry entry.
17. A computer program product for detecting a rootkit comprising:
a non-transitory computer readable storage medium;
computer program instructions, recorded on the non-transitory computer readable storage medium:
identifying a plurality of real addresses within an operating system kernel by accessing a plurality of kernel export tables, wherein the plurality of real addresses are associated with a kernel mode Nt function;
scanning a system service dispatch table (SSDT) in order to determine if unwanted modifications have occurred in the SSDT, wherein the scanning includes comparing the plurality of real addresses with a plurality of addresses within the SSDT;
determining a real address of a function that accesses a system service directly from inside the kernel for comparison with another address;
calling the function that accesses the system service directly;
receiving results from calling the function that accesses the system service directly;
calling a function that accesses the system service indirectly;
receiving results from calling the function that accesses the system service indirectly; and
comparing the received results from calling the function that accesses the system service directly and the received results from calling the function that accesses the system service indirectly to determine presence of a rootkit, wherein the function that accesses the system service directly is the kernel mode Nt function, and the function that accesses the system service indirectly is a user mode Nt function or a Zw function.
18. The computer program product of claim 17 , wherein the step of calling the function that accesses the system service indirectly comprises the steps of:
calling a function that obtains an address of the function that accesses a system service directly; and
calling the function that accesses a system service directly using the obtained address.
19. The computer program product of claim 17 , wherein a particular address in the table of the function that accesses a system service directly has been replaced with an address of a rootkit function.
20. The computer program product of claim 17 , wherein a particular address of the kernel mode Nt function is obtained from the system service dispatch table.
21. The computer program product of claim 20 , wherein a particular address in the system service dispatch table of the kernel mode Nt function has been replaced with an address of a rootkit function.
22. The computer program product of claim 21 , wherein the rootkit function is operable to hide a process, a thread, a file and a registry entry.