(Jul 24, 2013 04:48 PM)-Prime- Wrote: Are you sure of your self in fact BetaBot does hook KiSystemFastCall . There are differnt ways people say it like here look here: http://trojanforge.com/showthread.php?t=4543
Betamonkey says his bot hook KiSystemFastCall, buddy this is not bullshit. There are other Bots on the market which hook KiSystemFastCall.
Once again... Its KiFastSystemCall, not KiSystemFastCall. And intercepting that will only work on native 32 bit processes, for wow64 processes this won't work, especially won't work for native 64 bit processes.
That code you linked places inline hooks on single ntdll.dll exports. It is not a method to hook KiFastSystemCall. The prologue is totally different, not to mention KiFastSystemCall is not long enough to be hooked this way.
[img]http://x.hackforums.net/images/smilies/thumbsup.gif[/img]
I understand buddy but as I said on x64 I do not hook KiSystemFastCall (KiFastSystemFastCall).
It is possible to hook Zw from Usermode becuase they lie in same memory space as NT functions in Userland. By the way going to bed as it is midnight here.
(Jul 24, 2013 04:59 PM)-Prime- Wrote: I understand buddy but as I said on x64 I do not hook KiSystemFastCall (KiFastSystemFastCall).
It is possible to hook Zw from Usermode becuase they lie in same memory space as NT functions in Userland. By the way going to bed as it is midnight here.
No they don't is userland NT system calls are refered to by there Nt* names. Zw* equivalents only exist in the kernel (even if the userland equivs have aliases under this name).
Well in all fairness, 99% sure my bot is the only bot ever to actually hook KiFastSystemCall and X86SwitchTo64BitMode. Are you the programmer behind this project?
Do you mean on HF? I know of a few bots that hook X86switchto64bitmode I think. Not flaming I'm just wondering
(Jul 24, 2013 05:16 PM)Brian Krebs Wrote: Do you mean on HF? I know of a few bots that hook X86switchto64bitmode I think. Not flaming I'm just wondering
Care to name a few? I haven't heard of any.
(Jul 24, 2013 05:16 PM)Brian Krebs Wrote: Do you mean on HF? I know of a few bots that hook X86switchto64bitmode I think. Not flaming I'm just wondering
"I think". I'm not flaming either but I doubt it. None of the mainstream malwares have done it. There have been some that messed with SYSENTER MSR in kernel land, but not in userland.
This looks like it can be pretty successful. Good luck with this.
Got my answer good luck.
P.S:i'm now supporting this bot
(Jul 24, 2013 05:14 PM)betamonkey Wrote: Well in all fairness, 99% sure my bot is the only bot ever to actually hook KiFastSystemCall and X86SwitchTo64BitMode. Are you the programmer behind this project?
http://blog.rewolf.pl/blog/?p=102#.UfCnOKwXlzA
This article is pretty decent regarding that. Its pretty old, though (2011).
Edit: Not hooking, but calling x86 code in x64 process.
Hi,
I had message suggesting Ring0 rootkit is useless but look at it this way ring0 rootkit will at least your Bots will stay. As for heavens gate it was quite a bit of a messy work, the reason behind it is that, I can only use ntdll exports. I need to spruce the x64 mode hooks, at the moment I am trying to finish off the features before doing a final source code editing before major tests begin.
Next the bot does NOT drop different bins for different architecture. After doing an Code Segment change (Heavens Gate), it will switch to x64 to inject into x64 process, and vice versa.
The Bot does not use any external files (dropped files) except from *.sys needed for Ring0 rootkit on XP.
I have not tested BetaBot if it can be botkilled or not becuase to be honest I not at the stage yet because of leftover features to complete and few other protections and such.
Thanks
What is the size of software?
cterss
(Jul 24, 2013 03:12 PM)Sleazy P. Martini Wrote: Very HQ thread, Nice features, Tho not a fan of these...
![[Image: 76ba0d84f91ed0d206f1fdde6b3853ae.png]](https://gyazo.com/76ba0d84f91ed0d206f1fdde6b3853ae.png)
Kinda looks ugly but the rest of the website is nice.
who gives too much shits about the GUI
Hi,
At the moment the bot is 190kb although it will increase by few Kilo bytes becasue of other features I need to add. I am trying to cut size but I prefer quality over size.
I do understand GUI does not matter but just for those who do, the website is metro style and the buttons black border is removed and replaced with the button color to make it look more metro.
Feel So Good Plan
i'm intresting Bot-To-Bot File Sharing System Custom , Module Scripting Language
1. Can i check particular application installed?
Office , MAYA , AutoCAD , Casino , etc
2. DDOS methods: Random GET, Random Post Do you plan to add?
Looks Nice
(Jul 24, 2013 03:24 PM)KFC Watermelon Wrote: It needs to be able to kill BetaBot [img]http://renaissance.chingo.co.uk/wp-content/uploads/2010/03/070808-deniro.jpeg[/img]
You... You're a funny guy, I like you.
|
