Protecting what you value.

Protect what you value.

Rootkits Part 2:
A Technical Primer
by Aditya Kapoor and Ahmed Sallam
 www.mcafee.com

Rootkits Part 2: A Technical Primer

In “Rootkits Part 1: The Growing Threat,” we highlighted an important emerging trend in
information security: the increasing pervasiveness of stealth technologies—called rootkits—in
malware. Rootkits shield the files, processes, and registry keys of malware so that they can
carry on their malicious activities without a user’s knowledge. And when a user does discover
a rootkit infection, removing it is often too difficult for the typical user.
In this white paper, we examine the Code for applications such as Internet
technologies that make stealth Explorer and Microsoft Word execute
possible on the Microsoft® Windows within ring 3. A number of Windows
platform. After a brief explanation services run at this level. These include
of the basic security architecture of Service Control Manager, Local System
Windows, we explore the many Security Authority, Winlogon, Session
methods that have been discovered Manager, and RPC Server. Kernel-level
for hiding files, processes, and registry code runs within ring 0 and is used
keys. We begin with user-mode in device drivers and Windows kernel
rootkits, which operate at the same system components such as managers
privilege level as the user who for virtual memory, cache, I/O, object,
installed it. Most of the common plug and play, as well as the hardware
stealth technologies to date fall into abstraction layer, graphics subsystem,
this category. Rootkits that operate file systems, and network protocol
at the higher, system privilege level, implementations. Other examples of
on the other hand, are not nearly as legitimate code running with system
common, but they are quite difficult privileges are device drivers that
to remove because their processes control sound, keyboard, printer,
have system privileges. At the end other peripherals, and various system
of this paper, we describe this latest monitoring and anti-virus tools.
trend in stealth technologies.
Figure 1 (next page) shows a high-
Windows Architecture level view of a simple user-mode
application’s execution path. User
The i386 architecture supports four applications constantly require
rings (numbered 0 to 3), or privilege underlying operating-system kernel
levels, to protect system code and and hardware resources, with these
data from being unintentionally or interactions managed by the operat-
maliciously overwritten by lower ing system. To communicate with the
privileged code. Ring 0 is the highest kernel, user-mode applications use
privilege level, while ring 3 is the Win32 API calls, which are exported
lowest. Windows uses two privilege by the set of dynamic link libraries
levels (rings 0 and 3) for process and (DLLs) that comprise the Win32
data security. Using only two privilege subsystem; among them are
levels enables Windows to run on advapi32.dll, user32.dll, gdi32.dll,
CPU architectures that do not support kernel32.dll, shell32.dll, comctl32.dll,
all four. and comdlg32.dll.


Rootkits Part 2: A Technical Primer www.mcafee.com

When a function call is made to the via a special processor facility that
Win32 subsystem, it may, in turn, could be either an interrupt (INT 02E
carry out one of the following for Windows 2000 and older Windows
four activities: NT systems) or the SysEnter/SysExit
instructions (for Windows XP and
• Deal with the request locally, inside Windows Vista).1
the user-mode space and not call
into the kernel. The kernel32.dll is commonly mistaken
• Call into a user-mode service such as the Windows kernel. Kernel32.dll is
as csrss.exe, which is responsible actually a user-mode DLL that simply
for keeping the Win32 subsystem passes on requests for the kernel to
running. This process maintains ntdll.dll, another DLL that operates
the Win32 processes state-related in user mode. Windows kernel
information and returns informa- functions actually reside in ntoskrnl.
tion to the calling APIs. exe. The file win32k.sys is another
• Issue a remote procedure call to kernel-mode component that exists
one of the running Windows within the Win32 subsystem. Other
services that acts as the server subsystems, such as OS/2 and POSIX,
for that specific RPC interface. are included only to provide backward
• Make an API call that requires the compatibility.
services of the kernel. This category
of API call actually calls into the cor- A rootkit must alter the flow of this
responding function in the ntdll.dll. normal execution path to make its
stealth implementation successful. This
Ntdll is a special-purpose DLL that modification can occur via a process
contains internal support functions called system hooking. The Windows
and system-service dispatch stubs to architecture itself supports many
executive functions. Ntdll.dll maps the easily implemented hooking methods
incoming API requests to their cor- to keep itself flexible and extendible.
responding kernel services through a Rootkits normally modify the data
mechanism called system service returned by Windows system function
dispatching. The control from user calls to hide their binary files,
mode to kernel mode is transferred processes, and registry entries.

A Simple User-Mode Application’s Execution Path

User Mode
User Application/Services

Other Subsystems,
OS/2, POSIX Advapi32.dll Kernel32.dll User32/GDI23 Login/GINA

Ntdll.dll Runtime Library

Kernel Mode
Executive
Ntoskrnl.exe
Underlying Kernel

Hardware Abstraction Layer

Figure 1. Windows user- and kernel-mode Hardware

interaction for Win32 systems


Rootkits Part 2: A Technical Primer www.mcafee.com

Depending on where they run and alternative method of hooking is for

what area in the system they hook, the malware author to write arbitrary
rootkits’ stealth technology comes code using the WriteProcessMemory
in two flavors: user mode and kernel function of the Windows API. Figure 2
mode. User-mode rootkits are shows the most commonly used
relatively easy to detect and repair code-injection attack vectors.
because they execute with user-mode
privileges. Kernel-mode rootkits, on The following section briefly describes
the other hand, execute with system the variety of vectors through which
privileges, making them more attacking code can inject itself. All of
challenging to detect and repair. these techniques rely on documented
Windows APIs that are commonly
User-Mode Rootkits used by utilities, development tools,
debuggers, security tools, and others.
Simple user-mode rootkits (for Therefore, merely detecting the use
example, Qoolaid2) can hide from of these techniques is not sufficient
process viewers, such as the Windows evidence of rootkit activity.
Task Manager, by hooking the specific
viewer process. However, its effective- Injection by application extensions
ness depends on its ability to hide The Windows operating system,
from virus scanners and other security Windows Explorer, and Internet
tools. The stealthier Adclicker-BA3 Explorer are designed to be program-
Trojan hooks all running processes for matically extensible. Here are some
this purpose. This tactic, however, may examples:
not always work.
• Windows NT, 2000, and XP support
Installation vectors the use of the registry key
To alter the execution path of HKEY_LOCAL_MACHINE\Software\
commonly used APIs, user-mode Microsoft\WindowsNT\Current
rootkits may execute within another Version\Windows\AppInit_DLLs. If
process by loading a DLL into the the value of AppInit_DLLs points
memory space of the target. However, to a rootkit DLL, then during the
the rootkit need not run inside the process load time AppInit_DLLs
memory of the hooked process. An causes every process that loads

Common Methods for Malware Attacks

Process Attacking Malware
User Code 1. AppInit_DLLs

2. SetWindowsHookEx

3. CreateRemoteThread

4. WriteProcessMemory
Kernel32.dll

Rootkit code

Figure 2: Code-injection attack vectors


Rootkits Part 2: A Technical Primer www.mcafee.com

user32.dll to also load the rootkit any running process over which the
DLL listed under this same reg- malicious process has access rights.
istry. That rootkit DLL will then One typical technique is to call
have access to the process address CreateRemoteThread while
space and can apply different specifying the address of the
methods of hooking to the process LoadLibrary function and the name
code and data sections. Malware of the attacking DLL. This loads the
attacks Urbin4 and Adware-FCHelp5 attacker’s library inside the victim’s
employed this technique. process address space. Once in that
• Internet Explorer toolbar and space, the malware can monitor and
search extensions, browser helper alter API calls. (This function is also
objects, etc. employed by many legitimate
• Windows Explorer shell extensions applications to create a thread in
• Microsoft Office applets, plug-ins, another running application so that
and controls it shares its resources or queries
heap and process information.)
Injection by Windows Adcliker-BA Trojan uses this
messaging filtering injection vector.
The Windows Messaging System • WriteProcessMemory can write
allows the installation of message code over any existing process
filters to support a wide range of memory to which it has access.
functions. Computer-based training SetThreadContext can then modify
is one example. To install a filter, the thread’s extended instruction
Windows provides an interface that pointer to redirect the execution
can place a given library in each pro- of the thread into the newly
cess address space. written code bytes. The
WriteProcessMemory injection
• SetWindowsHookEx can be called method works in much the same
to hook one or more system way as CreateRemoteThread, except
events. Hooks can be set for any that no new DLL loads, and the
input method or for any Windows malicious, inserted code can exist
message generated for a single only in memory, which makes
application. Applications running detection and cleanup more
on the same desktop as the call- difficult. HackerDefender is the
ing thread are frequent targets. All classic example of a Trojan
hooked events are opportunities for implementing this technique.
the rootkit to alter subsequent API
call results. Injection by application vulnerability
Windows applications have many
Injection by debugging subsystem methods for interprocess communi-
The debugging subsystem provided cations, in addition to other inputs
by Windows allows one application to using network connections and local
debug and influence the execution files shared with other applications.
of another application. Assuming Usually, local applications are not
enough privileges are available to restricted to communicating solely
the user running the debugger, it with other local applications, thus
is possible to create new execution allowing a wide range of possible
threads in a target process, as well attack paths. If an application contains
as read and write from its memory buffer overflow vulnerability, or trusts
address space. a local file that can be modified by
another application, malware can gain
• CreateRemoteThread can run code control of the code executed inside a
remotely into the address space of vulnerable application.


Rootkits Part 2: A Technical Primer www.mcafee.com

Payload techniques Once within the target process’

address space, the rootkit DLL can
Once a DLL is loaded into the target parse the portable executable file
address space, the user-mode rootkit format and find the location of the
intercepts and modifies an API target function within the IAT. Then
function’s result to maintain the it’s easy to replace the target function
illusion that it and any objects it is with a hook function from the rootkit
hiding do not exist. This interception code. As a result, the rootkit code
occurs through one of two techniques: executes whenever the target API is
import address table hooking, or called, and data passing to and from
inline function hooking. the target function is altered. (These
techniques can be used to hook any
Import address table hooking API, and are not limited to kernel32.
Figure 3 shows the top-level structure dll.)
of a portable executable file header.
The import data section, idata, Figure 4 shows rootkit code modifying
contains addresses of imported the IAT. This simple technique is
functions. When a program is widespread, and has been found
compiled, not all of the API calls in Adclicker-BA,3 AFXRootkit,6 and
within that program are linked to the Qoolaid Trojan.2
library modules in which they reside.
These API calls are redirected through Inline function hooking
the import address table (IAT), using Inline function hooking (also known
standard assembly-language instruc- as detour functions) differs from IAT
tions. When the process loads binary in that it redirects the call to the
Headers hacker’s code by modifying it once the
memory, it resolves the addresses
Code section .text inside the IAT; thus the instructions actual code is in the core system DLLs.
Data section .data follow the new address. This archi- The rootkit modifies only the first few
Import data section .idata tecture allows the binary code to be bytes of the function inside the core
ported to various operating systems system DLLs (kernel32.dll and ntdll.
Export data section .edata
without recompiling. dll), placing an instruction so that any
Figure 3: The portable executable
file format
Rootkit Code Modifying the IAT
Process (before hooking) Process (after hooking)
Code section … Code section …
Call dword ptr Call dword ptr
[FindNextFilePtr] [FindNextFilePtr]
0x70034622
Import data section Import data section
FindNextFilePtr: FindNextFilePtr:
0x12345678 0x12345678
Kernel32.dll Kernel32.dll
0x12345678: 0x12345678:
FindNextFile code FindNextFile code
Rootkit code
Call HookCode
0x70034622:
MyFindNextFile …
Jmp 0x12345678
Figure 4: IAT hooking routine


Rootkits Part 2: A Technical Primer www.mcafee.com

process calls will hit the rootkit first. use kernel-mode programs to monitor
As with IAT, the rootkit code checks for system-wide changes and to access
to see if the parameters indicate kernel-level permissions to defend
the need to falsify results and then against malicious activity by any file.
responds appropriately. For security products, kernel-mode
execution brings the added advantage
Figure 5 illustrates the differ- that the program cannot be deleted
ences between the two techniques. by most user-mode processes.
Resuming normal execution paths
after hooking requires that the initial A device driver running with kernel
five bytes of the original FindNextFile privileges has full access to all system
function (inside kernel32.dll) be data, and permission to terminate any
replaced at location 0x12345678, running service or process. Rootkit
before jumping back to kernel32.dll technology’s next logical step is to
code. (The initial bytes are saved in operate in kernel mode with system
the Trampoline Function.7) privileges. By operating at the same
User-mode rootkits that use this high privilege level as security tools,
technique include Adclicker-BA,3 rootkits will better avoid detection
AFXrootkit,6 Adware-Elitebar,8 and deletion.
and Backdoor-BAC.9

Rootkit Code Modifying the Inline Function

Process (before hooking) Process (after hooking)
Code section … Code section …
Call FindNextFile Call FindNextFile
Import data section Import data section
FindNextFile: 0x12345678 FindNextFile: 0x12345678
Kernel32.dll Kernel32.dll
0x12345678: 0x12345678: FindNextFile
FindNextFile code Rootkit code
Replace first
0x70034622: 5 bytes of
code
MyFindNextFile with
jmp
0x70034622
Figure 5: Inline hooking routine

Kernel Mode: Kernel-mode rootkits require that

the Next Step for Rootkits their code be loaded into the kernel
address space, which rootkits typically
Kernel-mode programming is com- achieve by installing a kernel-mode
monly used by legitimate applications, device driver. Once the delivery
such as system device drivers and mechanism is in place, kernel-mode
anti-virus programs. System device rootkits can implement various hooks
drivers use kernel-mode programs to into API calls. This method is similar to
access low-level kernel objects and the tactics used by user-mode rootkits,
functions, and to interface with the except that the hooks operate at a
underlying hardware. Anti-virus tools higher privilege level.


Rootkits Part 2: A Technical Primer www.mcafee.com

Payload techniques: 2e / SYSENTER to transfer control to

already in the wild kernel mode after setting the
target function index in a processor
Although there are many kinds of register (EDX) (See Figure 6.). In
kernel-mode rootkits, their complexity kernel mode, the system service
and limited compatibility have made dispatch handler function, which
them no more common than resides inside ntoskrnl.exe, uses the
user-mode attacks. Here are several function index in the EDX register to
examples of current kernel-mode locate the corresponding system ker-
payload techniques: nel function (NtCreateFile) inside the
System Service Descriptor Table (SSDT).
System service descriptor
table modification Inside the kernel, device drivers
As we briefly mentioned in the call the Zwxxx functions inside
Windows architecture section, Win32 ntoskrnl.exe. Zwxxx functions set the
subsystem libraries pass the calls they EDX register with the target function
receive from user-mode applications index and then call the kernel-mode
to the system kernel via system service system service dispatch handler, which
dispatching. Now we’ll discuss this will look up the target function inside
process in more detail. the SSDT via the function index in the
EDX registers.
User-mode APIs, such as CreateFileW,
are implemented in kernel32.dll, By modifying the contents of the SSDT
which calls the native API NtCreateFile to point to a rootkit replacement
implemented in ntdll.dll. In turn, ntdll. function, all API calls, regardless of
dll calls the processor instruction INT their origin (user-mode application

Passing Calls to Kernel Mode Gives Rootkits an Opening

User Mode
User Mode Program
Headers
Call CreateFileW…
Kernel32.dll
0x77E7B091:…
Call NtCreateFile…

Ntdll.dll
0x77F7595E:
mov edx, …
Int 2E / SYSENTER

System Service Interrupt (2E)

Descriptor Table Descriptor Table

NtCreateFile
Index
System Service
Dispatcher

Figure 6: Call flow displaying the role of Kernel Mode

the System Service Dispatcher


Rootkits Part 2: A Technical Primer www.mcafee.com

or kernel-mode device driver), can process enumeration services by

be redirected to first call the rootkit removing the process entry from the
code. Approximately 50 percent of PsActiveProcessHead list. The rootkit
the rootkits observed in the wild author can use the same approach on
implement this technique. (See other system objects lists, such as the
Appendix, on page 14, for a break- PsLoadedModuleList.
down of techniques.)
Filter device drivers
Although relatively more sophisticated A filter device driver attaches itself
than user-mode rootkit techniques, on top of the I/O stack of an exist-
the disadvantage of SSDT ing device driver. A device driver can
modification is its susceptibility to attach to the NT file system driver
signature-based detection by most or to the TCP/IP driver. With this
memory scanners. A scanner can technique, malware authors can
search the memory for known intercept and modify all file system
patterns to weed out the rootkit. or network requests (from a layered
service provider). Because security
Each process running in memory has products install themselves as filter
an entry in a doubly linked list called drivers as well to be effective, rootkit
PsActiveProcessHead. Processes hidden filter drivers must attach themselves
using SSDT modifications can easily be to the I/O stack below the security
uncovered by querying elements of driver, so that they are called before
this list. The query results can be any security product filter drivers.
compared to the list of running pro-
cess obtained via user-mode The first observance of filter drivers in
applications such as Windows Task the wild occurred in September 2005,
Manager. Any difference can raise an with the discovery of the WinKRootkit
alarm, exposing the hidden process. Trojan. The filter driver loads at boot
time, before any anti-virus scanner
Direct kernel object modification starts, making the files it protects very
To overcome the limitations in difficult to delete after the system
querying processes listed in an has booted. (WinKRootkit protects
PsActiveProcessHead list to discover Adware-CommonName12 files from
hidden processes, author fuzen_op deletion.)
(author of FuRootkit10,11) came up
with a more sophisticated mechanism Because they are layers already added
called direct kernel object modifica- in, adding a filter driver before the
tion, or DKOM. This approach raised anti-virus scanner’s layer may be the
the bar of detection once again. next logical step for hiding from
traditional scanners. This technique
Non-file traces of a running rootkit offers the scanner a subverted view
can be hidden by directly manipulat- of the data.
ing kernel objects that store lists of
running processes, threads, services, Kernel-mode system
ports, drivers, and handles. Linked services handler modification
lists can be snipped and resewn with- A hook to the user-mode-to-kernel-
out affecting their functionality. The mode transition mechanism allows
rootkit can also modify kernel objects the rootkit to hook all function calls
by directly calling the Windows that go via the SSDT. Thus, this
Object Manager. By calling the Object technique can either hook the
Manager to modify a token object, INT 2E handler, or for newer versions
for example, the rootkit can hide a of Windows, hook the SYSENTER
process from standard system handler. When the SYSENTER


Rootkits Part 2: A Technical Primer www.mcafee.com

instruction executes, the location of to rootkit code instead of to normal

the system service handler function code, the rootkit can hook arbitrary
is stored in a model-specific register kernel functions. Critical system
named IA32_SYSENTER_EIP. A rootkit calls, such as privilege and authen-
can install a kernel-mode driver that tication checks, can be intercepted
will read this value (using Intel instruc- and replaced with code that always
tion rdmsr) in ring 0 and overwrite returns full access privileges.
it (instruction wrmsr) with the hook These intercepts can even replace
function, later calling the original loader functions, BIOS code, and firm-
address. This allows the rootkit to ware code.
hook the Interrupt Descriptor Table
and intercept that register’s contents This technique is demonstrated by
while pointing the interrupt handler the PWS-Gogo14 and Apropos15
to rootkit code, modifying the call’s Trojans. While the former hooks a
results. non-exported function in ntoskrnl.
exe called CMEnumerateKey, the
Code for the SYSENTER hook is latter modifies various APIs such
available at www.rootkit.com/vault/ as NtQuerySystemInformation and
fuzen_op/SysEnterHook.zip. A recent NTQueryDirectoryFile to hide files
Trojan, Spam-Mailbot.c,13 demon- and processes. Moreover, Apropos
strates this technique: It saves the file uses an interesting method of
in alternate data streams and hides redirecting the original code to its
itself, making it very tough for device driver. (See Figure 7.) Instead
anti-virus scanners to detect. of creating a “jump” or a “call” at
the function’s entry point, it writes
Runtime detour patching code to create an exception. This
Unlike DKOM, runtime detour exception is handled by patching
patching modifies code instead of Interrupt Descriptor Table (IDT) regis-
data structures. By directly modify- ter nt!KiTrap0C, which points to code
ing kernel memory so that it points within the rootkit’s device driver.

NtQuerySystemInformation NtQuerySystemInformation
(Original) (Apropos Hook)

68 10 02 00 00 push 210h 68 10 02 00 00 push 210h

68 58 6E 41 00 push offset_ 50 push eax

dword_416E58 8BC3 mov eax, ebx
2BC3 sub eax, ebx
E8 95 D9 F5 FF call sub_40BE73
48 dec eax
Figure 7: The Apropos Trojan gains Exception! 8B38 mov edi,ptr
dword dword
ds:[eax]
control by writing code that eventually ptr ds:[eax]
leads back to Apropos’ device driver.


Rootkits Part 2: A Technical Primer www.mcafee.com

Input/output request packet Hooking SystemCallStub

function table modification In user mode, system calls reside inside
Device drivers interpret input/output ntdll.dll. Each system call is composed
request packets (IRPs) to execute of a standard subroutine that looks
specific requests. For example, file like this:
system drivers use IRPs for reading

ntdll!NtCreateFile:
7c90d682 b825000000 mov eax, 25h
7c90d687 ba0003fe7f mov edx, offset SharedUserData!SystemCallStub
7c90d68c ff12 call dword ptr [edx]
7c90d68e c22c00 ret 2Ch

and writing to files, and network The address SharedUserData!SystemCa

drivers use IRPs to send and receive llStub is common in every ntxxx
network packets. Each device driver function, and contains the address of
has a set of driver dispatch routines, the KiFastSystemCall, which follows:
each of which handles a specific IRP.
Dispatch routines are stored inside the ntdll!KiFastSystemCall:
DEVICE_OBJECT structure that 7c90eb8b 8bd4 mov edx, esp
represents the device driver. The root- 7c90eb8d 0f34 sysenter
kit device driver can directly hook
the driver dispatch routines inside
the file system, or in the network By modifying the address of
device driver’s DRIVER_OBJECT struc- KiFastSystemCall, which is pointed to
tures and then gain control before by the SharedUserData!SystemCallS
the device driver routines are called. tub, the rootkit can take control of
DRIVER_OBJECTS can be located all the function calls made from user
through DEVICE_OBJECT structures, mode to kernel mode.
which can be located through the
IoGetDeviceObjectPointer API. Using Network driver interface
these techniques, the rootkit code specification manipulation
runs prior to the original driver call, Windows Network Driver Interface
allowing the rootkit to inspect and Specification (NDIS) provides a
modify the results before returning framework for network driver imple-
them. This technique is implemented mentations. A rootkit can break the
by PWS-Gogo, which hooks the interface between the network’s
routines IRP_MJ_CREATE and IRP_MJ_ physical device driver and the NDIS
DIRECTORY_CONTROL device driver, hook NDIS pointers, or
in ntfs.sys. patch the NDIS driver code to take
control before the firewall driver
Payload techniques: can. The DeepDoor rootkit and the
lab implementations Peligroso rootkit by Greg Hoglund
demonstrated methods to hook to
Although there is nothing to stop the Windows NDIS stack. Alexander
the following techniques from Tereshkin’s presentation at the
being distributed in wild, there is Black Hat USA 2006 conference
no evidence that they are currently demonstrated various techniques
being used in malware. for hooking the Windows NDIS stack.

10
Rootkits Part 2: A Technical Primer www.mcafee.com

Payload techniques: When accessing a virtual memory

proof of concept address, the processor relies on
virtual-to-physical memory address
All of the kernel-mode stealth translation tables called Page
techniques we’ve described have an Directory Entries (PDE) and Page
inherent flaw. To function, they must Table Entries (PTE). (See Figure 8.)
maintain their presence in memory, PTE contain flags that define the
which makes it impossible for them status of the page, such as present or
to remain undetected by memory not, user mode or kernel mode, etc.
scanners. The stealth development The operating system supplies those
community quickly came to realize entries for the allocated memory
that in order to circumvent all pages, and the processor reads those
scanners, they had to wipe their tables to locate physical pages in
traces from memory. memory. Because this address
translation is “expensive” and occurs
The following techniques have been every time the memory is accessed,
demonstrated only as proofs of the processor maintains an internal
concept and, to the best of our dedicated cache for the memory
knowledge, have yet to be seen in translation. Those tables are called
the wild. They provide a glimpse Translation Look-aside Buffers
of the probable future of rootkits. (TLB). (See Figure 9, next page.)
The processor maintains two sets of
Virtual memory subversion TLB—one for data pages mapping
Virtual memory subversion exploits (DTLB) and one for instructions map-
the Windows memory subsystem, ping (ITLB). The operating system does
making detection by scanners not have direct read or write access to
challenging. Rootkit memory pages DTLB but can invalidate them using
are marked as non-present pages, special instructions.
which result in a page fault each time
the page is accessed for a read. The This technique16 generates a page
page fault handler (INT 0E) is hooked, fault by marking the associated
supplying false data to the caller if rootkit code as not present inside the
the malware author believes the PTE. When hooking the page fault
calling process to be a defender. handler (Int 0E), the rootkit checks to
see if the calling instruction pointer

Linear Address
31 22 21 12 11 0
Directory Table Offset

12 4KB page

10 10 Page Table Physical Address

Page Table Entry

20
Directory Entry

1024 PDE = 1024 PTE = 220 pages

32*
Control Register 3
(Page Directory
Figure 8: Mapping of linear *32 bits aligned onto a 4KB boundary
Base Register)
addresses to physical addresses by
Intel 32-bit processors

11
Rootkits Part 2: A Technical Primer www.mcafee.com

and the fault address are the same. target system. Because software
If they are not, the caller is trying to running on the target system can’t
execute read only and not execute a assess the state of this type of rootkit,
kernel-mode call. Thus, the rootkit can the software fails to even detect it.
modify the results before returning
them by changing the PTE temporarily SubVirt is permanent and has to take
to map to a garbage page and then control during the boot phase—
accessing that page, which results before the operating system starts.
in the processor updating the cor- Therefore, it can be detected only by
responding DTLB entry. When control booting the system in an offline
returns to the processor to execute scanning mode. SubVirt is based on a
the faulting memory read again, the commercial virtual machine monitor,
CPU will do the translation based on which allows for easier detection.
the entry inside its updated DTLB.
Blue Pill:
SubVirt: processor-based virtualization
malware as virtual machines Both Intel and AMD have extended
Conceptually, virtual machine–based their 64-bit processor instruction sets
rootkits (VMBRs)17 install a virtual to support hardware virtualization.
machine monitor beneath an existing Blue Pill18 is a new conceptual root-
operating system and hoist the kit that uses the new virtualization
original operating system into a instructions provided by AMD’s Secure
virtual machine. Virtual machine– Virtual Machine extension. Blue Pill
based rootkits are hard to detect and uses ultrathin hypervisor, and all the
remove because their state cannot be hardware is natively accessible with-
accessed by software out negatively affecting performance.
running in the target system. Further, The key to Blue Pill is its ability to
VMBRs support general-purpose install itself on the fly—without
malicious services by allowing such modifying the BIOS, boot sector, or
services to run in a separate operating system files.
system that is protected from the

Physical Memory

System Bus
(External) Data Cache
L2 Cache L3 Cache†
Unit (L1)

Instruction
TLBs
Bus Interface Unit
Data TLBs

Instruction Decoder Trace Cache Store Buffer

Figure 9: Cache structure of Intel’s Pentium †

Intel Xeon procssors only
4 and Xeon processors

12
Rootkits Part 2: A Technical Primer www.mcafee.com

Raw network manipulation New functionality can be programmed

This approach uses raw sockets to sniff in a higher-level ACPI Source
or forge network packets at a level Language, be compiled into machine
lower than most intrusion prevention language, and then be flashed into
systems and firewall products operate, the tables. The ability to flash the
thus masking the rootkit’s network memory depends on whether the
activities. motherboard allows the BIOS to be
changed by default or if a jumper or
Firmware and setting in the machine setup program
hardware manipulation has to be changed.20
A rootkit can install itself into firm-
ware or hardware, such as a Conclusion
network card, hard drive, or even
the BIOS. By targeting the BIOS, the Although stealth techniques are
rootkit can survive reboots and power hardly new to malware, the recent
cycles, leave no traces on disk, survive rapid increase in the prevalence and
the reinstallation of the operating sophistication of Windows rootkits
system, and effectively subvert it. brings to light an alarming trend in
These rootkits are very complex to malware evolution. The legitimizing
implement and are not portable; effect of commercial software that
they change from device to device employs stealth technologies to cloak
and have to support different BIOS its files and processes only reinforces
versions as well. the reality that these technologies
are here to stay. Driven by financial
Advanced Configuration and incentives, innovations in stealth
Power Interface manipulation methods and rootkits are leading us
A collection of functions for away from user-mode and toward
power management, Advanced kernel-mode techniques. These new
Configuration and Power Interface techniques will challenge the security
(ACPI) has its own high-level community, creating hardier and ever
interpreted language. ACPI can more virulent strains of malware that
be used to code a rootkit and store may prove to be nearly undetectable
key attack functions in the BIOS’ and undeletable. For now, the only
flash memory.19 technical barrier blocking this
transition to kernel-mode hooking is
The firmware on most modern the poor cross-platform compatibility
motherboards has tables associat- of these low-level intercepts. In future
ing commands in the ACPI Machine papers we will describe and analyze
Language to hardware commands. strategies to combat rootkits.

Aditya Kapoor is a research scientist at Ahmed Sallam is an architect with

McAfee Avert Labs. He is experienced McAfee Avert Labs and is the
in program analysis and disassembly Approval Board Chair/Manager of
techniques, and amuses himself with McAfee’s internal R&D program.
program comparison, rootkit analysis Sallam overseas many advanced
and mitigation, and code behavior research and development projects
analysis. in various software security areas,
including rootkits and stealth
computer attacks, spyware, software
behavioral analyses, operating system
security, and systems virtualization.

13
Rootkits Part 2: A Technical Primer www.mcafee.com

Appendix

This table details the prevalence of various user- and kernel-mode techniques
found in rootkits today. Data from McAfee Avert Labs.

Kernel-Mode
Techniques

Techniques
User-Mode

Malware prevalence according

IRP table modification

Number of variants
in wild since 2003
to variant count
SYSENTER

Memory
DKOM
Inline

Filter
SSDT
IAT
Malware name

NTillusion X N/A 0

BootRootkit X N/A 0

Shadow Walker X X N/A 0

Vanquish X Low 1

Rootkit-DigitalNames X Low 1

Sony, F4I rootkit X X Low 1

WinKRootkit X Low 1

PWS-Gogo X Low 2

Adware-PigSearch X X Low 5

CommonName X Low 7

ISearch X Low 8

Backdoor-ALI X Low 9

He4hook.sys X Low 9

FURootkit X Moderate 10

CoolWebSearch X Moderate 11

W32/Maddis.worm X Moderate 15

AFXRootkit X Moderate 40

PWS-Progent X X High 48

Spam-Mailbot.c X X High 48

Qoolaid X High 58

Vanti X X High 60

Elitebar, AdClicker-BA X X High 77

PWS-Goldun X High 223

HackerDefender X High 304

Backdoor-BAC X X High 394

W32/Feebs X High 556

Backdoor-CKB X High 707

Frequency
of technique
3 10 12 4 1 3 1 1 2595
Table 1

14
Rootkits Part 2: A Technical Primer www.mcafee.com

1 Greg Hoglund and Jamie Butler, “Rootkits: Subverting the Windows Kernel,”
Addison-Wesley Professional.
2 Adware-Qoolaid, http://vil.nai.com/vil/content/v_126149.htm
3 AdClicker-BA, http://vil.mcafeesecurity.com/vil/content/v_128301.htm
4 Urbin, http://vil.nai.com/vil/content/v_125663.htm
5 Adware-FCHelp, http://vil.nai.com/vil/content/v_137814.htm
6 AFXrootkit, http://vil.nai.com/vil/content/v_102335.htm
7 Galen Hunt and Doug Brubacher,
“Detours: Binary Interception of Win32 Functions,”
http://www.usenix.org/publications/library/proceedings/
usenix-nt99/full_papers/hunt/hunt.pdf
8 Adware-EliteBar.dll, http://vil.nai.com/vil/content/v_133782.htm
9 Backdoor-BAC.gen.dr, http://vil.nai.com/vil/content/v_138676.htm
10 FURootkit, http://vil.nai.com/vil/content/v_127131.htm
11 FU rootkit description, http://rootkit.com/project.php?id=12
12 Adware-CommonName, http://vil.nai.com/vil/content/v_100875.htm
13 Spam-Mailbot.c, http://vil.nai.com/vil/content/v_140181.htm
14 PWS-Gogo, http://vil.nai.com/vil/content/v_141447.htm
15 Apropos, http://vil.nai.com/vil/content/v_137345.htm
16 Sherri Sparks and Jamie Butler, “ ‘Shadow Walker,’
Raising the bar for rootkit detection,”
www.blackhat.com/presentations/bh-jp-05/bh-jp-05-sparks-butler.pdf
17 Samuel T. King, Peter M. Chen, Yi-Min Wang, Chad Verbowski, Helen J. Wang,
and Jacob R. Lorch, “SubVirt: Implementing malware with virtual machines,”
http://www.eecs.umich.edu/virtual/papers/king06.pdf
18 Joanna Rutkowska, “Subverting Vista Kernel for Fun and Profit,”
The Symposium on Security for Asia Network.
19 Robert Lemos, “Researchers: Rootkits headed for BIOS,”
http://www.securityfocus.com/news/11372
20 John Heasman, “Implementing and Detecting ACPI BIOS Rootkit,”
Black Hat Europe 2006 conference.

© 2007 McAfee, Inc. No part of this document may be reproduced without the expressed written
permission of McAfee, Inc. The information in this document is provided only for educational
McAfee, Inc. purposes and for the convenience of McAfee’s customers. The information contained herein
3965 Freedom Circle is subject to change without notice, and is provided “as is” without guarantee or warranty
Santa Clara, CA 95054, as to the accuracy or applicability of the information to any specific situation or circumstance.
888.847.8766 McAfee, Avert, and Avert Labs are trademarks or registered trademarks of McAfee, Inc. in the
www.mcafee.com United States and other countries. All other names and brands may be the property of others.

15